HR teams across London · evidence taken from work machines
Preserving evidence before IT decides to wipe the laptop clean (to be able to pass it on to a new employee on Monday) is your first move and the least expensive option. Any machine returned in good working condition will repay some inspection. Sync clients and Windows also keep track of what was done with the machine. Deleting files and creating an orderly environment leaves these records to be found. Inbox rules can quietly forward emails to a private email address. A memory stick the machine had never seen before one Friday evening. Downloads deleted on the day of the employee's exit meeting. So the computer stops being used, and an evidential image of its hard disk is taken. Whatever data exists in the image is documented for review by both the HR panel and the solicitor. No accreditation is claimed as part of this process, whether ISO/IEC 17025, a UKAS schedule or anything from a trade association, and page one of the report states this fact. Costs for services start from £800 + VAT, and are fixed in writing prior to service.
Talk it over with an engineer, in confidence
0203 0868633
| What it turns on | What that asks of you | What the bench does about it |
|---|---|---|
| UK GDPR, with DPA 2018 behind it | Having a lawful basis for collecting or processing personal data is not automatically established merely because one owns the equipment. Choose one (legitimate interests, as a rule), document your balancing test, and have all this documented prior to the work starting. | Only the scope of whatever allegation you submitted to us is examined, and we examine no additional matters beyond that. |
| The ICO's guidance on monitoring | Transparency first, followed by a DPIA where a significant risk exists. The ICO is reviewing its current guidance under the Data (Use and Access) Act 2025. | We read the policies before examining any disk content, and we tell you where a DPIA is required. |
| Examining it covertly | Exceptional situations only (gross misconduct suspected, or criminal activity suspected), with a senior manager documenting the authority to proceed. | There must be documentation establishing that authority in writing prior to imaging or opening any disk content. |
| The Acas benchmark | Nothing supports a disciplinary finding except a fair and proportionate investigation. | Findings are documented as found, regardless of which party they benefit. |
| Weight given to evidence by a tribunal. | The value of evidence is determined by the methodology used to produce it. | Continuity notes provide support for your case rather than providing the other side with a doorway. |
Our forensic charges start at £800 + VAT. The amount charged depends upon the size of the task at hand, and that is determined in the course of our first telephone conversation: dates and events in dispute; machines and accounts involved; what needs to be demonstrated. There is no charge made for the initial telephone call. Furthermore, nothing that you would be billed for commences until a written fee quotation has been delivered to you.
If you wait two weeks, most of what is going to disappear will already have gone (and rarely intentionally). Somebody will rebuild the employee's laptop for an incoming employee. The hard drive goes into a box marked "spare parts". A manager quietly reviews the employee's folders. Capture an image of the data early, while using a write blocker, and you will be ahead of all three.
After that point, all of the work is done on the image, and no one touches the original machine again. Each removable drive has a record of its own: when the device was inserted, and how long it stayed connected. When files are uploaded into a personal cloud account, each one has a record too, and the same goes for webmail attachments, for deletions and for any trace left behind by a wiping utility. All records are contained within a single timeline.
An HR panel, a tribunal or a solicitor may review this documentation, not an engineer, and it is written for them. Our actions will be evaluated against the guidance provided by the Information Commissioner’s Office regarding monitoring, and against what constitutes a fair, proportionate investigation per Acas. Employment work falls outside the scope of the Regulator's statutory Code, which applies only to criminal proceedings. Should the police become involved later, none of the above lines need to be changed.
Hand the opposite side a finding they have no way to verify, and the argument is theirs. So the bundle contains everything: each exhibit numbered, the hash values for each, dated and countersigned handovers, the images used for the conclusions reached, and the bench notes created whilst the work was ongoing. Repeat the steps and the result does not change.
The single figure we will stand behind: in 2013 the Ponemon Institute, together with Symantec, found that about half of everyone who had recently started a new job admitted to keeping confidential information from their previous job. Almost everything else since then was published by businesses trying to sell something, and none of the statistics agree. What reaches our bench is far less sensational than any of it. It is usually the employer who rings up able to tell you what they think went, rather than just feeling uneasy about the loss, whose suspicions the artefacts bear out.
This device belonged to the business, therefore authorising the examination did not create a controversy. What it showed came in sequence: a folder compiled; a browser logged onto a personal cloud account; uploading finished. Twenty days afterwards, a formal resignation letter. At the beginning of the investigation the employer had nothing but a competitor’s pitch deck. Undertakings concluded the case.
Ownership means very little by itself. However, unauthorised access is a section 1 offence under the Computer Misuse Act 1990, regardless of who purchased the equipment. There are two additional requirements. The first is a lawful basis. The second is that employees should have been informed in advance that the employer reserves the right to inspect its computers, and that is exactly why an acceptable-use policy exists. Don’t state that and it will come up again in some form later. Covertly going in to investigate an employee's activity is reserved for suspected criminal behaviour or gross misconduct, and needs approval at senior management level.
Rarely, and never routinely. The ICO states in its guidelines regarding worker monitoring that covert methods are limited to exceptional situations. Those include suspected criminal conduct, or misconduct at the gross end. Even then, there needs to be senior level authorisation, a data protection impact assessment, a narrow scope for the investigation, and reasons supporting the investigation need to be documented in writing. The ICO is revisiting these guidelines on worker monitoring under the Data (Use and Access) Act 2025.
Preserving the original data, above all else. Turn off the computer and place it in secure storage under controlled access. Shut down neither the email nor the cloud accounts; keep them active. Leave every single folder alone until a forensic image has been created, because even a well-meant look through the files can shift the exact time stamps that would have shown files leaving.
The path followed to get where one ended up is as important as what was found at the destination. Break the path down and most of the damaging finding goes with it. In order for a screenshot to provide value towards an issue, there must have been a lawful basis for the examination, the examination must have remained within the suspicion that prompted it, and there must be documentation on a log of every step of handling the evidence.
Regardless of what contains the evidence, turn off electrical power to it before doing anything else: a recorder still operating overwrites its oldest evidence every hour. Once power is removed, secure a price quotation (either by phone or through submitting a form), then post us just the disk or drive (do not include the recorder or computer), or drop it off at our Guildford intake lab, Monday to Friday, 9am to 5:30pm (no appointment needed). Evaluation costs nothing; work on recorders costs £400 + VAT and forensic analysis starts at £800 + VAT, both prices agreed to in writing beforehand. What sits on that disk stays here.