Solicitors, HR teams and loss adjusters · evidence work for Nottingham
Scoping costs nothing, and forensic instructions start at £800 + VAT, with one figure put in writing before a cable reaches the exhibit. That covers a hardware blocker positioned in front of the exhibit before anything is touched, a sector-by-sector image taken behind it, MD5 and SHA-256 verified at both ends of the image, a continuity record typed at the bench as the work goes on, and a report to suit the forum (Part 35 in civil claims, Part 19 in criminal ones). This laboratory has no accreditation under ISO/IEC 17025 and no UKAS schedule, and each report includes a statement confirming this on its first page; an expert witness is required to disclose it. It is relevant less often than you would imagine: the Regulator's statutory Code applies to the detection and investigation of crime and criminal proceedings in England and Wales, and stops there, so civil, family, employment and insurance work (almost all the cases coming to us from Nottingham) falls outside the regime.
An engineer will talk it through with you, in confidence
0115 8220606
| What is happening | What the examination turns up | What we hand back |
|---|---|---|
| The single laptop a case turns on | Blocked, imaged, and then examined only on the duplicate: documents, system artefacts and the order they fall into | A written answer, in ordinary English |
| A leaver, and files that went with them | USB devices plugged into the computer, their serial numbers and how long each stayed plugged in; uploads to cloud accounts and webmail; deletions; wiper runs, all dated | A single dated timeline for HR and the solicitor |
| Deleted files the matter cannot proceed without | That the files existed, when they left, and what happened next, carved back with no break in continuity | The files, dated, alongside the method that reached them |
| An encrypted volume nobody can open | Passware run on the image, where authority exists and a genuine key is within reach | Either the contents, or a simple statement that the encryption held |
| A matter listed for a hearing | The same bench work, then written for the forum: Part 35 in civil claims, Part 19 in criminal ones | A report in the shape the court expects |
| Footage still held on a CCTV recorder | Taken off the disk with continuity preserved; the CCTV pages give further detail | Footage that plays, plus the paperwork standing behind it |
Forensic costs start at £800 + VAT depending on the scope of the job, as identified on your first call to us: what time frame and specific dates are in dispute? What equipment or accounts are involved? What evidence is needed? Your first call to us is free. Nothing is charged until you have our quote in writing.
Whatever arrives with us is treated as an exhibit rather than a bag of documents, so it is sealed once received. A hardware blocker goes in front of it and a complete forensic image is taken from behind the blocker. Only after that image exists is anything looked at. The original then stays in access-controlled storage while the duplicate carries the work.
Examination is done on the duplicate only, and the exhibit is not opened again. OSForensics indexes all of the data in the duplicate, including the artefacts a system leaves as it runs, which documents were opened and when, what was deleted, and in what order. Notes are typed step by step while that goes on.
The question you asked is answered in the first paragraph, in normal language. Below that, everything we did is explained in detail, for anybody who wants to test it. Some results don't help either side; they're there too, and they stay in.
If you give another party a result they can't verify themselves, then you have given them grounds for argument. So the bundle contains all the information: exhibit numbers, hash values, dated handovers (signed at both ends), the image each conclusion came from, and the notes taken while working at the bench. Run it again and you get the same answer.
Image it in week one, before anybody else has a go: two weeks of everyday use turns it into a different machine. Windows writes data to disk on its own account, the space once used by deleted items gets reused, and event logs fill up and start over. An image taken now captures how things actually stood. A later image captures a machine that has carried on working since. So when a dispute looks likely: make an image copy, seal the original and store it under access control.
| Kit on the bench | What it is used for | Why we reach for it |
|---|---|---|
| X-Ways Forensics | Detail work on the duplicate: usage history, artefacts, timelines and deleted material | Quick and clean, and one tool known properly is better than four known roughly |
| OSForensics | Builds a search index of a Windows machine, or of an image made from one | The broad first pass: registry hives, recent-file lists and every USB device the machine has ever used |
| Passware | Encrypted volumes, where authority exists and a valid key can be obtained | It will open, or it will not. The report states which. Nothing is dressed up |
| Atola Insight Forensic | Acquisition with write blocking in place, and hashes computed during the same pass | It keeps a log of how it acquired the drive, so the continuity record begins at sector zero |
| ACE Lab PC-3000 & Data Extractor | Firmware repair, when the evidence is a drive that is about to fail | Occasionally a disk is both the evidence and the repair, and both trades are in this room |
Why it goes first: under the criminal rules an expert has to disclose anything a court might reasonably treat as affecting their credibility, and under CPS guidance a missing accreditation falls into that category. Making the disclosure at the top is not modesty but simple arithmetic. The cheapest opening question from the other side disappears straight away, and the debate moves on to method, an area where we prefer to operate.
Nothing had actually been taken. The problem was an incorrectly configured sync client, which had emptied the shared folder by itself (less dramatic than the theft the client expected), and most of the lost files were still recoverable. That finding closed the dispute with nobody accused.
There are three phases. The duplicate is made; the duplicate is examined; and the results are written up ready for the testing that follows. The image exists before any file is opened, and the examiner makes detailed notes while the work runs, so another examiner could follow the exact same path to the same data.
There are no rate cards, because no two sets of instructions are ever identical. Scoping is provided without charge. Once the scope is set, what follows is a single price in writing covering imaging, examination and report, agreed before a cable is connected. Forensic instructions start at £800 + VAT, and no hourly clock runs underneath that.
No. All we accept at this bench are computers (PCs and Macs), drives, memory cards, and the disks taken out of CCTV and DVR units. We do not accept mobile phones or tablets. When a case clearly relates to the phone, we tell you during the call and name a laboratory equipped for handsets.
No. There is no UKAS schedule against our name, and no ISO/IEC 17025 certificate sitting behind this bench either. Each report we issue starts with a declaration of this, since the rules put a duty on an expert to make it. Instead of those credentials, we have a method that can be audited: acquisition behind a write block, two hash values calculated and then proved again, documentation at every stage as the work happens, and reporting under CPR Part 35 or, in a criminal case, Part 19.
Remove power from the DVR before you do anything else: as long as it is powered, it keeps writing, and the oldest footage goes first. Then get a quote and post the disk in. The first look is free. CCTV and DVR work is £400 + VAT, quoted in writing before any work starts, and anything recovered from the disk goes no further than our bench.