HR teams across London · evidence taken from work machines
Preservation is the first move and the cheapest, and it has to happen before IT wipes that laptop down for whoever starts on Monday. Even a machine handed back in good order repays a look. Windows notes things down; so do the sync clients; a tidy-up leaves the pair of them sitting there. An inbox rule quietly forwarding to a private address. A stick the machine had never met until one Friday evening. Downloads cleared out on the day of an exit meeting. So the laptop stops being used, an evidential image is made, and what the image holds is set out for the HR panel and the solicitor. No accreditation is claimed here — no ISO/IEC 17025, no UKAS schedule, nothing from a trade association — and page one of the report says so. From £800 + VAT, fixed in writing first.
Talk it over with an engineer, in confidence
0203 0868633
| What it turns on | What that asks of you | What the bench does about it |
|---|---|---|
| The UK GDPR, with the DPA 2018 behind it | A lawful basis is not created by owning the machine. Pick one — legitimate interests, as a rule — record the balancing test, and have all that done before work opens | The examination is scoped to whatever allegation you gave us, and reaches no further |
| The ICO's guidance on monitoring | Transparency first, and a DPIA where the risk runs high. The ICO is revisiting this guidance under the Data (Use and Access) Act 2025 | The policies are read here before the disk is, and you are told where a DPIA is called for |
| Examining it covertly | Exceptional matters only — criminality suspected, or misconduct at the gross end — with a senior manager putting a name to the decision | Nothing imaged and nothing opened before that authority exists in writing |
| The Acas benchmark | Nothing supports a disciplinary outcome except an investigation that was fair and proportionate | Findings go in as found, whichever party they happen to help |
| How a tribunal weighs it up | What the evidence is worth is set by the method that produced it | Continuity notes that shore your case up instead of handing the other side a door |
Forensic instructions start at £800 + VAT, and where a particular job lands within that depends on scope — which is what the first conversation is for: the dates and events in dispute, the machines and accounts in play, and what has to be shown. That conversation is not charged for, and no work that costs you anything begins before the written figure reaches you.
Give it a fortnight and most of what goes has already gone, and hardly any of that on purpose. Somebody rebuilds the laptop for a new arrival. The drive lands in a box of spares. A manager takes a quiet look through the folders. Image it early, behind a blocker, and you are ahead of all three.
From then on the work runs on the image and nobody touches the original again. Each removable drive gets an entry of its own: the hour of insertion, and the length of the connection. Uploads into a personal cloud account get one. So do webmail attachments, deletions, and any trace left by a wiping tool. One timeline carries the lot.
An HR panel reads this, or a tribunal, or a solicitor — not an engineer — and it is pitched at them. Our own conduct is measured against what the ICO says about monitoring, and against the fair, proportionate investigation Acas looks for. Employment work sits outside the Regulator's statutory Code, which reaches only criminal proceedings. If the police come into it afterwards, not a line has to change.
Hand the other side a finding they have no way of testing and the argument is theirs. So the bundle carries the lot: every exhibit numbered, every hash, handovers dated and countersigned, the image behind each conclusion, and the notes written up at the bench while the work went on. Repeat the steps and the result does not move.
The single figure we will stand behind: in 2013 the Ponemon Institute, with Symantec, put it at roughly half — half of everybody lately in a new job admitted keeping confidential material from the old one. Nearly all of what has appeared since was published by firms with something to sell, and no two of those numbers match. What reaches this bench is duller than any of it. The employer who telephones able to say what they think went, instead of simply feeling uneasy, is usually the one the artefacts bear out.
The machine was company property, so authorising the examination caused no argument. What it showed came in sequence: a folder assembled; a browser signed in to a personal cloud account; the upload completed. Twenty days after that, a resignation letter. All the employer had at the outset was a rival's pitch deck. Undertakings closed the matter.
By itself, ownership settles very little — and access without authority is a section 1 offence under the Computer Misuse Act 1990, whoever bought the hardware. Two further things are wanted. A lawful basis is the first. The second is a workforce warned in advance that the firm may examine its own machines, which is the whole purpose an acceptable-use policy serves; leave it unsaid and the argument turns up later. Going in without telling the user is kept for gross misconduct or suspected criminality, and wants authorising at senior level.
Seldom, and never as routine. The ICO's guidance on monitoring workers holds covert methods back for exceptional circumstances: criminality suspected, or misconduct at the gross end. Even there it expects senior authorisation, a DPIA, a narrowly drawn scope, and reasoning put in writing. That guidance is being revisited by the ICO under the Data (Use and Access) Act 2025.
Preservation, before anything else at all. Power the machine off and put it in storage under controlled access. Do not shut the mailbox or the cloud accounts down; let them run. And leave every folder alone until the forensic image has been made, since even a well-meant look shifts the very timestamps that would have shown files leaving.
The route matters as much as whatever sat at the end of it. Take the route apart and most of the damaging finding goes with it. For a screenshot to count for anything, there has to have been a lawful basis under the examination, the examination has to have kept within the suspicion that prompted it, and every stage of handling has to be on a log.
Whatever holds the evidence, take it off power before anything else — a recorder that is still running overwrites its own oldest material, hour by hour. Send it to us after that. Looking costs nothing; recorder work is £400 + VAT and forensic instructions start at £800 + VAT, both settled in writing beforehand. What sits on that disk stays here.