A departing employee and a laptop that looks suspiciously empty. A dispute that hinges on exactly when a file was created. A tribunal that wants deleted emails produced properly. Forensic work is recovery with the burden of proof attached — imaging that preserves, methods that document, and results that survive the other side’s expert.
$ ldr diagnose /dev/sda → Device: HGST 6 TB (server) → Status: NOT SPINNING — stiction → Client: confidential · York $ ldr engineer-working → Heads: freed off the platters → Motor: spun on the bench → Imaging: 5.9 TB · 99.8% $ ldr verify → ✓ archive — recovered → ✓ 6 TB — intact → ✓ server — restored
The difference is procedure at every step: original media write-blocked from first contact and never altered; imaging verified by cryptographic hash so any party can prove the copy is exact; a documented chain of custody from your hands to ours to the report; and analysis on the images — deleted-file recovery, timeline reconstruction from file-system metadata, USB and external-device traces, the artefacts that show what was accessed, copied or destroyed and roughly when. Findings arrive as a plain-language report with the technical appendix an opposing expert will look for — built to be examined, not just read.
One boundary, stated plainly: forensic work requires a lawful basis — your own devices and systems, company equipment under company policy, or matters instructed through solicitors and insurers. We work regularly alongside legal teams (engagement letters and NDAs as standard, ICO-registered handling throughout) on employment disputes, IP theft investigations, fraud matters and data-destruction claims. What our own bench doesn’t do is covert surveillance of partners, family or anyone else’s private devices — asking politely doesn’t change the law, and a lab that would bend it for you would bend it about you.
Usually a great deal: which deletion or wiping tool ran and when, which USB devices were connected in those final weeks, what left by cloud or email, any password-protected or encrypted files (opened where lawful with Passware Kit, the forensic decryption suite we run — which recovers keys and passwords where a route exists, by searching the drive and the computer’s RAM, checking escrow locations, or unlocking supported hardware-encrypted devices, and never by breaking the cipher itself), and — more often than people expect — recovery of the deleted material itself. The laptop should go straight into quarantine now: no IT reimaging, no 'quick look' logins.
They’re built to: hash-verified images, a documented chain of custody, the methodology stated openly, and reporting split into findings and a technical appendix. We can also work to directions agreed between parties' solicitors. What no honest examiner offers is a guaranteed conclusion — evidence says what it says.
No. That is covert access to someone else’s private device, and it sits outside both the law and our own terms — however strong the suspicion. Where there's a legitimate route (your own devices, joint business equipment, or matters via a solicitor), we'll gladly discuss it.