An engineer hands in her notice; three months later a competitor quotes your tender to the pound. For manufacturers, software teams and design businesses around Swindon and the M4, we turn that sinking feeling into dated, itemised evidence of what was taken and how it travelled.
Quiet, methodical, defensible. Nothing starts until the free diagnostic is finished and you have approved a written scope; forensic fees are then settled upfront.
Product, engineering and service firms across Wiltshire tend to see these signals first — preserve now, investigate second.
Trade secrets almost never leave through a hack. They leave with a trusted login, in working hours, and the loss surfaces months later as a bid that undercuts yours by a suspiciously exact margin or a familiar design wearing a different badge. The useful news is that the questions this raises are narrow — which files, which route, which dates — and each one is answered from your own estate, where every trace already sits.
Working from images of the relevant workstation, laptop or file server, the exit is reassembled end to end: removable-media records showing drawing sets or repositories copied wholesale, browser and sync artefacts marking uploads to personal cloud space or webmail, and the access and print history around the sensitive folders. What was erased is brought back, and the whole image is then swept for the part numbers, project names and confidentiality banners your documents carry — so nothing escapes for having been renamed.
When your material is already in a rival's hands, lineage becomes the battleground. PDFs, Office documents and CAD drawings carry hidden internals — author names, revision trails, company fields, save timestamps and internal reference numbers — that outlive renaming and casual editing. Set against your originals, it can show a competitor's document descending directly from yours, provided the rival material reaches us lawfully through disclosure or a court order. That comparison regularly turns an uncomfortable resemblance into expert evidence.
IP litigation is won in its first week more often than its last. Prompt imaging pins the record in place before anyone can tidy it, and gives a springboard or search-order application real teeth. Devices are secured at once; all work proceeds from write-blocked images proven by MD5 and SHA-256 under a logged custody trail; reporting is to expert-witness standard, findings ahead of the technical appendix. If a judge directs that a respondent's machine be imaged, we execute the direction to its exact terms — covert collection is never part of the service.
Every IP case runs on the method described at our forensic data recovery hub — imaging, hashing, custody. Fees are settled upfront: the standard investigation and its report at £800 + VAT, or a cheaper binary-image and deleted-file extraction at £400 + VAT with no report attached; the data recovery cost page carries both figures. Encrypted exhibits pass through BitLocker recovery using keys you lawfully hold.
Six strands, taken together, turn a resemblance into an evidenced account of the taking.
Drawing sets, repositories and databases moved out in bulk.
Part numbers, project names and confidentiality markings found.
Metadata tracing a rival's file back to your original.
Uploads through webmail, transfer sites and personal cloud space.
Erased and archived material carved back into evidence.
Opens, exports and print jobs against the confidential set.
We examine your company's own equipment, or hardware named in a court's imaging order, executed precisely to its terms. Covert collection from a competitor's systems or a private individual's devices is refused outright — partly because it is unlawful, mostly because tainted evidence dies on contact with a judge and takes the honest material down with it. In IP work the lawful route is not the slow lane; it is the only lane that arrives.
In an IP matter the first hours set the ceiling on what can be proved, so call 0800 689 0668 before anyone starts poking around the machine. Together we will settle which hardware gets imaged and how it travels — securely to our Oxford location, with custody recorded from signature.
Sending a drive from a computer, laptop, MacBook, iMac, CCTV / DVR or server? Please remove the internal hard drive or SSD and send us just the drive — we don't provide an internal drive-removal service. We don't recover storage soldered to a motherboard (e.g. Apple Silicon Macs and some thin laptops) — only drives that can be removed and sent to us.
↓ Print the booking-in & shipping form (PDF)
Mark the package for the attention of Oxford Data Recovery and we'll call you as soon as we diagnose your media.
Not sure what to send? Call 0800 689 0668 first or use the free online diagnostic.
Pull the machines from use and ring the freephone — early images are what an injunction stands on.