An insider who causes real damage to a business will usually not announce it. Logins carry on working past the last day at work, an export of data runs on a normal Tuesday afternoon, and an archive is created the evening before a resignation. The investigation is built from records the company already holds (endpoint, server, network) and reports what those records establish, against named accounts, sessions and hours.
◇ Scope first, then work. After the free diagnostic and the written scope, forensic casework is payable upfront on acceptance of the fixed price. For all other jobs, in most cases you will only be charged if we recover your data. Full pricing is set out on our data recovery cost page.
These are the things that can turn a vague feeling of unease into an actual written instruction.
Access will carry on after an employee has left much more often than many companies expect. Copying a user profile carries the stored credentials and the password manager over with it. Keys and tokens taken in the final week remain valid until someone revokes them. Once a colleague has seen a password across the desk, they can use it just as well from their kitchen table. This work is to establish which credentials left, and then to read the authentication logs beside the endpoint traces to list the systems reached with them, where they came from and during what hours, including everything after the leaving date, which is most often the part that settles it.
Endpoints cover only half of it. Bulk extraction is exposed through query history: the SELECT that pulled a customer table, with the time and the account it belonged to. Backups compared against snapshots date when records changed or disappeared. File-server logs show who opened which shares and where the pattern parted ways with habit. Network records and captures show steady transfers out to addresses that no business process can account for. Server material also ages faster than anything else, since logs rotate on timetables counted in weeks, so it goes first on the preservation list.
A tribunal will separate carelessness from planning, so the investigation collects what bears on that. Messages in Slack and Teams about the move or the material. Archives created in 7z or RAR during the final days; even though the archive itself has often been deleted, it is frequently possible to retrieve the list of files it held. Job boards and competitors' websites in the browsing history. Document metadata whose last-modified-by field puts a named account on a named file at a named hour. None of those decides anything alone; in sequence, they generally do.
An employee-owned phone or laptop on the office Wi-Fi sits on a legal boundary, and we stay on the lawful side of it. The data recorded by the network belongs to the company and is fair evidence: when each device connected, which identifiers it used, how much data was carried, and where it connected to. The device itself cannot be examined without its owner's permission, a protocol agreed between solicitors, or a court order. The report only relies on what the infrastructure lawfully shows and clearly states that boundary, which is what keeps it usable.
The imaging discipline behind this work is detailed at the forensic recovery hub. Routes out through a tenancy are covered at email and cloud exfiltration, endpoint capture at workstation deep imaging, and the trade secret side at the IP theft page. Costs are on the prices page.
Set against accounts and sessions, dated, and traced back to the systems' own records.
Which keys, tokens and stored passwords went, and when.
Systems they were used to reach, with hours and source addresses.
Bulk extraction from databases and file servers, with query evidence.
Steady transfers out to external addresses, from logs and captures.
Messages, archives, browsing and metadata relevant to the intent.
What the Wi-Fi records lawfully show about a personal device.
All of our instructions begin with the free diagnostic, which typically takes 2 working days from when the device reaches the bench. Forensic casework is paid upfront as soon as you have accepted a fixed quote. The full forensic investigation including a report costs £800 + VAT, payable 100% before work starts. Our less expensive forensic binary image and deleted-file extraction service (without the report) costs £400 + VAT. All forensic work is paid for upfront. For a scope involving several servers, we provide a written quote after the free diagnostic. Both prices are listed on our prices page, and no money is taken until a written scope has been agreed.
Insider work runs on systems and records owned by the company, under the instruction of HR or a solicitor. There are three footings that open the door, and there is no fourth: equipment owned by the company; a written instruction from solicitors, insurers or the court; or equipment that genuinely belongs to the client, which in family matters means their own machine or one owned jointly. We do not hack. Live communications are not intercepted. If the client has no right to look inside a device, then neither do we.
Typically, an insider case begins with a scoping call rather than a parcel. Ring 0800 689 0668, explain what is in front of you, and we will list the things to preserve this evening. Where hardware does travel, please do not send the computer; send the drives. They come via tracked, insured post or over the counter at our Cambridge location, and are signed into custody when they arrive.
Is the drive still bolted inside a laptop, desktop, MacBook, iMac, server or CCTV / DVR recorder? Before sending, remove the hard disk drive (HDD) or solid state drive (SSD), as we do not accept whole units. From a DVR or recorder, send just the disk. From a server or RAID, take out the disks and clearly label each disk by bay number. A network attached storage (NAS) device may be sent as its disks if they can be removed; otherwise please send the NAS itself. There is only one type of drive we are unable to accept: storage soldered onto a motherboard (e.g. Apple Silicon Macs, extremely thin laptops). In such cases, if the storage cannot be taken out it cannot be accepted. If you are unsure whether you have a removable drive or not, call us before sending anything.
↓ Print the shipping & booking-in form (PDF)
Please mark the parcel for the attention of Cambridge Data Recovery. It takes about an hour and twenty minutes to travel from Norwich along the A11, then two minutes off the A14 at Junction 32. Otherwise you can post it using a tracked service and we will receive it the following working day. We will contact you as soon as we have your drive and it is booked onto our bench.
If you're unsure of what to include in the box, please call us on 0800 689 0668 before sealing it. Or, for a first view on what we can do, you can use our free online diagnostic.
Save the logs before they rotate. The freephone connects you with an examiner, not a call queue.