A development lead resigns from a firm on one of the Bracknell business parks, and six months later a competitor is showing off something your team spent three years building. The software and instrumentation companies along the M4, the engineering firms towards Camberley and Farnborough and the agencies around the Lexicon will all know that particular sinking feeling. The job here is to turn it into a dated, itemised account: what moved, the channel it moved through, and how the rival's material stands up when compared with your originals.
◇ Footing first, bench afterwards. An investigation along with its full written report is £800 + VAT; a verified image with the deleted files extracted and no report written is £400 + VAT, which is the same point as a recorder disk. There is no charge for the diagnostic, and the scope goes into writing first. Forensic work is paid upfront at the time you accept our fixed quote. On other services, in most cases you only pay if we recover your data (electronic and mechanical failures, chip-level work and physical damage are 50% upfront, with the balance only if we recover your data). Standard rates for ordinary recovery bands can be found on the data recovery cost page.
Engineering and product people are typically the ones who spot these first. Preserve first, then investigate, and only confront once both are complete.
Trade secrets almost never leave through a break-in. Instead they go out under a working login, in the middle of an unremarkable week, lost within the normal noise of a busy system. The loss may surface months after the fact, when a tender is narrowly lost or a product is launched with lines that look very familiar. That leaves three basic questions, and the answers to all three can be obtained from systems you already own: what moved? By which channel? On which days? No part of this requires access to the competitor, which is a good thing too, since we wouldn't have it anyway.
Beginning with images of the workstations involved and an image of the file server, the exit is rebuilt from start to finish. The device register shows drawing sets and repositories leaving in one movement. Sync-client logs and browser artefacts show material being moved into personal storage. Wholesale access turns up where restricted folders were opened in bulk around a resignation date, well beyond what the role required. Print service logs and spool remnants show protected drawings reaching paper, along with the file name and the number of pages recorded against a user. Deleted material also comes back where someone tidied up afterwards. The final step is sweeping the image for your own part numbers, project code names and confidentiality banners, so that renaming files on the way out of the building accomplishes absolutely nothing.
Once somebody else has possession of your material, the argument moves to showing where it originated. Office documents, PDFs and CAD files include embedded records that remain intact even when renamed and lightly edited: author, organisation, revision history, template name, internal reference and save times. Word also writes revision-save identifiers into a file as it is edited, and where two documents share them it becomes very difficult to argue that one was written independently of the other. Compared against your originals, that can show descent rather than mere resemblance. The comparison only counts if the rival's copy reached us lawfully, through disclosure or under an order of the court; obtained any other way it is worse than useless, because it hands the other side an argument for free.
An intellectual property claim takes its shape almost immediately. Imaging straight away fixes the record before anyone has tidied it, and that in turn decides whether an application for an interim injunction, or for a search order from the High Court, is founded on evidence or on inference. Machines are taken out of service and captured. The report follows evidential standards, with findings ahead of the appendix, and Part 35 of the Civil Procedure Rules governs both the expert's duty and what the report has to contain. Where the court has ordered a defendant's hardware to be imaged, the terms of the order are followed exactly as drawn and nothing outside them is looked at. Covert collection is not offered here, regardless of cost, and any firm offering it to you is offering you a problem rather than a solution.
How the bench itself works is described at the forensic recovery hub. For pen drives and cards, see the USB device forensics page. Insider threat forensics covers logins used in places they should not have been, and the leaver casework sits at employee data theft. Bands for ordinary recovery can be found on the prices page.
Together they move a suspiciously familiar rival product out of grievance and into evidence.
Entire drawing libraries, repositories and databases going out in one operation.
Your part numbers, code names and confidentiality banners, found on the image.
Embedded metadata and revision identifiers that trace a rival file back to yours.
Webmail, transfer sites, personal cloud and print, and there is a date on each of those events.
Erased files and archives that were still there in some form, brought back into the record.
When protected material was opened, exported and printed, and who was logged in at the time.
Let's start with the part people are least often told about: a forensic examination is paid upfront, once you accept the fixed quote. The arrangement where in most cases you only pay if we recover your data belongs to recovery work, and even there electronic and mechanical failures, chip-level work and physical damage are 50% upfront, while DVR, forensic, BitLocker and ransomware work is paid upfront. An examination is bench time spent answering a question, so it is charged whether the findings help you or not. What it does have is two published figures, which is two more than many other laboratories will put in front of you. An examination that ends in a full written report is priced at £800 + VAT. An examination that stops at the evidence itself, a verified binary image with the deleted material extracted out of it and handed over for another party to interpret, is priced at £400 + VAT. That second figure is the same point on the list as a recorder disk or a BitLocker volume, so it adds nothing new to the five bands listed throughout the rest of the site.
The examination itself, together with the full written report that comes out of it, produced so that an expert acting against you can follow each and every step and test it.
The verified binary image with the deleted files extracted from it, and no report written. It is the same figure a recorder disk or an encrypted volume carries, not an additional band.
Both figures are based on a single machine and a single question put to it. An exercise with nine laptops, a file server and a tenancy export is a greater scope of work, so anything which spans several devices is measured after the free diagnostic and written down before you agree to proceed. Diagnosis still costs nothing and still closes 2 working days after the device is booked in, and the fee is settled before an examiner opens the image, not afterwards. Everything other than forensic work keeps its published band on the prices page.
An IP instruction is worked on your own corporate estate, or on hardware the court has directed to be imaged, and it stays strictly within the four corners of that order. Three routes have always reached this bench; there has never been a fourth. Equipment that the business itself bought and issued. A written instruction from a solicitor, an insurer or the court. Or a device that genuinely belongs to the person asking, which in a family matter means one owned outright or owned jointly. Nothing is broken into here. We will not work out another person's password, nor will we install monitoring software onto a device the client does not own, and live traffic is never intercepted: interception is reserved exclusively for the bodies named in the Investigatory Powers Act 2016 and for nobody else. Where a client has no lawful right to look inside a device, instructing us will not give them one. Handsets and tablets fall completely outside the practice.
What can be proved later is decided during those first few days, so ring 0800 689 0668 for a quote first, leave the machines untouched, and we will decide together which drives you will send, as we only need the drives, not the machines. They get to Guildford by tracked, insured post or a courier you book yourself, or you can drop them off at the Guildford lab, Monday to Friday, 9am to 5:30pm, without needing an appointment. No part of this network collects, and Bracknell does not have a counter. Custody is recorded from the moment of arrival.
Is the hard drive still bolted into a machine, whether that is a laptop, a tower, an iMac, a MacBook, a rack server or a DVR stored under the till? Get a quote first, then pull the drive out of the machine and send only the bare drive (never the entire machine): from a server the disks come out labelled by bay, and from a DVR you just send the disk. Stripping hardware is not something our lab does, though any repair shop on your high street can do it in about ten minutes. The one case with no way round it is memory chips soldered flat onto the mainboard, which is how T2 and Apple Silicon Macs and certain ultrabooks are built, and that storage is not taken on. Call us first if you're not sure which kind you have. Where the storage cannot be unbolted, there is no parcel to make up.
↓ Print the shipping & booking-in form (PDF)
With your quote in hand, the name on the parcel wants to be Guildford Data Recovery. Driving it over from Bracknell takes roughly forty minutes along the A322 followed by the A3, and you do not need an appointment; posting it costs you a stamp and a day. Either way, a message goes out to you as soon as the package has been logged onto our system, and two working days after that the diagnostic is finished.
Unsure which items should go in the box? Call 0800 689 0668 whilst the box is still open, or work through the free online diagnostic and let it guide you.
Withdraw the machines and ring the freephone, because an early image is what an urgent application rests upon.