A development lead resigns from a firm on one of the Bracknell business parks. Six months on, a competitor is demonstrating something your team spent three years building. The software and instrumentation companies along the M4, the engineering firms towards Camberley and Farnborough and the agencies around the Lexicon all know that particular sinking feeling. The job here is to convert it into a dated, itemised account: what moved, which channel it moved through, and how the rival's material stands up against your originals.
◇ Footing first, bench afterwards. An investigation with its full written report is £800 + VAT; a verified image with deleted-file extraction and no report written is £400 + VAT, the same point as a recorder disk. The diagnostic is free and the scope goes in writing first. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Ordinary recovery bands are published on the data recovery cost page.
Engineering and product people usually spot these before anybody else. Preserve first, investigate second, and confront only when both are done.
Trade secrets almost never leave through a break-in. They leave under a working login, in the middle of an unremarkable week, lost in the noise of a busy system, and the loss surfaces months later as a tender narrowly lost or a product with familiar lines. That leaves three questions, and all three are answerable from systems you already own: what moved, by which channel, and on which days. Nothing about that requires access to the competitor, which is just as well, because we would not have it.
Starting from images of the workstations concerned and of the file server, the exit gets rebuilt end to end. The device register shows drawing sets and repositories leaving in one movement. Sync-client logging and browser artefacts show material climbing into personal storage. Wholesale access turns up where restricted folders were opened in bulk around a resignation date, far past anything the role called for. Print service logging and spool remnants show protected drawings reaching paper, with the file name and the page count recorded against a user. Deleted material returns where somebody tidied afterwards. The image is then swept for your own part numbers, project code names and confidentiality banners, so that renaming a file on the way out of the building achieves precisely nothing.
Once material is sitting in somebody else's hands the argument moves to origin. Office documents, PDFs and CAD files carry embedded records that outlive renaming and light editing: author, organisation, revision history, template name, internal reference and save times. Word additionally writes revision-save identifiers into a file as it is edited, and where two documents share them it becomes very difficult to argue that one was written independently of the other. Compared against your originals, that can demonstrate descent rather than resemblance. The comparison only counts if the rival's copy reached us lawfully, through disclosure or under an order of the court — obtained any other way it is worse than useless, because it hands the other side an argument for free.
An intellectual property claim takes its shape almost immediately. Imaging at once fixes the record before anyone has tidied it, and that in turn decides whether an application for an interim injunction, or for a search order out of the High Court, is founded on evidence or on inference. Machines leave service and get captured. The report follows evidential standards, findings ahead of appendix, with Part 35 of the Civil Procedure Rules governing both the expert's duty and what the report has to contain. Where the court has ordered a defendant's hardware imaged, the order is carried out exactly as drawn and nothing outside its terms is looked at. Covert collection is not offered here at any price, and any firm offering it to you is offering you a problem rather than a solution.
How the bench itself works is at the forensic recovery hub. Pen drives and cards have their own page at USB device forensics; logins used where they should not have been are covered at insider threat forensics; the leaver casework sits at employee data theft. Bands for ordinary recovery are listed on the prices page.
Between them they move a suspiciously familiar rival product out of grievance and into evidence.
Whole drawing libraries, repositories and databases going in one operation.
Your part numbers, code names and confidentiality banners found on the image.
Embedded metadata and revision identifiers tracing a rival file back to yours.
Webmail, transfer sites, personal cloud and print, each one with a date on it.
Erased files and archives brought back into the record wherever they survived.
When protected material was opened, exported and printed, and under whose login.
Start with the part people are least often told: a forensic examination sits outside no fix, no fee. That guarantee belongs to logical recovery work, and the stated exclusions are electronic and mechanical failures, chip-level work, DVR jobs and forensic jobs. An examination is bench time spent answering a question, so it is charged whether the answer helps you or not. What it does have is two published figures, which is two more than most laboratories will put in front of you. An examination that ends in a full written report is £800 + VAT. An examination that stops at the evidence itself — a verified binary image with the deleted material extracted out of it, handed over for somebody else to interpret — is £400 + VAT. That second figure is the same point on the list as a recorder disk or a BitLocker volume, so it adds nothing new to the five bands the rest of the site publishes.
The examination and the full written report that comes out of it, produced so an expert acting against you can follow every step and test it.
The verified binary image with deleted files extracted from it, and no report written. The same figure a recorder disk or an encrypted volume carries, not an extra band.
Both figures assume one machine and one question put to it. Nine laptops, a file server and a tenancy export is a larger exercise, so anything spanning several devices is measured after the free diagnostic and written down before you agree to it. Diagnosis still costs nothing and still closes 2 working days after the device is booked in, and the fee is settled before an examiner opens the image rather than after. Everything that is not forensic keeps its published band on the prices page.
An IP instruction is worked on your own corporate estate, or on hardware the court has directed be imaged, and stays strictly within the four corners of that order. Three routes reach this bench and there has never been a fourth. Equipment the business itself bought and issued. A written instruction from a solicitor, an insurer or the court. Or a device that genuinely belongs to the person asking, which in a family matter means one owned outright or owned jointly. Nothing is broken into here. We do not work out somebody else's password, we do not put monitoring software on a device the client does not own, and live traffic is never intercepted — interception belongs to the bodies named in the Investigatory Powers Act 2016 and to nobody else. Where a client has no lawful right to look inside a device, instructing us does not create one. Handsets and tablets fall outside the practice altogether.
What can be proved later is decided in the opening days, so ring 0800 689 0668 first, leave the machines untouched, and we will agree between us which hardware travels. It reaches Guildford by tracked, insured post, or over the counter there in office hours. No part of this network collects and Bracknell has no counter. Custody is recorded from the moment of arrival.
Is the storage still bolted into a machine — laptop, tower, iMac, MacBook, rack server, a DVR under the till? Free it first and send the bare unit. Stripping hardware is not something this lab does, though it is ten minutes' work for any repair shop on your high street. There is a single case with no way round it: memory chips soldered flat onto the mainboard, which is how Apple Silicon machines and certain ultrabooks are built. Where the storage cannot be unbolted, there is no parcel to make up.
↓ Print the shipping & booking-in form (PDF)
The name on the parcel wants to be Guildford Data Recovery. Driving it over from Bracknell is roughly forty minutes on the A322 then the A3; posting it costs you a stamp and a day. Either way, a message goes out to you as soon as it is logged onto the system, and two working days later the diagnostic is finished.
Unsure whether something should go in the box? Ring 0800 689 0668 while the lid is still open, or work through the free online diagnostic and let it tell you.
Withdraw the machines and ring the freephone — an early image is the thing an urgent application stands on.