HR teams across Nottinghamshire · evidence off work devices
Image the computer as it is when the last user hands it back, before your IT team does anything with it: this is where evidence preservation starts, and it is the least expensive of all the stages. If the laptop came back in good order, it may still be worth working through. Windows keeps its own records; sync client applications keep their own records too; a clean-up doesn't change that. An employee could have set up a silent rule that copies every email coming into their account to their personal email address, for example. Or used a memory stick for the very first time on a Friday evening. Or deleted all the downloads off the laptop on the morning of an exit interview. So the computer is taken out of use, a forensic image is made of everything on it, and what is found is documented for both the HR panel and the solicitor. The cost starts at £800 + VAT and is agreed in writing before any work is undertaken.
An engineer will talk it through with you, in confidence
0115 8220606
| What it depends on | What is required of you | How the bench works to it |
|---|---|---|
| UK GDPR, with the Data Protection Act 2018 | Owning the computer is not a lawful basis. Choose one (generally legitimate interests), write down the balancing test, and do it before work starts | The examination is limited to the allegation you gave us, and will not go wider |
| ICO guidance on monitoring staff at work | Transparency comes first, and where the risk is high a DPIA is expected. The ICO is reconsidering this guidance in the wake of the Data (Use and Access) Act 2025 | Your policies are reviewed before the disk is, and if a DPIA is required, we say so |
| A covert examination | Exceptional circumstances only (suspected crime or gross misconduct), and a senior manager must sign off the decision | No imaging, and no files opened, until that signed-off authority exists in writing |
| The Acas standard | Fairness and proportionality in the investigation are what any disciplinary outcome has to rest on | Findings are reported as found, whichever side they happen to assist |
| How a tribunal weighs it | The method that produced the evidence decides what the evidence is worth | A continuity log that supports your case rather than giving the other side an advantage |
Forensic costs start at £800 + VAT depending on the scope of the job, as identified on your first call to us: what time frame and specific dates are in dispute? What equipment or accounts are involved? What evidence is needed? Your first call to us is free. Nothing is charged until you have our quote in writing.
Generally speaking, most of what will be lost will have been lost by two weeks, and very few of these losses will be intentional. The laptop is rebuilt for the new employee. The hard drive goes into a cupboard full of spare parts. A manager takes a quiet look around. Take the evidential image as early as possible (behind a blocker) so it arrives before any of those three.
After that, the image carries the work, and no one touches the original again. Each removable drive is identified separately, with the time it went in and how long it stayed. Uploads to a personal cloud storage account go on the list, as do webmail attachments, deletions and any sign that a wiping tool was used. All of it goes on one timeline.
This report is usually read by an HR panel, a tribunal or a solicitor, so it is aimed at them, not at an engineer. We measure what we do against the ICO's guidance on monitoring, and against the fair, proportionate investigation Acas looks for. There is no need to alter the document should police become involved at a later date.
If you give another party a result they can't verify themselves, then you have given them grounds for argument. So the bundle contains all the information: exhibit numbers, hash values, dated handovers (signed at both ends), the image each conclusion came from, and the notes taken while working at the bench. Run it again and you get the same answer.
The one figure we will stand behind: in 2013, Symantec and the Ponemon Institute reported that roughly half of people who had recently changed employer admitted taking confidential material from the job they left. Almost everything published since has come from companies with something to sell, and none of the numbers agree. What we see is duller. An employer who telephones able to name what they think went, rather than merely uneasy, is usually proved right by the artefacts.
Company property, so there was no issue authorising the examination. The evidence on the computer, in sequence, was: a folder made; a personal cloud account accessed from a web browser; the upload completed. Twenty days later the resignation letter arrived. All the Leicester employer had started with was a competitor's pitch deck. It closed on undertakings.
Ownership on its own does not mean very much. Two other things need to be present. First, a lawful basis. Second, employees informed beforehand that work machines can be examined, which is the whole purpose of an acceptable-use policy. If nothing was said in advance, the argument comes later. Examining a device without telling the person using it is kept for suspected crime or gross misconduct, and needs approval from senior management.
Rarely, and never as a matter of routine. Under the ICO's guidance on monitoring workers, covert monitoring is kept for exceptional circumstances only, such as suspected crime or gross misconduct. Even then, the guidance expects authorisation from senior management, a documented DPIA, a narrow scope, and the reasoning written down. That guidance is being reconsidered in the wake of the Data (Use and Access) Act 2025.
Preservation, above anything else. Turn the machine off and put it into access-controlled storage. Do not shut down the mailbox or the cloud accounts: keep them active. Do not open any folder until the forensic image has been created, as even a well-meant look round will alter the timestamps showing files being removed.
Not just what was at the end of the route, but how you got there, matters. Take that route apart and the damaging findings lose most of their power. A screenshot is worth something only if a lawful reason existed for the search, if the search stayed within the boundaries of the original suspicion, and if each step of the handling was recorded on a log.
Remove power from the DVR before you do anything else: as long as it is powered, it keeps writing, and the oldest footage goes first. Then get a quote and post the disk in. The first look is free. CCTV and DVR work is £400 + VAT, quoted in writing before any work starts, and anything recovered from the disk goes no further than our bench.