Digital forensic services, Plymouth · for solicitors, HR departments and loss adjusters
In Plymouth, as elsewhere, the majority of damage is done within the first hour by someone with good intentions. The machine is turned on to take a look, files are opened, and timestamps are moved so they will never again find their way home. A hardware write blocker goes on first. The image then takes place before a single file is opened. As the work progresses, the continuity log is written at the bench, not pieced together a week later from memory. The report is written anticipating that another expert will rely upon it. We remain independent, discreet about who instructed us, and clear in our reporting as to where the evidence stops providing information.
A quiet word first?
0800 6890668
| What turns up | What examination shows | What goes to you |
|---|---|---|
| The laptop the whole thing hinges on | Write-blocked, imaged and worked on the copy: artefacts, documents, and the sequence of events | A plain-English answer, in writing |
| An employee gone, and files gone with them | Every USB device connected, uploads to webmail or cloud storage, deleted files and wiped data, all dated | One document HR and the solicitor can both use |
| Deleted files the case cannot do without | Proof they existed, when they were deleted and what came next, captured without breaking continuity | The files back, dated, and the route we took |
| A locked volume, and the authority to open it | Passware is set on it once authority is shown and a key is actually within reach | The contents, and an account of how it opened |
| A dispute heading for a hearing | The same bench work, then documented to the rules that govern it: CPR Part 35, or CrimPR Part 19 | A report built to the form required |
| Footage sitting on a CCTV recorder | Lifted from the disk with continuity maintained; our CCTV pages cover this in full | Footage that plays, with the paperwork behind it |
Call us and tell us as much or as little as you like. The call costs nothing. It needs to establish what the matter is: what happened, which devices and accounts are involved, and what question the evidence has to answer. That defines the scope. One written figure follows from it, and you get that before anything is opened.
Nothing gets looked at first. The write blocker goes in line, the image is captured, and only then does any viewing happen. The device is an exhibit in its own right, not just a box with files in it, so all the work is done on a copy and the original goes back in its bag.
From here on, the image is what is examined. OSForensics is one of the tools used: which artefacts the system left behind, which files were opened and when, which were deleted, and in what order. Notes are typed while the examination goes on, and never reconstructed later.
Your question is answered at the start, in everyday language. Below it are the technical workings, for anyone who wants to check them. Any finding that helps neither party is included as well, and stays in.
Anything the other side can't check is something to argue over. So we put together a bundle that can be checked: exhibit references, the images each finding was read from, every handover with its date, hash values, and the notes made during the examination. Their own examiner can repeat the work and reach the same result.
Why take the copy early, and take it yourself: a computer in daily use is not the same computer two weeks later. Windows keeps writing, space holding deleted material is reused, and logs cycle round. An image taken on day one shows exactly how things were; one taken after a month of use shows something else. If a dispute looks likely, make the copy while the answer is still there to find, then put the original into storage.
| The kit | Where it is used | Why we keep it |
|---|---|---|
| X-Ways Forensics | Close work inside disk images: usage history, artefacts, timelines and deleted data | Quick and uncluttered, and a small bench does better knowing one tool thoroughly |
| OSForensics | Indexes an entire Windows machine, or its image, so any content on it can be searched | The broad first sweep: registry hives, recent file lists, every USB device ever attached |
| Passware | Encrypted volumes, where opening them is lawful and there is a route to the key | Either it opens or it doesn't. The report says which, and nothing gets dressed up |
| Atola Insight Forensic | Acquisition behind a write block, with hashing done on the same run | The acquisition logs itself, so continuity starts at sector one |
| ACE Lab PC-3000 & Data Extractor | Firmware-level repair, when the exhibit is also a failing drive | A disk can be both the exhibit and the repair job; both trades sit in this room |
Why put it in writing? The criminal rules require an expert to disclose anything capable of detracting from their credibility, and an accreditation not held qualifies. Declaring it first is not modesty: it takes away the easiest question the other side had waiting.
The client came to us expecting to be shown a theft. What the evidence revealed was duller than that: a sync client had been set up incorrectly and had cleared the shared folder by itself. Most of what went was still there to recover. The finding closed the dispute without anyone being accused.
Three stages: taking a copy, examining the copy, and writing up the findings so they hold when someone tries to take them apart. Nothing is read before the copy exists. The notes are typed at the bench while the job runs, with enough detail for a second examiner to follow the same process and arrive at the same place.
Each job has its own requirements, so there is no price list to read a figure off. Working out the scope costs nothing. After that comes one written figure covering imaging, examination and the report, agreed before any equipment is plugged in. The starting point is £800 + VAT. There is no clock ticking to track hours.
No. Disks, cards, PCs, Macs and the drives out of CCTV and DVR units are accepted on this bench; a handset is not. If your case turns out to rest on a phone, you will hear that on the call, along with the name of a lab that does handset work.
No: we hold neither UKAS accreditation nor an ISO certificate, and every report says so on its first page, because an expert is obliged to disclose it. Instead, anyone can inspect our method: acquisition behind a hardware write blocker, MD5 and SHA-256 hashes generated and verified, every step documented as it happens, and reports laid out under CPR 35 for civil work and CrimPR 19 for criminal work.
Evidence is stronger when the drive is imaged early and left undisturbed afterwards. Start here and we will tell you plainly what can be shown and what cannot. The first look is free, and everything you tell us stays confidential.