Evidence work for Reading · solicitors, HR and loss adjusters
Instructions here begin at £800 + VAT. The price is written down before we connect any cables, and working out the scope is free. For that you get a hardware blocker in line; a sector-by-sector copy made before any file is opened; MD5 and SHA-256 hash checks at each end; a continuity log typed while the job is running; and a final report written to whichever rules govern your case (Part 35 for civil cases and Part 19 for criminal cases). We hold no UKAS schedule and no ISO/IEC 17025 accreditation, so our reports open with a statement saying so: as experts, we are required to disclose it. Most of what we receive from Reading is civil, family, employment or insurance work, and none of it falls under the Regulator’s statutory Code.
Talk it through in confidence
0800 6890668
| What you are seeing | What the examination shows | What comes back to you |
|---|---|---|
| The one laptop the case turns on | Write-blocked, imaged, then worked entirely on the copy: all documents, artefacts and the order of events as they occurred | An answer in plain English, in writing |
| A leaver, and the files that were removed with them | Each time a USB device was plugged in and how long it remained attached, uploads to webmail and cloud accounts, deletions and wiper runs, with a date on each event | HR and your solicitor will have one single timeline to refer to |
| Deleted files the case depends on | Proof that they were there, when they went, and what followed, carved out with continuity held | The files, with their dates, and the method that found them |
| A volume nobody can open | Passware aimed at the image, where the examination has been authorised and there is a real chance of getting the key | What's in the volume, or a plain statement that the encryption held |
| A case that is on its way to a court hearing | Identical bench work, written up under whichever rules apply: Part 35 for civil matters, Part 19 for criminal matters | A report for the court, in the form required |
| Footage still sitting on a CCTV recorder | Taken off the disk while holding continuity; the CCTV pages show all of this in full | Footage that will play, and the documentation to go along with it |
The first scoping call costs nothing. There will be no chargeable work on your case until you have a price in writing. The purpose of this call is to define the scope of the work. Specifically, we identify all relevant events, the accounts and machines involved and, most importantly, what the evidence needs to prove. Forensic instructions begin at £800 + VAT, and the scope decides where yours lands.
No file is ever opened first. The blocker is put into place, the image comes off behind it, and only then is anything viewed. What arrives is an exhibit, not just a container of documents, so it is sealed and set aside while the copy does the work.
An examination occurs within the image and never on the exhibit. OSForensics can index everything: artefacts a computer may leave behind, which files were opened and when, what has been deleted, and in what order. Notes are typed step by step as that goes on.
Your question is answered directly in the first paragraph, written in normal language, and how it was analysed is detailed below for those interested in testing it. The findings also include anything that helps neither side, and it stays in.
Give the other side a finding they cannot check or test, and you are giving them an argument. So it all goes in the bundle: exhibit numbers, the image each conclusion came from, dated handovers, the hashes, and the working notes typed while the job was running. The examiners on the other side will be able to re-run everything and come to the same answer.
Image it early, and image it before anybody else has a go: a machine in daily use is a completely different machine two weeks later. Windows writes to disk whenever it wants and does not ask permission; the disk space that held deleted data is given out again; event logs wrap round and start over. Copy the machine in week one and you'll know exactly what condition it was in. Copy it after a month and you'll have a machine that has kept working ever since. If you think a dispute is likely, take an image while the answer can still be found, then seal the original and store it somewhere only authorised people have access.
| Bench tools | Where it applies | Why it is here |
|---|---|---|
| X-Ways Forensics | Detailed work inside an image: usage history, artefacts, timelines, deleted files | Fast, uncluttered, and one tool known completely beats four tools known partly |
| OSForensics | Indexes the whole Windows machine, or its image, so any part of it can be searched | The broad first pass: registry hives, the lists of recently opened files, and all USB devices ever attached |
| Passware | Encrypted volumes, where authorisation has been given and the key can be reached | It opens or it does not, and the report states which. Nothing gets dressed up |
| Atola Insight Forensic | Acquisition made behind a write block, with hashing done on the same run | It logs its own acquisition, so continuity starts with the very first sector |
| ACE Lab PC-3000 & Data Extractor | Firmware-level repair, for an exhibit that is also a drive nearing the end of its life | Sometimes the disk is both the exhibit and the repair job, and both trades sit in this room together |
Why it is said first: under the criminal rules an expert must disclose anything that could reasonably be thought to detract from their credibility, and CPS guidance counts a missing accreditation as one of those things. Mentioning it at the front is not modesty. It takes away one of the simplest questions the other side had ready, and instead of debating credibility we move on to how the conclusions were reached (method), which is the ground we would rather argue on.
No one had taken anything. A poorly set up sync client had emptied the shared folder by itself (duller than the theft the client expected), and most of it was still recoverable. The finding ended the dispute without anyone being accused.
There are three stages. The first involves making a copy. In the second, the copy is examined. In the third, the findings are written up in such a way that they can withstand testing by others. Nothing is opened before the image exists, and bench notes are typed as the work progresses, closely enough that another examiner could follow the same path and arrive at the same place.
There is no rate card, because the work varies depending on the case. The initial scoping call is always free. After it, we provide a single fixed figure in writing that covers imaging, examining and reporting, before we connect a single cable. Forensic instructions begin at £800 + VAT, with no hourly clock running underneath.
No. Drives, cards, PCs, Macs and disks taken from CCTV and DVR systems are what this bench takes. Phones are not. If your phone turns out to be where the case actually lives, you will hear that during the call, along with the name of a lab that takes them.
There is no UKAS schedule and no ISO/IEC 17025, and the first page of each report says so, because experts have a duty to disclose it. In their place is a method open to examination by all parties: a hardware write block applied during acquisition, two hashes (MD5 and SHA-256) generated and then verified, each action documented as it is taken, and a report prepared under Part 35 for civil work and Part 19 for criminal.
Stop using that machine for now, because it will be a completely different machine after just two weeks. Looking is free, all charges are put in writing before any work is done, and the findings go to the party who instructed us, and to no other parties.