Employee Data Theft Investigations

An account manager hands in notice at a software firm on one of the A329(M) parks; a buyer leaves a distributor on the Reading side of the M4. Eight weeks later a competitor is working a client list that nobody outside your building could have assembled. The laptop that came back usually knows what happened, and it knows it right up until the first person logs in and starts writing over the answer. Work here runs on a copy that verifies, and the report claims nothing the copy will not support.

Footing first, bench afterwards. An investigation with its full written report is £800 + VAT; a verified image with deleted-file extraction and no report written is £400 + VAT, the same point as a recorder disk. The diagnostic is free and the scope goes in writing first. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Ordinary recovery bands are published on the data recovery cost page.

// stop before anyone signs in

Six reasons to take the image today

One of these on its own is enough to take the device out of circulation and leave it untouched until a copy exists — the same answer whether the firm trades from Bracknell, Wokingham, Slough or south London.

It came back freshly reinstalled and nobody in IT asked for that
A pen drive or portable disk started turning up during the notice period
Documents went out to a private address in ones and twos across a month
A private Dropbox, OneDrive or Google Drive is signed in on issued hardware
Shared folders were opened wholesale, late in the evening, before the resignation
Clients report being approached from the leaver's new employer

Do nothing for the first hour

Restraint decides more of these cases than effort does. Every sign-in writes fresh data over the old. A well-meant look round by the IT team moves precisely the access times that will matter later. A rebuild for the next starter ends the enquiry outright, and no amount of money afterwards buys it back. So the opening routine is short and unexciting: shut the machine down rather than logging out of it, label it, write down everyone who has touched it since it came back, and put it somewhere nobody will helpfully open it. The examination then runs entirely against a copy that verifies, while the hardware stays sealed — which is also what allows an expert instructed by the other side to look at the same machine and form their own view of it.

The notes Windows keeps without being asked

An operating system makes a better witness than most people, because it has no reason to shade anything. USBSTOR carries an entry for every stick, card reader and portable drive the machine has met, with maker, product and serial, and modern builds add first-connected and last-removed times to each. setupapi.dev.log dates the first appearance of each of them. Shortcut files and jump lists tie named company documents to the drive letter and volume serial belonging to the removable volume. Shellbags keep the folder structure somebody browsed while it was mounted. The change journal stamps a time on each operation across the weeks at issue. Put in order, that material moves a suspicion into territory where a solicitor can do something with it.

The copying that never touches a USB port

These days most of it leaves through a browser tab and a sync client. The image turns up webmail sessions attaching files to a private address, mailbox rules quietly pushing selected traffic outward, uploads to file-transfer sites, and a personal sync client mirroring folders into private storage while its own logs record which folders and from what date. Two patterns are worth naming because they recur constantly. The first is mass access: several hundred files opened across directories the role had never gone near, clustered in the days either side of a resignation. The second is printing. The print service log records document name, user, printer and page count, and spool remnants left in the spool directory and in unallocated space frequently survive long after the job itself completed. Where the business runs Microsoft 365 or Google Workspace, the tenancy audit records come in too, so the platform's account of an afternoon can be set beside the endpoint's account of the same afternoon.

Written for the panel, not for the bench

The intended reader is a tribunal panel, possibly with a technical assessor sitting beside it. Findings lead, numbered and dated, each tied to the artefact it came from, and the technical reasoning goes into an appendix where it belongs. The exhibit schedule carries a SHA-256 value against every image on it. Should the matter head for the High Court instead — an interim injunction, or a search order aimed at a former employee — the same material carries the application, and it does so precisely because it was taken early and written up while it was being taken. Nothing is asserted beyond the record, and one further point is worth making to any employer: an investigation of this kind processes personal data, so it needs a lawful basis and a proportionate scope under the UK GDPR and the Data Protection Act 2018. Agreeing the date range and the categories in advance is not bureaucracy. It is what keeps the findings usable.

How capture and custody work across the practice is set out at the forensic recovery hub. Plug-in history has a page of its own at USB device forensics, routes out through a tenancy at email and cloud exfiltration, and the obligation to preserve at legal hold and chain of custody. Bands for ordinary recovery are on the prices page.

// the findings, itemised

What the instruction produces in writing

Each item below arrives as a numbered finding with a date on it and the artefact it rests on named beside it, in a document a tribunal panel can work from without a translator.

// what one machine gives up

Six threads out of one laptop

Captured before it is reissued, a leaver's computer will normally surrender the lot.

Hardware register

Every device ever mounted, by maker, product and serial, with its dates.

Transfer timings

Journal entries and destination clocks placing named files on a device at a stated hour.

Opened-from proof

Shortcuts and jump lists binding documents to the volume they were opened from.

Ways out

Webmail sends, mailbox rules and sync-client logs still sitting on the machine.

Surrounding conduct

Mass folder access, print runs, late sessions and messages about the move.

Integrity

Capture date against leaving date, with hash values that still verify today.

