An engineer hands in her notice, and three months later a competitor quotes your tender to the pound. For manufacturers, software teams and design businesses around Swindon and the M4, we turn that sinking feeling into dated, itemised evidence of what was taken and how it travelled.
Quiet, methodical, defensible. Nothing starts until the free diagnostic is finished and you have approved a written scope; forensic fees are then paid upfront once you accept the fixed quote.
Product, engineering and service firms across Wiltshire tend to spot these signals first: preserve now, investigate second.
Trade secrets almost never leave through a hack. They leave with a trusted login during working hours, and the loss surfaces months later as a bid that undercuts yours by a suspiciously exact margin, or a familiar design wearing a different badge. The good news is that the questions this raises are narrow (which files, which route, which dates), and each one is answered from your own IT estate, where every trace already sits.
Working from images of the relevant workstation, laptop or file server, the exit route is rebuilt end to end: removable-media records showing drawing sets or repositories copied wholesale, browser and sync artefacts marking uploads to personal cloud storage or webmail, and the access and print history around the sensitive folders. What was erased is brought back, and the whole image is then swept for the part numbers, project names and confidentiality banners your documents carry, so nothing escapes just because it was renamed.
When your material is already in a rival's hands, lineage becomes the battleground. PDFs, Office documents and CAD drawings carry hidden internals, such as author names, revision trails, company fields, save timestamps and internal reference numbers, that outlive renaming and casual editing. Set against your originals, these can show a competitor's document descending directly from yours, provided the rival material reaches us lawfully through disclosure or a court order. That comparison regularly turns an uncomfortable resemblance into expert evidence.
IP litigation is won in its first week more often than its last. Prompt imaging pins the record in place before anyone can tidy it, and gives a springboard or search-order application real teeth. Devices are secured at once; all work proceeds from write-blocked images verified by MD5 and SHA-256 under a logged custody trail; and reporting is to expert-witness standard, with findings ahead of the technical appendix. If a judge directs that a respondent's machine be imaged, we carry out the direction to its exact terms, and covert collection is never part of the service.
Every IP case runs on the method described at our forensic data recovery hub: imaging, hashing and custody. Fees are paid upfront once you accept the fixed quote: the standard investigation and its report at £800 + VAT, or a cheaper binary-image and deleted-file extraction at £400 + VAT with no report attached; the data recovery cost page carries both figures. Encrypted exhibits pass through BitLocker recovery using keys you lawfully hold.
Six strands, taken together, turn a resemblance into an evidenced account of the taking.
Drawing sets, repositories and databases moved out en masse.
Part numbers, project names and confidentiality markings identified.
Metadata that traces a rival's file back to your original.
Uploads made through webmail, transfer sites and personal cloud storage.
Erased and archived material, carved back out and turned into evidence.
Opening, exporting and printing activity against the confidential set.
We examine your company's own equipment, or the hardware named in a court's imaging order, with the order carried out precisely to its terms. Covert collection from a competitor's systems or a private individual's devices is refused outright. Partly that's because it is unlawful, but mostly it's because tainted evidence dies the moment it reaches a judge, and it takes the honest material down with it. In IP work the lawful route isn't the slow lane; it is the only lane that actually arrives.
In an IP matter the first few hours set the ceiling on what can be proved, so call 0800 689 0668 before anyone starts poking around the machine. Together we'll settle which drives get imaged and how they travel, securely to our Oxford location, with custody recorded from the moment of signature.
Sending a drive from a computer, laptop, MacBook, iMac, CCTV / DVR or server? Please remove the internal hard drive or SSD and send us just the drive (from a server, every disk, each labelled with its bay), as we don't offer a drive-removal service. We don't recover storage soldered to a motherboard (for example T2 and Apple Silicon Macs and some thin laptops), only drives that can be removed and sent to us. If you're not sure which kind you have, ring us first.
↓ Print the booking-in & shipping form (PDF)
Mark the package for the attention of Oxford Data Recovery and we'll ring you as soon as we've diagnosed your media.
Not sure what to send? Ring 0800 689 0668 first or use the free online diagnostic.
Take the machines out of use and ring the freephone, because early images are what an injunction stands on.