HR teams across Nottinghamshire · evidence off work devices
Image the machine before IT rebuilds it for the next starter: preservation is the first step and the cheapest one. A laptop handed back in good order still repays a look. Windows writes records of its own, sync clients write theirs, and a tidy-up leaves both where they are. A rule quietly copying inbound mail off to a private address. A memory stick seen for the first time on a Friday evening. Downloads emptied on the very morning of an exit meeting. So the laptop leaves service, an evidential image is taken, and its contents get written up for the HR panel and the solicitor. £800 + VAT upwards, fixed in writing before anything starts.
An engineer will talk it through, in confidence
0115 8220606
| What it depends on | What is required of you | How the bench works to it |
|---|---|---|
| UK GDPR, with the Data Protection Act 2018 | Owning the device is not a lawful basis. Pick one — legitimate interests, as a rule — write the balancing test down, and do it before any work begins | The examination is scoped to the allegation you gave us, and goes no wider |
| ICO guidance on monitoring staff at work | Transparency comes first, and where risk is high a DPIA is expected. This guidance is being reconsidered by the ICO in the wake of the Data (Use and Access) Act 2025 | Your policies get looked at before the disk does, and where a DPIA is called for we say so |
| A covert examination | Exceptional cases only — crime suspected, or gross misconduct — and a senior manager has to put a name to the decision | No imaging and nothing opened until that authority is there in writing |
| The Acas standard | Fairness and proportionality in the investigation are what a disciplinary outcome has to rest on | Findings are reported as found, whichever side they happen to assist |
| How a tribunal weighs it | The method that produced the evidence sets what the evidence is worth | A continuity log that strengthens your case instead of opening a door for the other side |
Forensic instructions begin at £800 + VAT, and where yours sits depends on scope — which is exactly what the first call settles: the events and dates at issue, the machines and accounts involved, and what precisely has to be proved. That call is free, and nothing chargeable starts before the figure is with you in writing.
Within a fortnight most of what vanishes has gone, and hardly any of it on purpose. A laptop gets rebuilt for the next arrival. A drive is dropped into a cupboard of spares. A manager has a quiet look round. Get an image made early, behind a blocker, and it arrives before any of those three.
After that the image carries the work and nobody goes near the original again. Each removable drive is listed on its own, with the time it went in and the length of time it stayed. Uploads to a personal cloud account go on the list. So do webmail attachments, deletions, and any sign that a wiping tool was run. One timeline holds the lot.
This gets read by an HR panel, by a tribunal or by a solicitor, not by an engineer, and that is who it is pitched at. Our own conduct gets measured against what the ICO says on monitoring, and against the sort of fair, proportionate investigation Acas looks for. If police involvement follows later, the document needs no alteration.
Give the other side a finding they cannot check for themselves and you have given them an argument. So the bundle carries all of it: exhibit numbers, hashes, dated handovers signed at both ends, which image every conclusion came off, and the notes typed at the bench as the job ran. Run the same steps again and the answer is the same.
The one figure we will stand behind: Symantec and the Ponemon Institute reported in 2013 that roughly half of everyone who had lately moved employer admitted keeping confidential material from the job they left. Almost everything published since has come from businesses with something to sell, and none of the numbers agree. Duller is what we see. An employer who telephones able to name what they think went, rather than merely uneasy, is usually proved right by the artefacts.
Company property, so authorising the examination raised no argument. What the machine showed ran in order: a folder put together, a personal cloud account opened inside a browser, the upload completed. Twenty days later the resignation letter arrived. All the Leicester employer had begun with was a competitor's pitch deck. It closed on undertakings.
Very little follows from ownership by itself. Two other things are needed. One is a lawful basis. The other is staff who were told beforehand that work machines can be examined — the whole job an acceptable-use policy exists to do. Say nothing in advance and the argument comes later. Examining a device without telling the person using it is kept back for suspected crime or gross misconduct, and senior management has to authorise it.
Rarely, and never as a matter of routine. Covert work is held back by the ICO's guidance on monitoring workers for exceptional circumstances only — crime suspected, or gross misconduct. Even there it expects authorisation from senior management, a DPIA, a scope drawn tightly, and the reasoning written down. That guidance is being reconsidered in the wake of the Data (Use and Access) Act 2025.
Preservation, ahead of everything else. Power the machine down and put it into access-controlled storage. Do not close the mailbox or the cloud accounts — leave them running. And open no folder until the forensic image exists, since even a well-intentioned look round shifts the timestamps that would have shown files leaving.
The route you took counts as much as what waited at the end of it. Pull that route apart and the damaging finding loses most of its force. A screenshot is worth something only if a lawful basis stood behind the search, if the search kept within whatever suspicion prompted it, and if every stage of the handling went onto a log.
Cut the power to the DVR before anything else — while it runs it keeps writing, and the oldest footage goes first. Then post it in. The first look is free, CCTV and DVR work is £400 + VAT quoted in writing before anything starts, and what is on that disk goes no further than the bench.