// paying for it, and being entitled to ask

What it costs, and who may instruct

Two figures, printed rather than hinted at

Start with the part people are least often told: a forensic examination sits outside no fix, no fee. That guarantee belongs to logical recovery work, and the stated exclusions are electronic and mechanical failures, chip-level work, DVR jobs and forensic jobs. An examination is bench time spent answering a question, so it is charged whether the answer helps you or not. What it does have is two published figures, which is two more than most laboratories will put in front of you. An examination that ends in a full written report is £800 + VAT. An examination that stops at the evidence itself — a verified binary image with the deleted material extracted out of it, handed over for somebody else to interpret — is £400 + VAT. That second figure is the same point on the list as a recorder disk or a BitLocker volume, so it adds nothing new to the five bands the rest of the site publishes.

£800 + VAT

The examination and the full written report that comes out of it, produced so an expert acting against you can follow every step and test it.

£400 + VAT

The verified binary image with deleted files extracted from it, and no report written. The same figure a recorder disk or an encrypted volume carries, not an extra band.

Both figures assume one machine and one question put to it. Nine laptops, a file server and a tenancy export is a larger exercise, so anything spanning several devices is measured after the free diagnostic and written down before you agree to it. Diagnosis still costs nothing and still closes 2 working days after the device is booked in, and the fee is settled before an examiner opens the image rather than after. Everything that is not forensic keeps its published band on the prices page.

The footing an examination needs

These investigations run on equipment the business bought and issued, with HR standing behind them or a solicitor giving the instruction. Three routes reach this bench and there has never been a fourth. Equipment the business itself bought and issued. A written instruction from a solicitor, an insurer or the court. Or a device that genuinely belongs to the person asking, which in a family matter means one owned outright or owned jointly. Nothing is broken into here. We do not work out somebody else's password, we do not put monitoring software on a device the client does not own, and live traffic is never intercepted — interception belongs to the bodies named in the Investigatory Powers Act 2016 and to nobody else. Where a client has no lawful right to look inside a device, instructing us does not create one. Handsets and tablets fall outside the practice altogether.

// getting the media to the bench

Booking a device in — what actually has to happen

The moment a machine becomes an exhibit it travels on terms fixed beforehand, so ring 0800 689 0668 and we will settle packaging and paperwork before the box is closed. There is no collection anywhere in this network and no Bracknell counter, so it reaches Guildford by tracked, insured post or comes in over the counter there in office hours. The custody record opens at booking-in.

Is the storage still bolted into a machine — laptop, tower, iMac, MacBook, rack server, a DVR under the till? Free it first and send the bare unit. Stripping hardware is not something this lab does, though it is ten minutes' work for any repair shop on your high street. There is a single case with no way round it: memory chips soldered flat onto the mainboard, which is how Apple Silicon machines and certain ultrabooks are built. Where the storage cannot be unbolted, there is no parcel to make up.

  • Pick packaging that holds its shape — a rigid carton or a heavy padded mailer — and pack round the unit so it cannot shift in transit. Leave the caddy, the mains adaptor and the leads at home; none of them are wanted at this end.
  • Print the shipping and booking-in form (PDF), put your name and mobile on it along with a sentence describing how the fault started, and slip it in alongside the media.
  • Send it Special Delivery through the Post Office and it travels tracked and covered. A courier account of your own works just as well. The only thing that matters is that somebody signs for it at this end.
  • If you would sooner deliver it by hand, the Guildford reception on the address card takes devices over the counter, Mon–Fri 9:00am–5:30pm. Neither a Bracknell shopfront nor a pickup van exists — those are the two things we cannot offer.
// write this on the label

Guildford Data Recovery

Building 2, Ground Floor
Guildford Business Park
Guildford, GU2 8XH

↓ Print the shipping & booking-in form (PDF)

The name on the parcel wants to be Guildford Data Recovery. Driving it over from Bracknell is roughly forty minutes on the A322 then the A3; posting it costs you a stamp and a day. Either way, a message goes out to you as soon as it is logged onto the system, and two working days later the diagnostic is finished.

Unsure whether something should go in the box? Ring 0800 689 0668 while the lid is still open, or work through the free online diagnostic and let it tell you.

// employee data theft — the first call

What employers open with

Nearly always, yes. A reset is a noisy event rather than a quiet one. It is dated, a great deal of the registry and the journal survive it, and unallocated space holds on to a share of what was deleted beforehand. A reset that nobody in IT authorised is a finding in itself and worth putting in a report. Keep the machine off and out of the rebuild queue while you decide.
Separating those two is the examination. Attachment on its own establishes almost nothing, so shortcuts, jump lists, shellbags, journal entries and the clocks at the receiving end get read against one another until a named document sits on a named volume at a named hour. Producing the drive itself for imaging tightens that considerably.
On equipment the business bought and supplied, generally yes, and a signed acceptable-use or IT policy leaves very little to argue about. The basis goes in writing before anything is touched, any instruction from your solicitor is followed to the letter, the date range and categories are kept proportionate, and nothing belonging personally to the former employee is examined.
Numbered findings against their sources, a dated sequence of events, an exhibit schedule with hash values, a method appendix and the custody record — all prepared to evidential standards. Whether it is admitted stays with the panel, as it should. Giving them nothing to hesitate over is the half we can actually control.

The laptop knows. Stop using it.

Shut it down, ring the freephone, and let a copy that verifies do the talking on your behalf.