Solicitors, HR departments and loss adjusters · London evidence work
Scoping is free, and the figure is written down before a cable reaches your exhibit: forensic instructions open at £800 + VAT. It buys a write blocker fitted ahead of any power, an image lifted sector by sector behind it, MD5 and SHA-256 computed and then proved a second time, a continuity log typed up at the bench while work goes on, and a report shaped for its forum. Then the part no competitor prints. This lab holds no accreditation of any kind — no ISO/IEC 17025, no UKAS schedule, no police or Home Office approval, no trade association — and that sentence opens page one of every report, since an expert has a duty to declare it. It draws a boundary too. The Forensic Science Regulator's Code, statutory since October 2023 and in its second version since 2 October 2025, requires ISO/IEC 17025 for digital evidence in criminal proceedings in England and Wales, under DIG 100 for data from storage devices and DIG 300 for CCTV footage. Work within that scope is not ours to take, and what you get is a name rather than a quote. Civil claims, family proceedings, employment and insurance disputes sit outside it — nearly all of what arrives here.
Talk it over with an engineer, in confidence
0203 0868633
| What is going on | What an examination shows | What is handed over |
|---|---|---|
| One laptop, and a case resting on it | Blocked, imaged, then read only on the duplicate: documents, the traces a system leaves behind, and the order they fall into | A written answer, put in ordinary English |
| Somebody who left, and files that left too | Every USB device by serial, the hour of insertion, the length of the connection; uploads into personal cloud accounts; webmail attachments; deletions; wiper runs — each of them dated | One dated timeline, for HR and the solicitor together |
| Deleted files the matter cannot move without | Proof the files existed, the hour of their going, and what followed it — carved back out with the continuity unbroken | The files themselves, dated, with the method that found them |
| A locked volume nobody can get into | Passware turned on the image, where there is authority to open it and a key is genuinely reachable | Either what was inside, or a plain sentence saying it held |
| A dispute already listed for hearing | The same bench work, then shaped to the forum: CPR Part 35 for a civil claim, and the Code talked through first if the matter is criminal | A report in the form the court is expecting |
| Footage a recorder is still holding | Taken off the disk with continuity kept intact; the CCTV section spells out how | Footage that plays, and the paperwork that stands behind it |
Forensic instructions start at £800 + VAT, and where a particular job lands within that depends on scope — which is what the first conversation is for: the dates and events in dispute, the machines and accounts in play, and what has to be shown. That conversation is not charged for, and no work that costs you anything begins before the written figure reaches you.
Whatever lands here is handled as an exhibit and not as a parcel of documents, so it is sealed on arrival. A write blocker is fitted, a full image is lifted behind it, and only once both of those are done does anybody look at anything. Your original then moves into storage under controlled access, and the duplicate does the rest.
Examination runs inside the copy, and your exhibit is not opened a second time. OSForensics indexes the lot — what a system writes down about itself while running, which documents were opened and at what hour, what went, in what sequence. Notes go down step by step as that happens.
Paragraph one answers the question you asked, in ordinary English. The workings sit beneath it for anyone who wants to test them. Findings that help neither party go in as well, and nobody takes them out again.
Hand the other side a finding they have no way of testing and the argument is theirs. So the bundle carries the lot: every exhibit numbered, every hash, handovers dated and countersigned, the image behind each conclusion, and the notes written up at the bench while the work went on. Repeat the steps and the result does not move.
Image it in week one, before anyone else gets a look: a fortnight of ordinary use hands you a different machine. Windows writes on its own account, space that held deleted material is given away to something else, and event logs wrap round and begin again. Image it today and you record how things really stood. Image it next month and you record a machine that has been in service throughout. Where a dispute looks at all likely, then: copy it, seal what you copied from, and put that under controlled access.
| Equipment used | What it is there for | The reason for it |
|---|---|---|
| X-Ways Forensics suite | Close work inside the duplicate — usage history, system traces, timelines and deleted material | Fast, uncluttered, and knowing one tool properly is worth knowing four of them roughly |
| PassMark OSForensics | Puts a searchable index across a Windows machine, or across the image taken off one | The wide first sweep: registry hives, recent-file lists, every USB device the machine has ever met |
| Passware Kit | Locked volumes, where authority to open them exists and a key is within reach | The volume gives way or it holds, and the report says which. Nothing here is dressed up |
| Atola Insight Forensic imager | Acquisition with the write block already in place, hashing computed on the same pass | Acquisition is logged by the machine itself, so continuity is on the record from sector zero |
| ACE Lab PC-3000, with Data Extractor | Firmware work, for when the evidence is itself a drive on its way out | Sometimes a disk is the exhibit and the repair at once, and both trades live in this room |
Why it goes at the top: an expert has to declare, under the criminal rules, whatever a court could fairly treat as denting credibility, and CPS guidance puts an unheld accreditation squarely in that class. Declaring it first is arithmetic rather than modesty. The cheapest question the other side had is gone, and the argument shifts to method, which is where we would rather it were.
Nothing of the sort had happened. A sync client, wrongly configured, had emptied the share by itself — a far duller explanation than the one the client had assumed — and most of what had gone proved recoverable. The finding settled the argument without a single person being blamed.
Three stages, always in that order. A duplicate is taken; the duplicate is worked on; the findings are written so they hold together when somebody sets out to pull them apart. Nothing gets opened before the image exists, and bench notes are typed while the job runs — close enough that a second examiner could walk the same road and arrive where we did.
No rate card exists here, since instructions never repeat. Scoping costs nothing. What comes out of it is one written figure with the imaging, the examination and the report all held inside it, agreed before a cable touches your exhibit. Forensic instructions open at £800 + VAT, and no hourly meter runs underneath.
No. Computers are what this bench takes — Windows machines and Macs — plus drives, memory cards, and whichever disk was living inside a CCTV or DVR box. Handsets and tablets want equipment we do not keep. Where a matter plainly turns on somebody's phone you hear it on the first call, and you are given the name of a laboratory built for handsets.
No — nor anything else. No UKAS schedule, no ISO/IEC 17025 certificate, no police or Home Office approval, no trade association. An expert must declare that, so it opens page one of every report. Statutory since October 2023, and in its second version since 2 October 2025, the Regulator's Code sets ISO/IEC 17025 for digital evidence in criminal proceedings in England and Wales — DIG 100 for data from storage devices, DIG 300 for CCTV footage. Instructions within that scope go to an accredited laboratory and we name one. Civil, family, employment and insurance work sits outside it entirely.
Whatever holds the evidence, take it off power before anything else — a recorder that is still running overwrites its own oldest material, hour by hour. Send it to us after that. Looking costs nothing; recorder work is £400 + VAT and forensic instructions start at £800 + VAT, both settled in writing beforehand. What sits on that disk stays here.