Digital forensics · investigations across Devon
When a dispute is coming up, it's just as important how you handle the information as what that information actually says. Therefore, no one will have reviewed anything that comes into this lab prior to its image being created; each of our steps from imaging through final report preparation is documented; and our reports are designed so that another independent technical expert (or a judge) can review them line by line. We are independent and discreet, and honest about exactly what this lab is and isn't.
A quiet word, in confidence
0800 6890668
| What's wrong | What the examination finds | What's returned |
|---|---|---|
| One computer that could be used to settle a dispute | First a write-blocked image, then we analyse the artefact, file and timeline evidence using the copied image. | Results expressed in plain English and documented in writing. |
| An ex-employee who is thought to have made unauthorised copies of company data | Chronologically ordered USB history, including evidence of deletions, wiping, cloud and webmail traces | Items your HR department and legal team can act on. |
| Legally relevant items that have been deleted. | Documented proof of when these files existed, when they were deleted and what happened to them (recovered under forensic conditions). | The files, plus when and how. |
| A locked volume (that you are lawfully authorised to unlock) | Where Passware is able to establish credentials, it will attack the encryption on the locked volume. | Opened contents and a documented process for opening. |
| A matter heading towards a hearing. | The same assessment, reported as per CPR Part 35 standards (or by way of criminal standards, CrimPR Part 19) | A court-compliant expert report. |
| Video footage being stored on a DVR or CCTV system. | Retrieved with the entire continuity chain preserved; our CCTV pages cover it. | Playable video as well as the continuity record for that video. |
When you instruct us on a new matter, we will first hold a confidential conversation about what has occurred, which devices/accounts matter and what the evidence needs to establish. Following this, you will receive a single written quote, fixed prior to any examination commencing, and the initial scope of works does not incur any cost.
Each piece of evidence will be copied using a hardware write blocker prior to opening any files. The original is always the evidence. Viewing/reading/browsing it is what kills evidence.
The analysis occurs on the image, using tools such as OSForensics (file activity, deleted data, system artefacts, timelines), and each time an action occurs, it is logged at that point, rather than afterwards.
When findings are returned, they are expressed in plain English, addressing the question you asked, while providing technical details below them. Regardless of whether or not the answers reflect what you had hoped, the answers will be provided.
You get everything: the report, all of the exhibits and the files behind each exhibit, as well as the hashes, the continuity record and our working notes. If at some time in the future a tribunal or another expert wishes to verify anything, they will be able to follow the entire chain of evidence from start to finish.
Why you need to secure your information privately from an early stage: in December 2022, HMICFRS reported that there were more than 25,000 devices waiting to be examined by police using their digital forensic services; in June 2025 the Westminster Commission on Forensic Science also found that, over a four-year period, more than 30,000 prosecutions in England and Wales failed due to lack of evidence (lost, missing or inadequate). Material properly preserved on day one will never enter those queues.
| System | What it handles | Why we rate it |
|---|---|---|
| X-Ways Forensics | In-depth examination of disk images: artefact analysis, activity records, deleted data and timelines | A lean, efficient tool that allows us to use it extensively in a lab of our size, as opposed to perfunctorily. |
| OSForensics | Comprehensive indexing and searching of Windows operating systems and captured image files | Broad first-pass discovery: registry entries and recent-use traces; history of USB devices. |
| Passware | Unlocking encrypted volumes when it is legal to do so, and when there is a recoverable credential. | The honest encryption tool: it either gets in, or it doesn't, and we'll report which. |
| Atola Insight Forensic | Forensic imaging using hardware write protection, with hashing done simultaneously in the same pass. | The acquisition log generates an unbroken record from the start as the image is acquired |
| ACE Lab PC-3000 & Data Extractor | Firmware-level work can be done when an exhibit is also a failing drive. | A half-dead drive is not precluded from being considered as evidence; the two disciplines will be applied simultaneously. |
For what reason is this list provided? Since 2019, criminal procedures have required that an expert provides all information which may bear upon their credibility, including any gaps in accreditation. Stating this here in plain terms does not constitute humility; it ensures that the evidence remains standing if/when challenged.
A customer was certain that files had been stolen. The evidence pointed to a duller place: a wrongly configured sync setting had removed the files from the shared directory, and most were recoverable. A truthful explanation ended the argument quicker than any accusations could have.
The capture, analysis and reporting of computer-based electronic evidence in such a manner that the results can withstand scrutiny: the device is copied ("imaged") before any examination occurs. All actions taken during the process are recorded. The results are documented in a manner that allows another examiner to follow the same steps.
The pricing of each matter will be based on that matter's unique factual circumstances; there is no charge for the initial scoping call. A single quotation will be provided in writing prior to beginning any work; it includes all costs associated with obtaining images, analysing those images and preparing your report. There are no charges incurred by the hour while working on a case.
No. Our services are focused on drives, computers, storage media and CCTV equipment; handsets, tablets and mobile devices are excluded from our service. If at some stage a mobile device does come into play with your investigation, we will be honest about this and refer you to a relevant specialist.
We are an independent laboratory and we do not have UKAS (United Kingdom Accreditation Service) or ISO accreditation. We clearly state this fact, including within each of our reports, as the applicable rules require. Instead, the "inspectable" method we use includes write-blocker imaging, hashing, documentation of all steps taken during the process and preparation of reports compliant with CPR 35 or CrimPR 19.
When recorders overwrite on a loop, all recorded evidence will weaken and time limitations expire, so open your case now. The first review is completely free and confidential.