Evidence & investigations · digital forensics
When data becomes evidence, how it's handled matters as much as what it says. We image before we look, log everything we do, and report so that another examiner — or a court — can follow the trail. Independent, confidential, and honest about exactly what we are.
Talk it through, in confidence
01273 964902
| The situation | What we establish | What you receive |
|---|---|---|
| A device that may hold the answer to a dispute | A write-blocked image, then analysis of files, artefacts and timelines | A plain-English findings report |
| A leaver suspected of taking company data | USB, cloud and webmail activity, deletions and wiping, in a timeline | An investigation report HR and legal can act on |
| Deleted material that matters legally | Whether it existed, when, and what happened to it — recovered forensically | Recovered material plus the how and when |
| An encrypted volume with lawful authority to open it | Decryption with Passware where keys or passwords can be established | Decrypted evidence, method documented |
| A matter heading to court | The same work, reported to CPR Part 35 or CrimPR Part 19 | A court-ready expert report |
| CCTV or DVR footage as evidence | Recovery and export with continuity — covered by our CCTV hub | Playable footage plus continuity records |
Every instruction starts with a confidential conversation: what happened, which devices and accounts exist, and what question the evidence needs to answer. You get a fixed written quote before any examination begins — and the initial scoping costs nothing.
Every device is imaged through hardware write-blockers before anyone looks at anything. The original is evidence; evidence doesn't get browsed.
Analysis runs on the forensic image in tools like OSForensics — file activity, artefacts, deleted material, timelines — with every step logged as it happens.
Findings are reported in plain English against the question you actually asked, with the full technical detail behind it — and nothing softened for whoever's paying.
You receive the findings — report, exhibits and supporting files — with hashes, continuity records and our contemporaneous notes preserved. If the work is ever tested by another expert or a tribunal, the trail is there to be followed.
Why private, prompt capture matters: HMICFRS reported in December 2022 that police digital-forensics queues held over 25,000 devices awaiting examination, and the Westminster Commission on Forensic Science (June 2025) found more than 30,000 prosecutions in England and Wales collapsed over four years for lost, missing or insufficient evidence. Evidence preserved early, properly, doesn't join those queues.
| Platform | What it does on an instruction | Why this one |
|---|---|---|
| X-Ways Forensics | Examination of the forensic image — file activity, artefacts, deleted material, timelines | Fast and light enough for a small lab to run properly rather than badly |
| OSForensics | Collection, indexing and search across Windows systems and their images | Broad discovery work: registry, recent activity, connected-device history |
| Passware | Decryption where the instructing party has lawful authority and a key can be established | The only honest route into an encrypted volume — and it either works or it doesn't |
| Atola Insight Forensic | Acquisition with hardware write blocking and hashing built into the process | Imaging and reporting in one step, so continuity isn't assembled afterwards |
| ACE Lab PC-3000 & Data Extractor | Firmware-level access when the evidence is also a failing drive | Evidence doesn't stop being evidence because the media is dying |
Why we put this in writing: since 2019, criminal procedure has required disclosure of anything bearing on an expert's credibility — expressly including a lack of accreditation. Honesty here isn't a style choice; it's how evidence survives scrutiny.
Files a client insisted had been stolen turned out, on the timeline, to have been deleted from a shared drive by a sync misconfiguration — and most were recoverable. The honest answer ended the dispute faster than the suspected one would have.
The preservation, examination and reporting of electronic data so it can be relied on — devices imaged before examination, every step recorded, findings reported so another examiner could reproduce them.
It's scoped per case — imaging, analysis and reporting are quoted together in writing after a free scoping conversation, before any work begins. No meter running.
No. We work on computers, drives, storage media and CCTV systems — not phones or tablets. If a phone matters to your case we'll say so and point you to a specialist.
We're an independent lab, not UKAS- or ISO-accredited, and we say so plainly — including in reports, where the rules require it. What we offer instead is disclosed methodology: write-blocked imaging, hashing, logged process, and reports built to CPR 35 or CrimPR 19.
Loops overwrite, artefacts age, deadlines pass. Open a case first — the scoping conversation is free and confidential either way.