Employers in Plymouth and the South Hams · evidence off work devices
A laptop handed back in good order repays a second look, because Windows keeps records of its own and the sync clients keep theirs, and a tidy-up reaches neither. An inbox rule copying mail to a private address. A memory stick that appeared at 22:40 on a Friday night. A Downloads folder cleared out on the morning of the exit meeting. The machine comes out of service, gets imaged to evidential standard, and what it shows is written up for HR and for your solicitor.
A quiet word first?
0800 6890668
| What bears on it | What it requires of you | How we work to it |
|---|---|---|
| UK GDPR, plus the Data Protection Act 2018 | Owning the device supplies no lawful basis on its own. Choose a basis — legitimate interests, as a rule — then work the balancing test through and record it before anything begins | The examination is scoped to the allegation we were handed, and goes no wider |
| ICO guidance on monitoring workers, from October 2023 | Openness is the default position, with a DPIA wherever the risk runs high | Your policies get read first, ahead of the disk, and we say plainly where a DPIA is needed |
| Examination done covertly | Defensible only in rare cases — suspected crime, or serious misconduct — and nothing moves until senior management has signed it off | Nothing imaged and nothing read until that sign-off exists in writing |
| What ACAS expects | A disciplinary decision must rest on an enquiry that was fair and proportionate | Findings go in the report as they stand, whichever party they happen to assist |
| Weight before a tribunal | No evidence is any better than the method that produced it | A chain-of-custody log that adds to your case instead of handing the other side an opening |
Ring us and say as much or as little as you like; the call itself is not charged for. What it has to settle is the shape of the matter — what took place, which machines and accounts it reaches, and the question the evidence must answer. That is the scope. One written figure follows from it, and you have that before anything is opened.
Most of what vanishes goes inside a fortnight, and hardly ever on purpose. The laptop is rebuilt for whoever starts next. The drive is dropped into the spares cupboard. A manager takes a quiet look round it. A write-blocked image taken early beats all three to it.
After that the work happens on the copy, and nothing further is done to the original. Every removable drive gets listed, with the time it went in and how long it stayed. So does anything sent up to a personal cloud account or attached to webmail, anything deleted, and any trace of a wiping tool having run. It all lands on one timeline.
The report is meant for a tribunal, an HR panel or a solicitor rather than for an engineer. What we did is measured against the ICO's monitoring guidance and against the fair enquiry ACAS looks for. Should the matter later reach the police, the document holds up unchanged.
Anything the other side cannot check is worth arguing about. So the bundle is built to be checked: the exhibit references, the images each finding was read from, every handover with a date on it, the hashes, and the notes written while the work was going on. Their own examiner can repeat the work and land in the same place.
The single figure we will stand behind: Symantec, with the Ponemon Institute, found in 2013 that roughly one in two recent job-changers admitted keeping confidential material belonging to their previous employer. Nearly everything published since comes from companies with a product to sell, and the numbers disagree with one another. What we see is duller. An employer who rings able to name what they believe went, rather than uneasy in a general way, is usually borne out by the artefacts.
The laptop was the company's own, which made the examination easy to authorise. The order of events on it was plain: the files were collected in one place, a private account was opened in the cloud, and the transfer went from there. The resignation letter came twenty days after the last upload. The Falmouth employer had begun with a rival's pitch deck and little else. Undertakings closed the matter.
Ownership settles very little by itself. What you need is a lawful basis, plus a workforce told in advance that its work machines can be looked at — an acceptable-use policy is what carries that message. Say nothing beforehand and the point gets argued later. Examining a device without telling its user is a step reserved for suspected crime, and it needs a director's signature.
Hardly ever, and never as a matter of routine. The ICO's guidance on monitoring workers, published in 2023, keeps covert work for exceptional circumstances — a suspicion of crime, or gross misconduct. Even then it looks for senior management sign-off, a DPIA, a tightly drawn scope, and the reasoning recorded.
Preservation, ahead of everything else. Switch the machine off, put it in a locked drawer, and leave the mailbox and cloud accounts alive rather than closing them down. No folder gets opened until a forensic copy exists. Even a well-intentioned browse destroys the exact date stamps that would have shown files moving.
The route you took matters as much as what you turned up. A damaging finding loses its force the moment the road to it can be taken apart. For a screenshot to be worth anything there must have been a lawful basis behind it, the search must have kept inside whatever suspicion set it off, and every stage of the handling must have been logged.
A workplace device imaged early and handled properly is far harder to argue with than one examined in a hurry once notice has been given. Start it here. The first look is free, and what you tell us goes no further.