Solicitors, HR teams and loss adjusters · evidence work in Nottingham
Scoping costs nothing, and one figure goes into writing before a cable reaches the exhibit: forensic instructions start at £800 + VAT. That buys a hardware blocker in line before anything is touched, a sector-by-sector image taken behind it, MD5 and SHA-256 proved at both ends, a continuity log typed at the bench as the work proceeds, and a report shaped to the forum — Part 35 where the claim is civil, Part 19 where it is criminal. This laboratory holds no ISO/IEC 17025 and carries no UKAS schedule, and page one of every report opens with that sentence, because an expert is required to disclose it. It matters less often than you would think: the Regulator's statutory Code reaches the detection and investigation of crime and criminal proceedings in England and Wales, and stops there, which leaves civil, family, employment and insurance work — almost everything that arrives here from Nottingham — outside the regime altogether.
An engineer will talk it through, in confidence
0115 8220606
| What is happening | What the examination turns up | What we hand back |
|---|---|---|
| The single laptop a case turns on | Blocked, imaged, then examined only on the duplicate: documents, system artefacts, and the sequence they fall into | A written answer, in ordinary English |
| A leaver, and files that went with them | Each USB device, its serial and how long it stayed connected; uploads to cloud accounts and webmail; deletions; wiper runs — every one of them dated | A single dated timeline for HR and the solicitor |
| Deleted files the matter cannot proceed without | Evidence they existed, the point at which they went, and what happened next — carved back with continuity unbroken | The files, dated, alongside the method that reached them |
| An encrypted volume nobody can open | Passware pointed at the image, where authority exists and a key is genuinely within reach | Either the contents, or a plain sentence saying the encryption held |
| A matter listed for a hearing | Identical bench work, then written to the forum: Part 35 where the claim is civil, Part 19 where it is criminal | A report in the shape the court expects |
| Footage still held on a CCTV recorder | Lifted off the disk with continuity intact; the CCTV pages give the detail | Footage that plays, plus the paperwork standing behind it |
Forensic instructions begin at £800 + VAT, and where yours sits depends on scope — which is exactly what the first call settles: the events and dates at issue, the machines and accounts involved, and what precisely has to be proved. That call is free, and nothing chargeable starts before the figure is with you in writing.
Whatever arrives is treated as an exhibit rather than a bag of documents, so it is sealed on receipt. The hardware blocker goes in front of it, a full image comes off behind that, and only then does anyone look at anything. The original then sits in access-controlled storage while the duplicate carries the work.
Examination takes place inside the duplicate, and the exhibit is not opened again. OSForensics indexes the whole of it — the artefacts a system leaves as it runs, which documents were opened and when, what was removed, and in what order. Notes are typed step by step while that goes on.
The question you asked is answered in paragraph one, in ordinary English. Underneath it sit the workings, for anybody minded to test them. Findings that assist neither side are included as well, and they stay in.
Give the other side a finding they cannot check for themselves and you have given them an argument. So the bundle carries all of it: exhibit numbers, hashes, dated handovers signed at both ends, which image every conclusion came off, and the notes typed at the bench as the job ran. Run the same steps again and the answer is the same.
Image it in week one, before anybody else has a go: a fortnight of ordinary use makes it a different machine. Windows keeps writing to disk on its own account, the space once holding deleted material is reallocated, and event logs wrap round and start over. An image taken now records how things actually stood. An image taken next month records a machine that has carried on working since. So where a dispute looks likely: copy it, seal the original, and keep it under access control.
| Kit on the bench | What it is used for | Why we reach for it |
|---|---|---|
| X-Ways Forensics | Detail work inside the duplicate — usage history, artefacts, timelines and deleted material | Quick, uncluttered, and one tool known properly is worth four known roughly |
| OSForensics | Builds a searchable index of a Windows machine, or of the image taken from one | The broad first pass: registry hives, recent-file lists, and every USB device the machine has ever seen |
| Passware | Encrypted volumes, where authority exists and a key is within reach | It opens, or it does not; either way the report says which. Nothing is dressed up |
| Atola Insight Forensic | Acquisition with the write block in place, and hashing computed on the same pass | It logs its own acquisition, so the continuity record starts at sector zero |
| ACE Lab PC-3000 & Data Extractor | Firmware repair, where the evidence itself is a drive close to giving out | Now and then a disk is both the exhibit and the repair, and both trades sit in this room |
Why it goes first: an expert is obliged under the criminal rules to declare whatever a court might reasonably treat as denting their credibility, and CPS guidance is explicit that a missing accreditation belongs in that bracket. Declaring it at the top is not modesty; it is arithmetic. The other side's cheapest opening question disappears, and the argument moves on to method — where we would sooner have it.
Nobody had taken anything at all. The culprit was a sync client with the wrong settings, which had emptied the shared folder by itself — a duller answer than the theft the client came in expecting — and the bulk of what disappeared was still recoverable. That finding closed the dispute with nobody accused.
Three stages. A duplicate is made; the duplicate is examined; the findings are written to survive the testing that comes next. The image exists before a single file is opened, and bench notes go down while the job runs — tight enough that a second examiner could follow the same route to the same place.
No rate card exists, because no two instructions match. Scoping is free. What follows it is one figure in writing — imaging, examination and report inside a single number — agreed before a cable is connected. £800 + VAT is the starting figure for forensic instructions, and no hourly clock runs beneath it.
No. What this bench takes is computers — PCs and Macs — plus drives, cards, and the disks that come out of CCTV and DVR units. Handsets and tablets it does not. Where a case plainly lives on the phone, you hear that during the call, and we name a laboratory equipped for handsets.
No. No UKAS schedule stands against our name, and no ISO/IEC 17025 certificate sits behind this bench. That fact opens every report issued here, since the rules put a duty on an expert to declare it. Carrying the weight instead is method that can be checked: acquisition behind a write block, two hash values computed and then re-proved, a record of each step made while it is taken, and reporting under CPR Part 35 or, in a criminal matter, Part 19.
Cut the power to the DVR before anything else — while it runs it keeps writing, and the oldest footage goes first. Then post it in. The first look is free, CCTV and DVR work is £400 + VAT quoted in writing before anything starts, and what is on that disk goes no further than the bench.