Material that leaves via a mailbox or cloud account is logged twice, once by the computer and once by the service, and a thorough investigation reads both. Rules applied to email, attachment history and sign-in patterns can be retrieved from within the tenancy. Browser and sync traces can be obtained from the device itself. Both sets of information are lined up into one dated record of what went where. For insurers, brokers and professional firms in the city centre, and the advisers working for them.
◇ Scope first, then work. After the free diagnostic and the written scope, forensic casework is payable upfront on acceptance of the fixed price. For all other jobs, in most cases you will only be charged if we recover your data. Full pricing is set out on our data recovery cost page.
Each has an innocent explanation. Taken together, they make a pattern that warrants a look.
A mailbox being used to move material behaves in ways you can recognise. Attachments begin to build up as the recipient list narrows to one personal email address. A new rule appears that automatically sends certain mail out, without anyone watching. The search history looks like hunting for customers, project names and price lists, rather than the day's work. Access drifts into evenings and weekends. The mail platform records all of it, and each item is retrieved and given its date during the examination.
The device supplies the other side of it. Browser traces show accounts being created and signed into at Dropbox, OneDrive and Google Drive from a company machine. A sync client's logs and folder setup show which directories were set to mirror upward, and from when. Cached pages, confirmation screens and recent file lists remain on the image even after a user clears their browsing history. A private account turning up on work hardware in the final month is seldom there for nothing.
Microsoft 365 and Google Workspace keep their own evidence, and this often decides the matter. Messages being moved, shared and downloaded appear in Purview audit logs and eDiscovery exports. Emails and files are held in Google Vault. All shares and bulk downloads show up in the SharePoint and OneDrive logs along with an account and a time. Dropbox keeps version histories and recoverable deletions. In many cases a deleted mailbox can be brought back from retention or backup, however only for a while, which is why we say ring early.
The finding that persuades is the one where all the pieces agree. A 2.1 GB download is recorded in the tenancy's log at 21:14. Two minutes later the same files show up in a private sync folder on the device. The browser history then fills in the final gap. Service evidence and machine evidence are combined into one run of events, any disagreement between them is flagged rather than smoothed over, and everything (the mailbox export, the audit extract and the image itself) is hashed before an account is suspended or a licence taken back.
The method behind all of it can be found at the forensic recovery hub. Logins and server logs are covered at insider threat forensics, the employer casework at employee data theft, and holding material at legal hold and chain of custody. Costs are on the prices page.
Service logs and machine traces, read against each other and shown as one timeline.
What was sent to private addresses, how big, and on which days.
Forwarding and deletion rules, when they were made and what they caught.
Sign-in hours and places, with clusters outside working hours marked.
Accounts, sync folders and leftover uploads on the work machine.
Sharing, download and export events from M365 and Workspace logs.
Messages and whole mailboxes recovered from retention and backup.
Every one of our instructions begins with the free diagnostic, which takes 2 working days from when the device arrives at the bench. Forensic casework is paid upfront as soon as you have accepted a fixed quote. A full forensic investigation including report is £800 + VAT, payable 100% upfront. The cheaper forensic binary image and deleted-file extraction service, without the report, is £400 + VAT, also paid upfront. All forensic work is payable upfront. A scope that covers several accounts or a whole tenancy is quoted in writing after the free diagnostic. Both prices can also be found on our prices page, and no money is ever taken before a written scope has been agreed.
Mailbox and cloud work runs on the company's tenancy and its devices, or by way of a written instruction from a solicitor. There are three footings that open the door, and there is no fourth. The first is kit owned by the company. The second is a written instruction from solicitors, insurers or the court. The third is a device that is genuinely the client's own (in a family matter this means either their own machine or one owned jointly). We do not hack. Live communications are not intercepted. If the client has no right to look inside a device, neither do we.
Cloud material is often preserved by exporting it rather than sending a parcel. Contact us on 0800 689 0668 and we'll work out with you what can be captured remotely and what needs to physically come to Cambridge. Drives, not the machines, reach our Cambridge location by tracked, insured post or over the counter, with custody logged from the signature.
Is the drive still bolted inside a laptop, desktop, MacBook, iMac, server or CCTV / DVR recorder? Before sending, remove the hard disk drive (HDD) or solid state drive (SSD), as we do not accept whole units. From a DVR or recorder, send just the disk. From a server or RAID, take out the disks and clearly label each disk by bay number. A network attached storage (NAS) device may be sent as its disks if they can be removed; otherwise please send the NAS itself. There is only one type of drive we are unable to accept: storage soldered onto a motherboard (e.g. Apple Silicon Macs, extremely thin laptops). In such cases, if the storage cannot be taken out it cannot be accepted. If you are unsure whether you have a removable drive or not, call us before sending anything.
↓ Print the shipping & booking-in form (PDF)
Please mark the parcel for the attention of Cambridge Data Recovery. It takes about an hour and twenty minutes to travel from Norwich along the A11, then two minutes off the A14 at Junction 32. Otherwise you can post it using a tracked service and we will receive it the following working day. We will contact you as soon as we have your drive and it is booked onto our bench.
If you're unsure of what to include in the box, please call us on 0800 689 0668 before sealing it. Or, for a first view on what we can do, you can use our free online diagnostic.
Retention windows close on their own schedule rather than yours. Please call our freephone first.