A design engineer at a subsea company leaves, and two quarters down the line a rival shows off something that took your team three years to build. For the engineering supply chain surrounding Dyce and Altens, for spin-outs from the two universities, and for the software companies servicing both of them, that event is documented in an itemised, dated format: What left? The route that it travelled? How does the rival material sit next to your originals?
◇ Footing first, then the bench time. It all begins with the free diagnostic, which is then followed by a written scope, and forensic fees must be paid before any actual examination can take place. Generally speaking, in most cases you only pay if we recover your data; the exceptions are electronic and mechanical failures, chip-level work, DVR jobs and forensic jobs. Full pricing can be found on the data recovery cost page.
Typically the engineering and product companies will identify these issues prior to all others. The issue of preservation has to be resolved before you can begin to investigate; and both processes must occur well before you confront the individual.
Trade secrets rarely leak because someone broke into your system. Instead they leave via an active user ID, mid-week, buried in the traffic of a busy network. The only time this is noticed is months later when a project bid is lost by a hair, or a rival product hits the market that has some of the same design elements. This leads to three questions and each can be answered using data from your current IT systems. What moved. By which channel. On what dates.
Work begins from images of the relevant workstations and the server that stores the files. Then, the exit trace is constructed from beginning to end. Records for devices capture the release (i.e., export) of repository and drawing collections in a single event. Activity related to browser and sync client is captured as an upload into an individual's private storage area. Activity related to printing bunches around the protected folder areas. Material deleted by someone who cleaned up after themselves is recovered. Finally, the copy is scanned for part numbers, project codes and confidential designations; therefore, if a person renamed a file when it was being exported, it would still be detected rather than slipping past on a technicality.
The moment your material sits somewhere else, parentage becomes the whole argument. CAD drawings, PDFs and Office documents all contain a record of who made them, which company, how many revisions there are and when they were saved. They also include reference numbers, and these records remain with a document even if it gets renamed and slightly edited. When compared to your original documents, those records can show which document was based on which. A copy of your work will have to come through an appropriate legal avenue (either through recovery of documents or under a court order) before a judge can weigh up whether this version is similar enough to be relevant.
IP claims get their shape early. Capture images as soon as possible, so that the record is fixed before anybody tidies, and that decides whether your application for interim interdict, or an order under section 1 of the Administration of Justice (Scotland) Act 1972 for preservation and recovery, is based upon proof or simply inference. Withdraw the computers, then capture them. The reports are completed to evidential standards. Findings from our examination are kept in front of the appendix. We work strictly within the bounds of any order that the court makes regarding a respondent's computer equipment. No covert collection occurs.
Each bench process involved in this work has been documented by the forensic recovery hub. Flash media cards, memory sticks, etc. can be found at USB device forensics. Misused logins can be located on the insider threat forensics page. For pricing information, please refer to the prices page.
Together, these processes take a competitor's product that looks like yours and transform it from a complaint into hard evidence.
Repositories, drawing libraries and databases leaving in one go.
Part numbers, project codes and confidentiality banners located on the copy.
These internal records document which original file a competitor's file was copied from.
Webmail, transfer sites and personal cloud uploads, each with a date.
Erased files and archives returned to the record.
Every opening, export and print run against the protected material.
Every instruction starts with the free diagnostic, and you should allow 2 working days from the date a device reaches this bench. Forensic work is not covered by our usual payment terms, where in most cases you only pay if we recover your data. The full forensic investigation with report costs £800 + VAT and must be paid 100% upfront. The less expensive Forensic binary image and deleted-file extraction service (which does not include a report) will cost £400 + VAT. All Forensic services are required to be prepaid. Both figures are repeated on our prices page and we do not take anything until we have agreed upon a scope of works in writing.
IP instructions are for equipment owned by your business or covered by a court order; they shall be carried out strictly as outlined in that order. There are three doors in, and we have not seen a "fourth door" yet. The equipment that your business owns. Written instructions from a solicitor, insurer or the court. Or otherwise, a device that really does belong to the client (in matrimonial matters this includes devices shared between both parties). No hacking occurs here. Never do we intercept live traffic. If the instructing client has no right to look inside a particular piece of equipment, neither do we.
Most of what can be proved about your case later is decided in those initial few days. Call us on 0800 689 0668 for a quote first, then leave the equipment just as it is and we'll identify together which hard drives need to come to us (we only need the drives, not the machines). We don't have collection services; this means all items will be sent tracked and insured, or you may bring them across the counter at our premises in Edinburgh (Monday to Friday, 9am to 5:30pm, no appointment needed), and custody runs from the signature onward.
Still attached to a laptop, desktop, MacBook, iMac, server or CCTV/DVR unit? Remove the hard drive or SSD first. The bare drive travels on its own; when removing disks from a server remove all the disks and label each disk by its bay. This lab does not take machines apart. Any storage that has been soldered onto a motherboard (as in T2 and Apple Silicon Macs and a couple of thin laptops) will not be worked on: if it will not unbolt, we cannot work on it. If you're not sure what type of machine you have, ring us first. Phones and tablets are also not taken on.
↓ Print the shipping & booking-in form (PDF)
Your parcel should be addressed to Edinburgh Data Recovery, approximately two and a half hours (and 130 miles) from Aberdeen via the A90; alternatively it can reach us the next working day by tracked post if this journey time / distance is prohibitive to travel. As soon as your drive has been scheduled in we will contact you.
Still unsure about what should be placed inside of the packaging? Please call us first on 0800 689 0668, or use our free online diagnostic tool to assist you in deciding which items belong inside of the packaging before sealing.
Remove all computers and devices from operational status and contact our freephone number. Early imaging creates a foundation for any application.