Digital forensics · evidence and investigations
Once data is going to be relied on, handling counts for as much as content. Nothing is examined until it has been imaged, each action is written down, and the report is set out so a second expert — or a judge — can retrace it. Independent, discreet, and straight about what this lab is.
Speak to us in confidence
0800 6890668
| The problem | What the analysis shows | What you get |
|---|---|---|
| A single machine that might settle an argument | An image taken behind a write blocker, then files, artefacts and timelines read | A findings report in plain English |
| An ex-employee who may have taken company files | A timeline of USB, cloud and webmail use, plus deletions and wiping | A report HR and solicitors can work from |
| Erased material with legal significance | Did it exist, when, and what became of it — recovered forensically | The material itself, with how and when |
| An encrypted container, where authority to open exists | Passware used to decrypt, if a key or password can be found | Decrypted material, method recorded |
| A case bound for a hearing | Identical work, written up under CPR Part 35 or CrimPR Part 19 | An expert report fit for court |
| Video from a CCTV or DVR unit | Retrieved and exported with continuity intact — see our CCTV hub | Viewable footage and the continuity log |
Every instruction opens with a private discussion: the events so far, the devices and accounts involved, and the question the evidence has to settle. Before any examination is carried out you get one fixed quote in writing — and that first scoping stage is free.
Each item is copied behind a hardware write-blocker before a single file is opened. Originals are evidence, and evidence is not for browsing.
The image is what gets examined, in tools such as OSForensics — artefacts, file activity, deleted material, timelines — and each step is logged while it happens.
You get the findings in plain English, set against the question you put to us, with the full technical working behind them. Nothing is toned down to suit the client.
What comes back to you is the full set — the report, its exhibits, the underlying files — along with hashes, continuity logs and the notes we made as we worked. Should another expert or a tribunal later probe it, every step can be retraced.
Why early private capture counts: an HMICFRS report in December 2022 put over 25,000 devices in police digital-forensics backlogs awaiting examination, while the Westminster Commission on Forensic Science reported in June 2025 that over four years upwards of 30,000 prosecutions collapsed in England and Wales because evidence was lost, missing or too thin. Preserved properly at the outset, it never joins that queue.
| Platform | The job it does on a case | Why we use it |
|---|---|---|
| X-Ways Forensics | Working through the image — artefacts, file activity, deleted material, timelines | Quick and lean enough that a small lab can use it well rather than half-well |
| OSForensics | Gathering, indexing and searching Windows machines and the images taken from them | Wide-net discovery — registry hives, recent activity, records of devices plugged in |
| Passware | Decrypting where the instructing party holds lawful authority and where a key can be worked out | The one straight way into an encrypted container — it either succeeds or it fails |
| Atola Insight Forensic | Imaging with write blocking in hardware and hashing built into the run | It images and reports together, so continuity isn't bolted on later |
| ACE Lab PC-3000 & Data Extractor | Access at firmware level when the exhibit is itself a dying drive | A failing disk is still an exhibit, and still has to be treated as one |
Why we set this down: from 2019 the criminal procedure rules have required anything touching an expert's credibility to be disclosed, accreditation gaps included. Being straight about it is not a matter of tone; it is what lets evidence hold up when tested.
A client was certain files had been stolen. The timeline showed something duller: a badly configured sync had removed them from a shared drive, and most could be brought back. That truthful finding closed the argument sooner than the accusation would have.
Preserving, examining and reporting on electronic data so it will stand up — devices imaged before anyone examines them, each step logged, findings written so a second examiner could repeat the work.
Each case is scoped on its own: a free scoping call first, then one written quote covering imaging, analysis and reporting before any work starts. No hourly meter.
No. Our work covers computers, drives, storage media and CCTV kit — phones and tablets are outside it. Should a handset matter to your case, we'll say so and refer you on to a specialist.
We are an independent lab without UKAS or ISO accreditation, and we state that openly — in our reports too, as the rules demand. In its place we put an open method: write-blocked imaging, hashing, a logged process, and reports written to CPR 35 or CrimPR 19.
Loops write over themselves, traces fade, deadlines run out. Start a case early — scoping it costs nothing and stays confidential.