The notice period is over, the laptop is returned factory fresh and within a month your quotes are being lost to a name you already know. For employers throughout the areas around Swindon, from the units at Kembrey Park and Cheney Manor to professional practices in Old Town, we get back the evidence that a reset machine still holds. Freephone advice and a free diagnostic come first.
Quiet, methodical, defensible. Nothing starts until the free diagnostic is finished and you have approved a written scope; forensic fees are then paid upfront once you accept the fixed quote.
If you see any one of these, lock the machine away and don't use it until it's been imaged, whether your firm is anywhere in Swindon, Chippenham or Royal Wootton Bassett.
A machine that is reset when returned tells us something before any investigation takes place; normal employees who leave don't wipe their laptops clean. The reset removes the icons from the desktop and the visible folders, but it rarely reaches into the other records on the system that can stay intact, e.g. registry hives that continue to exist, the footprint of the erasing tool and the exact time it ran, and unallocated space where many of the deleted documents are still sitting, ready to be carved back out. This same scenario happens time after time around Swindon; two weeks of slow steady copying of data followed by one single big deletion on the last day.
Windows is a data retention expert. Windows records every single flash drive or portable storage device that has ever been attached to it by make, model and serial number in the USBSTOR registry key. Also, the setupapi log notes when it first appeared and MountPoints2 links it to the user profile that mounted it. After that the trail carries on through Windows, with LNK shortcuts and jump lists showing named company documents being opened from a removable drive letter, shellbags keeping the shape of the folders browsed on the device, and the Windows change journal timestamping file operations minute by minute. Once it is all put in order, it stops looking like a suspicion and looks more like an itinerary.
A lot of data leaves through a web browser tab instead. We recreate webmail sessions where attachments were sent to private addresses, uploads pushed through transfer services, and folders synced to a personal OneDrive, Dropbox or Google Drive. Sync-client logs note what was uploaded and when, and deleted emails are brought back out of unallocated space. The timeline we finish with covers every route the data could have gone by, including the ones nobody happened to notice.
All work is done on the belief that the other side's forensics expert will review everything. All drives are imaged through a hardware write-blocker. The copy is verified as an exact match of the original using MD5 and SHA-256 checksums. Each time an exhibit changes hands it is recorded in the custody record. OSForensics performs the analysis, Passware Kit Forensic opens password protected material when the law allows, and the report gives plain English conclusions first, followed by the technical details in an appendix. The directions agreed with your solicitor are followed strictly.
The methods used for this work (write-blocked imaging, hash verification, logged custody) are described in detail on our forensic data recovery hub. All fees for forensic cases are paid upfront once you accept the fixed quote. The standard investigation costs £800 + VAT and includes a full written report. The forensic binary-image and deleted-file option is £400 + VAT, which does not include the report. Both options are listed on our data recovery cost page. If the laptop comes back encrypted, our BitLocker recovery service unlocks it first using the key your business holds.
Properly imaged, one company computer usually discloses all six of these areas at once.
Make, model and serial number of each stick plugged into it, with the first and last dates.
LNK and jump list entries connecting documents to a removable drive letter.
Shellbag records of folders browsed on the device.
USN change-journal activity over the relevant weeks.
Emails going out to the employee's private address, transfer uploads, and the history held in cloud-client logs.
The documents that have been recovered, along with the traces left by the wipe tool itself.
If the company owns and issued the device, then it is fair ground to examine. However if a device is personally owned by the employee, there must first be a proper basis (such as a signed acceptable-use policy or a solicitor's instruction) before any forensics is done, and covert access to a former employee's own home computer or phone is something we refuse every time. While you decide how to proceed, keep in mind the laptop is an exhibit and should be treated like one and not like a spare. Shut down the laptop, lock it away in a secure place and tell IT not to rebuild it and not to hand it over to the next new starter, as a reinstall will remove all of the traces the case needs.
An exhibit is not an ordinary parcel, so please ring 0800 689 0668 for a quote before you box anything up. We will agree the packaging and paperwork with you, and custody is recorded from the moment the drive is signed for at our Oxford lab. The lab is under an hour up the A420 if you would rather drop it at reception (Monday to Friday, 9am to 5:30pm, no appointment needed), or it can reach us next day by tracked post.
Sending a drive from a computer, laptop, MacBook, iMac, CCTV / DVR or server? Please remove the internal hard drive or SSD and send us just the drive (from a server, every disk, each labelled with its bay), as we don't offer a drive-removal service. We don't recover storage soldered to a motherboard (for example T2 and Apple Silicon Macs and some thin laptops), only drives that can be removed and sent to us. If you're not sure which kind you have, ring us first.
↓ Print the booking-in & shipping form (PDF)
Mark the package for the attention of Oxford Data Recovery and we'll ring you as soon as we've diagnosed your media.
Not sure what to send? Ring 0800 689 0668 first or use the free online diagnostic.
Lock the machine away and pick up the phone, because imaging it early is what keeps the evidence intact.