Plymouth evidence work · for solicitors, HR and loss adjusters
In Plymouth as anywhere, most of the harm is done inside the first hour, by somebody meaning well. The machine gets switched on for a look, folders are opened, and timestamps move where nothing will put them back. So a hardware write blocker goes on first, and the image is taken before one file is opened. The continuity log is typed at the bench as the job runs, not assembled from memory a week later. The report is written expecting another expert to lean on it. Independent, discreet about who instructed us, and plain about where the evidence stops telling you anything.
A quiet word first?
0800 6890668
| What shows up | What examination shows | What goes to you |
|---|---|---|
| The laptop the whole thing hinges on | Write-blocked, imaged, and worked on the copy — artefacts, documents, and what happened in what order | A plain-English answer, in writing |
| An employee gone, and files gone with them | Every USB device connected, uploads to webmail or cloud accounts, deletions and wipes, all of it dated | One document HR and the solicitor can both use |
| Deleted files the case cannot do without | Proof they existed, when they were removed and what came next — lifted with continuity intact | The files back, dated, and the route we took |
| A locked volume, and the authority to open it | Passware is set on it, once authority is shown and a key is actually reachable | The contents, and an account of how it opened |
| A dispute heading for a hearing | Identical bench work, then written to whichever rules govern it — CPR Part 35, or CrimPR Part 19 | A report built to the form required |
| Footage sitting on a CCTV recorder | Lifted off the disk with continuity held — our CCTV pages cover this in full | Footage that plays, with the paperwork behind it |
Ring us and say as much or as little as you like; the call itself is not charged for. What it has to settle is the shape of the matter — what took place, which machines and accounts it reaches, and the question the evidence must answer. That is the scope. One written figure follows from it, and you have that before anything is opened.
Nothing is read at the start. The blocker goes in line, an image is taken, and looking comes after that. The device is an exhibit in itself, not a box with files inside, so the work happens on the copy and the original goes back in its bag.
From there on, the image is what is examined. OSForensics is one of the tools used: what artefacts the system left behind, which files were opened and when, what was deleted, and in what order. The notes are typed while it goes on, never reconstructed later.
Your question is answered at the top, in ordinary words, with the technical workings underneath for anybody who wants to check them. A finding that helps neither party goes in as well, and stays in.
Anything the other side cannot check is worth arguing about. So the bundle is built to be checked: the exhibit references, the images each finding was read from, every handover with a date on it, the hashes, and the notes written while the work was going on. Their own examiner can repeat the work and land in the same place.
Why take the copy early, and take it yourself: a computer still in daily use is not the same computer a fortnight on. Windows writes constantly, space holding deleted material gets handed out again, and logs wrap round. An image made on day one shows the state things were actually in; one made after a month of use shows something else. Where a dispute looks likely, copy it while the answer is still there to be found, then store the original away.
| The kit | Where it is used | Why we keep it |
|---|---|---|
| X-Ways Forensics | Close work inside disk images: usage history, artefacts, timelines and deleted material | Quick, uncluttered, and a small bench does better knowing one tool thoroughly |
| OSForensics | Indexes an entire Windows machine, or its image, so anything on it can be searched | The broad first sweep: registry hives, lists of recent files, every USB device ever attached |
| Passware | Encrypted volumes, where opening one is lawful and there is a route to the key | It either opens or it does not. The report says which, and nothing gets dressed up |
| Atola Insight Forensic | Acquisition behind a write block, hashed on the same run | The acquisition logs itself, so continuity begins at sector one |
| ACE Lab PC-3000 & Data Extractor | Repair at firmware level, when the exhibit is a failing drive as well | A disk is sometimes the exhibit and the repair job together; both trades sit in this room |
Why put it in writing: the criminal rules require an expert to disclose anything capable of detracting from their credibility, and an accreditation that is not held qualifies. Declaring it first is not modesty — it takes away the easiest question the other side had waiting.
The client came to us expecting to be shown a theft. What the evidence showed was duller than that: a sync client had been set up wrongly and had cleared the shared folder by itself. Most of what went was still there to be recovered. The finding closed the dispute, with nobody accused.
Three stages. A copy is taken, the copy is examined, and the findings are written up so they hold when somebody tries to take them apart. Nothing gets read until the copy exists. The notes are typed at the bench as the job runs, in enough detail for a second examiner to walk it and land in the same place.
No two instructions are alike, so there is no list to read a price off. Working out the scope is free. What follows is a single written figure covering imaging, examination and the report, agreed before anything is plugged in. The starting point is £800 + VAT. There is no hourly clock ticking.
No. This bench takes disks, cards, PCs, Macs and the drives out of CCTV and DVR units; a handset is not on that list. Should the phone prove to be where your case actually lives, you will hear it on the call, along with the name of a lab that does handset work.
No — neither UKAS accreditation nor an ISO certificate, and the first page of every report states as much, since the rules oblige an expert to disclose it. What stands instead is a method anybody may inspect: acquisition made behind a hardware write block, MD5 and SHA-256 taken and checked, each step noted while it happens, and a report laid out under CPR 35 for civil work, CrimPR 19 for criminal.
Evidence is strongest when the drive is imaged early and left alone after. Start it here and we will tell you plainly what can be shown and what cannot. The first look is free, and what you tell us goes no further.