A process engineer leaves a research park spin-out, and just two quarters later a competitor is showing something your team has been working on for three years. For Norfolk's engineering, software and design businesses, along the A11, at Norwich Research Park and across the offshore wind supply chain, that moment of recognition is turned into an account that lists the events with dates: what left, the route it took, and how the competitor's material compares to your own originals.
◇ Scope first, then work. After the free diagnostic and the written scope, forensic casework is payable upfront on acceptance of the fixed price. For all other jobs, in most cases you will only be charged if we recover your data. Full pricing is set out on our data recovery cost page.
Product and engineering firms usually notice these first. Preservation comes before investigation, and both come well before any confrontation.
Trade secrets do not typically leave through a break-in. Instead they go out under a legitimate login during a normal working week, buried in the noise of a busy system. Months later it shows up as a tender lost by a thin margin or a product with familiar features. Three questions follow, and all three can be answered: what was taken, along what route, and on what days. The answers to all three are held in the systems you already own.
Starting with images of the workstations concerned and the file server, the exit is put back together from start to finish. Device records show drawing sets and repositories going out in one go. Browser and sync-client traces show files being uploaded into private storage. Print activity clusters around the protected folders. Deleted material is brought back where somebody tidied up afterwards. The copy is then searched for your part numbers, project names and any confidentiality markings you use, so that a file renamed on the way out cannot slip past on a technicality.
Once your material is in someone else's hands, parentage is the issue. Office documents, PDFs and CAD files have information inside them that survives renaming and light editing: the author, the company, the revision history, reference numbers, and when they were saved. Compared with your original files, these can show where one document came from. The rival copy has to arrive lawfully, by disclosure or under an order, and on that footing a resemblance becomes something a judge can actually weigh.
An IP claim takes its shape early. Imaging done straight away fixes the record before any clean-up, and that decides whether a springboard or search order application is based on evidence or on inference. Machines are taken out of service and captured. The report is prepared to evidential standards, with all findings set out before the appendix. Where a court has ordered a respondent's hardware to be imaged, the order is carried out exactly as written. Covert collection is no part of this service.
The bench method behind it is described at the forensic recovery hub. Sticks and cards are covered under USB device forensics, misused logins under insider threat forensics, and the numbers on the prices page.
Between them they take a familiar looking rival product out of grievance and into evidence.
Drawing libraries, repositories and databases leaving in one go.
Part numbers, project names and confidentiality banners found on the copy.
Internal records tracing a rival file back to the original it came from.
Webmail, transfer sites and private cloud uploads, all with dates.
Erased files and archives brought back into the record.
Opening, exporting and printing of the protected material.
Each instruction starts with the free diagnostic, which takes 2 working days from the day it arrives at the bench. Forensic casework is paid upfront on acceptance of the fixed quote, before work starts. The fixed price for the full investigation with report is £800 + VAT. The less expensive forensic binary image and deleted-file extraction service without report is £400 + VAT. Both figures also appear on the prices page, and no money will be taken until a written scope has been agreed. Send us the drives, not the machines.
IP work is done on your company's own systems, or on hardware that a court has ordered imaged, kept strictly to the terms of that order. There are three ways into the door and not four: kit the company itself owns; a written instruction from solicitors, insurers or the court; or a device that genuinely belongs to the client, which in a family matter means their own machine or one owned jointly. We do not hack. We do not intercept live communications. If a client does not have the right to look inside a device, then neither do we.
Much of what can be proven later is decided within the first few days. Call 0800 689 0668, leave the machines as they are, and we will decide together which drives travel, not the machines. They arrive by insured, tracked post or over the counter at our Cambridge location, with custody logged from the signature.
Is the drive still bolted inside a laptop, desktop, MacBook, iMac, server or CCTV / DVR recorder? Before sending, remove the hard disk drive (HDD) or solid state drive (SSD), as we do not accept whole units. From a DVR or recorder, send just the disk. From a server or RAID, take out the disks and clearly label each disk by bay number. A network attached storage (NAS) device may be sent as its disks if they can be removed; otherwise please send the NAS itself. There is only one type of drive we are unable to accept: storage soldered onto a motherboard (e.g. Apple Silicon Macs, extremely thin laptops). In such cases, if the storage cannot be taken out it cannot be accepted. If you are unsure whether you have a removable drive or not, call us before sending anything.
↓ Print the shipping & booking-in form (PDF)
Please mark the parcel for the attention of Cambridge Data Recovery. It takes about an hour and twenty minutes to travel from Norwich along the A11, then two minutes off the A14 at Junction 32. Otherwise you can post it using a tracked service and we will receive it the following working day. We will contact you as soon as we have your drive and it is booked onto our bench.
If you're unsure of what to include in the box, please call us on 0800 689 0668 before sealing it. Or, for a first view on what we can do, you can use our free online diagnostic.
Take the machines out of service and call our freephone; an early image gives an application its footing.