A process engineer leaves a research park spin-out, and two quarters later a competitor is demonstrating something your team spent three years on. For Norfolk's engineering, software and design businesses — along the A11, at Norwich Research Park, and across the offshore wind supply chain — that moment of recognition is turned into an itemised account with dates on it: what left, the route it took, and how the rival's material stands beside your originals.
◇ Scope first, then work. The free diagnostic comes at the start and the written scope follows it; forensic fees are paid in full before an examination begins. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Full pricing is on the data recovery cost page.
Product and engineering firms usually notice these before anyone else. Preservation comes before investigation, and both come well before any confrontation.
Trade secrets seldom leave through a break-in. They go out under a working login, in the middle of an ordinary week, buried in the noise of a busy system, and the loss only shows itself months later in a tender lost by a hair or a product with familiar lines. Three questions follow, and all three can be answered: what moved, along what channel, on what days. The systems you already own are holding the answers.
Starting from images of the workstations concerned and the file server, the exit is put back together end to end. Device records show drawing sets and repositories going out in one movement. Browser and sync-client traces show uploads into private storage. Print activity clusters around protected folders. Deleted material comes back where somebody tidied afterwards. That copy is afterwards swept for your part numbers, for project names, and for whatever confidentiality markings you use, so that a file renamed on the way out does not slip past on a technicality.
Once your material is in another set of hands, parentage becomes the argument. Office documents, PDFs and CAD files carry internal records that survive renaming and light editing: who authored them, which company, the revision history, reference numbers, the times they were saved. Put against your originals, those can show one document descended from another. The rival copy has to arrive lawfully — by disclosure, or under an order — and on that footing a resemblance becomes something a judge can actually weigh.
An IP claim takes its shape early. Imaging done at once fixes the record ahead of any tidying, and that decides whether a springboard or search-order application rests on evidence or on inference. Machines are withdrawn from service and captured. The report is prepared to evidential standards, findings set out ahead of the appendix. Where a court has ordered a respondent's hardware imaged, the order is carried out precisely as written. Covert collection is no part of this service.
The bench method behind it is described at the forensic recovery hub. Sticks and cards are dealt with under USB device forensics, misused logins under insider threat forensics, and the numbers on the prices page.
Between them they take a familiar-looking rival product out of grievance and into evidence.
Drawing libraries, repositories and databases leaving in one go.
Part numbers, project names and confidentiality banners found on the copy.
Internal records running a rival file back to the original it came from.
Webmail, transfer sites and private cloud uploads, all with dates.
Erased files and archives brought back into the record.
Opening, exporting and printing of the protected material.
Each instruction opens with the free diagnostic, which takes 2 working days from the day a device reaches the bench. Forensic casework itself falls outside no fix, no fee. The full forensic investigation with report is £800 + VAT, payable 100% upfront. The less expensive Forensic binary image and deleted-file extraction service, without the report, is £400 + VAT. Any Forensic work required will be payable upfront. Both figures also appear on the prices page, and no money is taken until a written scope has been agreed.
IP work runs on your company's own systems, or on hardware a court has ordered imaged, kept strictly to the terms of that order. Three footings open the door and there is no fourth: kit the company itself owns; a written instruction from solicitors, an insurer or the court; or a device that is genuinely the client's, which in a family matter means their own machine or one owned jointly. We do not hack. Live communications are not intercepted. Where a client has no right to look inside a device, neither have we.
What can be proved later is largely decided in the opening days. Call 0800 689 0668, leave the machines as they stand, and we will agree between us which hardware travels. It comes by tracked, insured post or over the counter at our Cambridge location, with custody logged from the signature.
Is the drive still bolted inside a laptop, desktop, MacBook, iMac, server or CCTV / DVR recorder? The hard drive or SSD needs to come out first, and only the bare drive travels — taking drives out of machines is not something we do here. Storage soldered to a motherboard (Apple Silicon Macs, one or two very thin laptops) is the single thing beyond us: if it will not come out, it cannot come in.
↓ Print the shipping & booking-in form (PDF)
Mark the parcel for the attention of Cambridge Data Recovery. From Norwich it is about an hour and twenty down the A11, then two minutes off the A14 at Junction 32 — or next working day by tracked post. You hear from us as soon as it is booked onto the bench.
Unsure what to put in the box? Ring 0800 689 0668 before you seal it, or run the free online diagnostic.
Withdraw the machines and ring the freephone — an early image gives an application its footing.