Plymouth and South Hams employers · evidence off company computers
If a returned laptop appears clean, give it a second look. Windows maintains its own logs and the syncing applications maintain theirs, and a tidy-up cannot erase either. An inbox rule forwarding email to a personal account. A memory stick that appeared at 22:40 on a Friday night. A Downloads folder cleaned out on the morning of the exit meeting. The machine is taken out of service, imaged to evidential standard, and what it shows is written up for HR and for your solicitor.
A quiet word first?
0800 6890668
| What bears on it | What it requires of you | How we work to it |
|---|---|---|
| UK GDPR, plus the Data Protection Act 2018 | There isn't any lawful basis solely from owning the device. Pick a basis (usually legitimate interests), then complete the balancing test and note it down before anything happens | We only examine the allegation we were given, and go no wider |
| ICO guidance on monitoring workers, from October 2023 | By default there needs to be openness; if the risk is high, a DPIA is required | Your policies are read first, ahead of the disk, and we state plainly when a DPIA is needed |
| Examination done covertly | Rarely defensible (suspected crime, or serious misconduct), and nothing can move without senior management's sign-off | No imaging or reading of data until that sign-off exists in writing |
| What ACAS expects | A disciplinary decision must be based upon a fair and proportionate investigation | Regardless of which side they may support, findings must be included in the report as they stand |
| Weight before a tribunal | Evidence quality is determined by the methodology used to obtain that evidence | A chain-of-custody log that supports your case, rather than providing your opponent with grounds to challenge your evidence |
Call us and tell us as much or as little as you like. The call costs nothing. It needs to establish what the matter is: what happened, which devices and accounts are involved, and what question the evidence has to answer. That defines the scope. One written figure follows from it, and you get that before anything is opened.
Most of what vanishes disappears within two weeks, and generally unintentionally. The laptop is rebuilt for whoever starts next. The drive is placed in the spares cupboard. A manager quietly checks its contents. An early write-blocked image gets there before all three.
Following that point, the analysis occurs on the copy and nothing else is done to the original. All removable media are listed, with the time they went in and how long they stayed. Everything sent to a personal cloud account or attached to webmail, any deletions, and any use of a wiping tool are also tracked. They all end up on the same timeline.
This report is intended for a tribunal, an HR panel or a solicitor, not an engineer. What we did is evaluated against the ICO's monitoring guidance and against the fair investigation ACAS looks for. If the matter later reaches the police, the document holds up unaltered.
Anything the other side can't check is something to argue over. So we put together a bundle that can be checked: exhibit references, the images each finding was read from, every handover with its date, hash values, and the notes made during the examination. Their own examiner can repeat the work and reach the same result.
The only statistic we feel comfortable standing by: Symantec with the Ponemon Institute reported in 2013 that approximately half of recent job-changers admitted keeping confidential material from their previous employer. Just about every other set of statistics published since has come from companies selling a product, and the numbers vary greatly. What we see is much less exciting. When an employer calls able to describe what they believe went, rather than being vaguely uneasy, the artefacts left behind most likely confirm it.
Since the laptop belonged to the company, it was simple to authorise the examination. There was no question about the order of events. The files were collected in one place, a private cloud account was opened, and the transfer went from there. The resignation came twenty days after the last upload. The Falmouth employer had started with only a rival's pitch deck. The undertakings resolved the matter.
Ownership does not settle the question nearly as much as having a lawful basis for the examination, and a workforce told of this possibility in advance through an acceptable-use policy. If your staff are unaware, it will be argued later. Examining a device without its user's knowledge is reserved for suspected crime and requires a director's signature.
Rarely, if ever, and never routinely. The ICO's guidance on monitoring workers (published 2023) says covert monitoring is only permissible in exceptional circumstances, such as where a crime is suspected or gross misconduct has occurred. Even then, it looks for senior management approval, a Data Protection Impact Assessment (DPIA), a clearly defined scope, and the reasons documented.
Preservation, above all. Turn off the machine and lock it in a drawer. Leave mailboxes and cloud accounts active instead of closing them. Do not open a folder before a forensic copy exists. Even well-meant browsing destroys the date stamps that would have shown files moving.
The way you got there matters as much as what you found. A damaging finding loses its force when the path leading to it can be taken apart. For a screenshot to be of value there must have been a lawful basis behind it, the search must have stayed within the suspicion that started it, and each stage of handling must have been logged.
An image of a workplace device taken early and handled properly will withstand scrutiny far better than one made hurriedly after notice has been given. Start it here. The first look is free, and what you tell us goes no further.