Evidence & the courts · forensic examination in Berkshire
The integrity of digital information can be compromised by the way it has been handled, and that matters as much as what it holds. That is why cases are lost well before the trial starts. All our examinations start with creating a forensic image of every device using hardware write blockers (i.e., the data is copied directly onto another device without writing anything back to the original). We create a continuity log as we examine each item (which is documented live) and do not wait until the end of the examination to document everything. We draft our reports with the understanding that they will likely be reviewed and possibly disputed by an opposing expert or the judge. Furthermore, we always maintain an independent, unbiased and discreet position and are honest regarding what the evidence cannot show us.
Go through it with an engineer
0800 6890668
| The symptom | What we are able to establish | What we send back |
|---|---|---|
| A laptop at issue in a dispute | Imaged behind a hardware write blocker, then examined on the copy: artefacts, files, sequence | Plainly written answers |
| Former employee suspected of taking data | Cloud & webmail traces, deletions, attached USBs, wiping software: all in order | Something material you're able to use with HR or your lawyer |
| Deleted files that now have value | When they were deleted and what happened next: forensic recovery of evidence of their existence | File contents, dates and method |
| An encrypted (locked) volume which you may unlock | Passware will be applied to decrypt an encrypted volume when a credential or key is within reach | What was inside and how we got in |
| Heading for the courtroom | Same examination, with a CPR Part 35 or CrimPR Part 19 compliant report | Expert report suitable for submission to court |
| Recording stored on a DVR or CCTV recording device | Extracted with the custody record remaining unaltered; the CCTV pages go into more detail | Video clips that play back, along with their continuity record |
All instructions commence in confidence. First outline the incident, the devices and accounts involved in the incident and what the evidence needs to prove; this establishes the scope, and once established, it also sets the single written quote you will be provided prior to any examination commencing. The scoping discussion is free.
Nothing is reviewed until a copy of the original evidence has been duplicated using a hardware write blocker. The exhibit is considered to be the actual evidence, and it is a quick look at it before that duplicate copy is made that typically ruins cases.
Each examination is conducted against a previously created image of that exhibit, with OSForensics among the tools used: system artefacts, file activity, deletions, event order etc. Documentation regarding the examination process is completed while conducting the examination (not compiled after the fact).
The question you have actually asked is answered in plain language, and if anyone wishes to verify our technical work, they may do so. If no one's position is supported by our findings, they remain our findings. And they stand.
When all aspects of the case are handed over to another entity (report, exhibits, source files, hash values, continuity log and bench notes), a tribunal, or another expert who has been instructed against you, may replicate the work and obtain the same result(s).
Why preserve privately and early? In December 2022 HMICFRS reported over 25,000 devices in police digital-forensics backlogs. The Westminster Commission on Forensic Science in its report published in June 2025 identified the collapse of prosecution of over 30,000 cases across four years in England and Wales as a result of evidence lost, missing or not of usable quality. Material secured properly from the first day never enters a queue.
| Tool | What it's for | What it brings |
|---|---|---|
| X-Ways Forensics | Detailed work inside disk images, including artefacts, activity records, deleted content & timelines | Fast, efficient & suited to a small laboratory where they prefer to understand one tool thoroughly |
| OSForensics | Indexing, searching and sifting within Windows systems, including forensic image files created from them | The first wide-sweep search through all areas, such as recently used trace records and registry key searches to identify any device connections (USB), etc. |
| Passware | Encrypted drives: those that can be opened using legal means and whose passwords/keys are recoverable | There is no sugar coating when it comes to encryption: either we crack the code or we do not, and the report will record which of the two it was |
| Atola Insight Forensic | Hardware write protection during the acquisition process along with hash values generated simultaneously | The log file is written automatically throughout the acquisition process, therefore continuity begins from minute one |
| ACE Lab PC-3000 & Data Extractor | Firmware-level repair on exhibits which are also failing disks | Although a hard drive can serve as an evidence exhibit, it can also act as a patient at the same time; we offer services as both investigators and mechanics |
So why publish? Since 2019, the criminal procedure rules have made it mandatory for experts to declare anything they believe may affect their credibility, including a lack of accreditation. Declaring it here does not demonstrate humility; it gives the opposing party no opportunity to make our silence on it their strongest argument.
The client was certain that someone had intentionally removed these files. Our investigation found that the evidence showed something less sinister: an incorrectly configured sync client had deleted these files from the shared drive and most were recoverable. This answer resolved the dispute faster than an accusation could have.
Collecting, analysing and reporting on electronic materials from a source in a form that survives a challenge. A copy is made prior to reading any data, and there are notes kept as to what actions were performed at the time. Finally, the report allows for a secondary reviewer to follow our same path of investigation.
Billing is done based upon the scope of the project rather than a pre-determined fee schedule. Our initial scoping conversation is free. After that, there is one written total cost for collecting, analysing and reporting on the data, agreed to prior to beginning. We bill per job, not per hour.
No. Handheld devices and tablet computers fall outside of what we handle here in this laboratory. Drives, storage media, computers and CCTV/DVR recorders make up what we can handle. If a phone was significant enough, we would inform you about that immediately and give you the name of a lab that specialises in reviewing those items.
No. The laboratory is independent and has no UKAS accreditation nor ISO certification, and the reports say so at the front, as the rules require. However, there is a method available for inspection: data acquired via a write blocker, each hash value verified, and every step in acquiring the data and obtaining the results contained within the written record, in a report framed by CPR 35/CrimPR 19.
Recording in a loop is already overwriting your needed evidence, and the deadline will not move. There is no cost associated with opening a case today: diagnoses are free and remain completely confidential.