Evidence & the courts · forensic examination in Berkshire
What an exhibit holds matters no more than how it has been handled, which is why cases are lost long before anyone reaches a conclusion. The copy is taken behind a hardware write blocker before a file is opened, the continuity record is kept as the work proceeds, not written up afterwards, and the report is drafted expecting an opposing expert, or the bench, to take it apart. Independent, discreet, and candid about what the evidence will not support.
Go through it with an engineer
0800 6890668
| The symptom | What we are able to establish | What we send back |
|---|---|---|
| A laptop at the centre of a dispute | Copied behind a write blocker, then examined on the copy: artefacts, files, sequence | A written answer, plainly put |
| An ex-employee you suspect took files | USB devices attached, cloud and webmail traces, deletions, wiping software — set in sequence | Material HR and your solicitor can act on |
| Files deleted that now carry weight | Proof the files existed, when they were removed and what followed — recovered forensically | The files themselves, plus dates and method |
| A locked volume you are entitled to open | Passware is put on the encryption when a credential or key is within reach | The contents, and the route in |
| A matter heading for a courtroom | The same examination, reported in the form CPR Part 35 or CrimPR Part 19 demands | An expert report fit for the court |
| Footage held on a DVR or CCTV recorder | Extracted with the custody record intact — the CCTV pages go further | Footage that plays, with its continuity record |
Every instruction opens in confidence. You set out the incident, the devices and accounts it touches, and what the evidence has to establish; that settles the scope, and the scope settles the single written quote you receive before any examination starts. The scoping conversation is free.
Nothing is read until a copy has been taken through a hardware write blocker. The exhibit is itself the evidence, and it is the quick look before that copy which undoes cases.
Every examination runs against that image, OSForensics among the tools used: system artefacts, file activity, deletions and the order events occurred in. Notes are made as the work proceeds, not assembled afterwards.
The question you actually asked is answered in plain English, and the technical working sits behind it for whoever wants to check. A finding that suits nobody is still the finding, and it stands.
The point of handing over the lot — report, exhibits, source files, hash values, continuity log and the notes taken at the bench — is that a tribunal, or an expert instructed against you, can repeat the work and reach the same result.
Why preserve privately, and early: HMICFRS put more than 25,000 devices in police digital-forensics backlogs in December 2022, and the Westminster Commission on Forensic Science, in its June 2025 report, traced the collapse of over 30,000 prosecutions across four years in England and Wales to evidence that was mislaid, missing or not of usable quality. Material secured properly on the first day never joins a queue at all.
| Tool | What it's for | What it brings |
|---|---|---|
| X-Ways Forensics | Detailed work inside disk images — artefacts, activity records, deleted content, timelines | Lean and fast, and suited to a small laboratory that prefers to know one tool thoroughly |
| OSForensics | Indexing, searching and sifting Windows systems and images made from them | A broad opening sweep: registry keys, recently-used traces, the record of USB devices once attached |
| Passware | Encrypted volumes, opened where there is lawful authority and a recoverable password or key | Candour about encryption: it yields or it does not, and the report records which of the two |
| Atola Insight Forensic | Acquisition under hardware write protection, with hashing performed in the same pass | The acquisition log writes itself as the copy proceeds, so continuity starts at minute one |
| ACE Lab PC-3000 & Data Extractor | Firmware-level repair where the exhibit is also a failing disk | A disk can be an exhibit and a patient at the same time; both trades are on hand here |
Why set it out at all: since 2019 the criminal procedure rules have obliged an expert to disclose whatever might bear on their credibility, an absent accreditation among it. Publishing it here is not modesty; it is what denies the other side the chance to make our silence their strongest point.
The client was certain the files had been taken deliberately. The evidence pointed somewhere duller: a sync client set up wrongly had cleared them from the shared drive, and the greater part was recoverable. That answer closed the dispute faster than an accusation could have.
The capture, analysis and reporting of electronic material in a form that survives challenge. A copy is taken before anything on the device is read, each action is noted as it happens, and the write-up lets a second examiner retrace the route we took.
Pricing follows the case rather than a tariff. The scoping conversation costs nothing; what follows is one written figure covering acquisition, examination and reporting, agreed before work begins. Nothing is billed by the hour.
No — handsets and tablets sit outside what this laboratory handles, which is drives, storage media, computers and CCTV or DVR recorders. Where a phone proves central, we will tell you plainly and name a lab that examines them.
No. This is an independent laboratory with neither UKAS accreditation nor ISO certification, and the reports say so at the front, as the rules require. What stands in their place is a method open to inspection: acquisition behind a write blocker, hash values verified, every step on the record, and a report framed by CPR 35 or CrimPR 19.
Loop recording is already writing over what you need, and the deadline will not move. Open a case today: the diagnosis costs nothing and stays confidential.