A design engineer leaves a subsea outfit. Two quarters later a rival demonstrates something your team spent three years building. For the engineering supply chain around Dyce and Altens, for spin-outs from the two universities, and for the software houses serving both, that moment gets converted into an itemised, dated account: what left, the road it travelled, and how the rival material stands beside your originals.
◇ Footing first. Bench time after. The free diagnostic opens the job, a written scope follows it, and forensic fees clear ahead of any examination. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Full pricing is on the data recovery cost page.
Engineering and product firms usually spot these before anyone else. Preservation comes ahead of investigation, and both come a long way ahead of confrontation.
Trade secrets almost never leave through a break-in. They walk out under a working login, mid-week, buried in the traffic of a busy network, and the loss only shows up months later when a tender goes by a whisker or a product turns up with familiar lines on it. That leaves three questions, and all three are answerable. What moved. By which channel. On what dates. Your own systems are already holding those answers.
Work begins from images of the relevant workstations and the file server, and the exit gets assembled from one end to the other. Device records catch repositories and drawing sets going out in a single movement. Browser and sync-client traces catch uploads into personal storage. Print activity bunches around protected folders. Deleted material returns where somebody tidied up behind themselves. The copy is then searched for part numbers, project codes and confidentiality markings, so a file renamed on its way out cannot slip past on a technicality.
The moment your material sits elsewhere, parentage becomes the whole argument. CAD files, PDFs and Office documents keep internal records that outlast renaming and a light edit. Author. Company. Revision history. Reference numbers. Save times. Held up against your originals, those can demonstrate one document descending from another. The rival copy still has to arrive by a lawful route, whether by recovery of documents or under a court order, and only on that footing does a resemblance turn into something a judge can weigh up.
IP claims take their shape early on. Image straight away and the record is fixed before anybody tidies, which decides whether an application for interim interdict, or an order under section 1 of the Administration of Justice (Scotland) Act 1972 covering preservation and recovery, is founded on proof or merely on inference. Withdraw the machines, then capture them. Reports are prepared to evidential standards, with findings kept in front of the appendix. Where the court has granted an order touching a respondent's hardware, we operate strictly inside its terms. Covert collection forms no part of this service.
The bench method behind every bit of it is written up at the forensic recovery hub. Cards and sticks belong on USB device forensics. Misused logins are covered at insider threat forensics. Numbers are on the prices page.
Between them these turn a familiar-looking rival product from grievance into evidence.
Repositories, drawing libraries and databases leaving in one go.
Part numbers, project codes and confidentiality banners located on the copy.
Internal records tracing a rival file back to the original behind it.
Webmail, transfer sites and personal cloud uploads, each with a date.
Erased files and archives returned to the record.
Every opening, export and print run against the protected material.
Each instruction opens on the free diagnostic. Allow 2 working days from the date a device reaches this bench. Forensic casework sits outside no fix, no fee. The full forensic investigation with report is £800 + VAT, payable 100% upfront. The less expensive Forensic binary image and deleted-file extraction service, without the report, is £400 + VAT. Any Forensic work required will be payable upfront. You will find both figures repeated on the prices page, and we take nothing until a scope is agreed in writing.
IP instructions run on systems your company owns, or on hardware covered by an order of the court, kept strictly inside the terms of that order. Three doors in, and we have never found a fourth. Kit the business itself owns. A written instruction out of a solicitor, an insurer or from the court. Or else a device that genuinely belongs to the client, which in a matrimonial matter takes in one held between the two of them. Nothing gets hacked at this bench. Live traffic is never intercepted. Where the instructing client holds no right to look inside a device, we hold none either.
What can be proved later is mostly decided in the opening days. Ring 0800 689 0668, leave the machines exactly where they are, and we will agree which hardware needs to travel. Collection is not a service we run, so it goes tracked and insured, or comes across the counter in Edinburgh, with custody running from the signature onward.
Still bolted into a laptop, desktop, MacBook, iMac, server or CCTV / DVR box? Get the hard drive or SSD out first. The bare drive travels on its own. Stripping machines down is not a job this lab takes on. Flash soldered to a motherboard, as on Apple Silicon Macs and a couple of very thin laptops, is our one flat no: if it will not unbolt, it cannot be worked on.
↓ Print the shipping & booking-in form (PDF)
Address it for the attention of Edinburgh Data Recovery. From Aberdeen that is roughly 130 miles and two and a half hours down the A90, or next working day by tracked post if you would rather not make the run. You get a call the moment it is booked onto the bench.
Not sure what belongs in the box? Ring 0800 689 0668 before you tape it shut, or work through the free online diagnostic.
Take the machines out of service and ring the freephone. An early image is what gives an application its footing.