Digital forensics · evidence and investigations
Once information is going to be relied on as evidence, handling matters just as much as content. Nothing is examined until an image of it has been taken, every action is documented, and our reports are designed so another expert (or even a judge) can retrace exactly what was done. Independent, discreet, and truthful about what this lab is.
Speak to us in confidence
0800 6890668
| The complaint | What the analysis shows | What you get |
|---|---|---|
| One machine that could settle a disagreement | An image taken behind a write blocker, then the files, artefacts and timeline read | A findings report in plain English |
| An ex-employee suspected of taking company data | A timeline of USB, cloud storage and webmail use, plus deletions and wiping | A document that lawyers and HR can work from. |
| Erased material with legal significance | Whether it existed, when, and what happened to it (forensic recovery). | The material itself, with how and when |
| An encrypted file container, where there is authority to open it. | Passware used for decryption, if a key or password can be found. | Decrypted material, method recorded |
| A case bound for a hearing | Identical work, prepared in accordance with either CPR Part 35 or CrimPR Part 19 | An expert report fit for court |
| Video from a CCTV or DVR unit | Retrieved and exported with continuity retained (see our CCTV hub) | Viewable footage and the continuity log |
Each instruction begins with a private discussion: what's happened so far, all relevant devices and accounts involved, and what issue needs to be resolved using this evidence. Before any examination is carried out, you will receive one fixed quote in writing, and that first (scoping) phase is free.
Each item is first copied behind a hardware write-blocker before a single file is opened. The originals are considered evidence, and evidence is not for browsing.
The images that were created are examined in X-Ways Forensics and OSForensics, including artefacts, file activity, deleted data and timeline information, with each step documented as it happens.
All results will be communicated clearly and concisely in plain English and based on the question(s) you asked us, along with all of the technical details of how we arrived at those conclusions. No results will ever be watered down or altered to fit any client's needs.
What is returned to you is the full set: the report itself, its exhibits, all of the underlying files, and the hash values, continuity logs and notes taken as we worked. Should another expert or a tribunal later probe it, every step can be retraced.
Why early private capture counts: HMICFRS stated in its December 2022 report that over 25,000 devices were awaiting examination in police digital-forensics backlogs; further, Crown Prosecution Service figures analysed by the University of Leicester and the BBC, published in June 2025, indicated that more than 30,000 prosecutions were dropped in England and Wales in the four years from October 2020 to September 2024 due to missing, damaged or otherwise lost evidence. If the evidence is preserved properly at the outset, it never ends up in that queue.
| Which platform | The job it does on a case | Why we use it |
|---|---|---|
| X-Ways Forensics | Working through the image: artefacts, file activity, deleted material, timelines | Quick and lean enough that a small lab can use it well, rather than half-well |
| OSForensics | Gathering, indexing and searching Windows machines and the images taken from them | Wide-net discovery: registry hives, recent activity, records of devices plugged in |
| Passware | Decryption where the instructing party holds lawful authority and a key can be worked out | The one straight path into an encrypted container: it either works or fails |
| Atola Insight Forensic | Write block imaging in hardware and hashing integrated into the process | Images and reports simultaneously, so continuity isn't bolted on afterwards |
| ACE Lab PC-3000 & Data Extractor | Firmware-level access if the exhibit is itself a dying hard drive | A failing disk is still an exhibit and must still be treated as one |
Why we tell you this in advance: since April 2019, criminal practice directions have required an expert to disclose anything that relates to their credibility, including any gaps in their accreditation. Being straight about it is not a matter of tone; it is what lets evidence hold up when tested.
The client was convinced that files had been stolen. But the timeline of events showed nothing more sinister than a poorly configured sync, which had removed files from a shared drive, with most able to be restored. Providing that honest finding closed the argument much faster than the theft accusation would have.
Electronic evidence is preserved, examined and reported upon in such a way that the results will stand up. The device is imaged before anyone examines the data, each step is logged to create an audit trail, and the findings are written so a second examiner could repeat the work.
Every single case is reviewed individually. We provide each client with a free scoping call, followed by one written quote covering imaging, analysis and reporting before any work starts. There are no hour-by-hour charges.
No. Our computer forensic services cover computers, drives, storage media and CCTV equipment; phones and tablets are outside them. If your case requires a phone examination, we will advise you accordingly and refer you to a specialist.
As an independent laboratory, we do not have UKAS or ISO accreditation. We make no secret of this: we clearly state it in our reports, which is mandatory under the rules. Instead, we employ an open method: we take write-blocked images, hash all collected data to ensure integrity, document each stage of the process, and produce reports written to CPR 35 or CrimPR 19.
Loops are erased, footprints disappear and time runs out. Start your case as soon as possible; obtaining an estimate has no cost and is completely confidential.