Evidence work in Reading · solicitors, HR and loss adjusters
Instructions here begin at £800 + VAT. The figure is fixed in writing before a cable is connected, and working out the scope costs nothing. For that you get a hardware blocker in line; a sector-by-sector image made before any file is opened; MD5 and SHA-256 verified at each end; a continuity log typed while the job is running; and a report answering to whichever rules apply — Part 35 in a civil claim, Part 19 in a criminal one. No UKAS schedule is held here and no ISO/IEC 17025 accreditation, which is why the first page of each report starts by saying so: an expert has to disclose it. Most of what arrives from Reading is civil, family, employment or insurance work, and the Regulator's statutory Code reaches none of that.
Talk it through in confidence
0800 6890668
| What you are seeing | What the examination shows | What comes back to you |
|---|---|---|
| The one laptop the case turns on | Write-blocked, imaged, then worked entirely on the copy — documents, artefacts, and the order things happened in | An answer in plain English, in writing |
| A leaver, and files that left with them | Every USB device connected and for how long, uploads to webmail and cloud accounts, deletions and wiper runs, each with a date on it | One timeline HR and your solicitor can both use |
| Deleted files the case depends on | Proof that they were there, the moment they went, and what followed — carved out with continuity held | The files, dated, and the method that found them |
| A volume nobody can open | Passware aimed at the image, where the examination is authorised and a key can actually be got at | The contents, or a plain statement that the encryption held |
| A case on its way to a hearing | Identical bench work, then written up under whichever rules apply — Part 35 for a civil claim, Part 19 for a criminal one | A report in the form the court expects |
| Footage still sitting on a CCTV recorder | Taken off the disk with continuity held — the CCTV pages set this out in full | Footage that plays, and the paperwork behind it |
The scoping call costs nothing, and nothing chargeable starts until you have a price in writing. What the call fixes is the ground it covers: the events, the machines and accounts in play, and precisely what the evidence must establish. Forensic instructions start at £800 + VAT, and the scope decides where yours lands.
No file is opened first. The blocker goes in line, the image comes off behind it, and looking begins after that. What arrives is an exhibit, not simply a container of documents, so it is sealed and set aside while the copy carries the work.
Examination happens inside the image and never on the exhibit. OSForensics indexes all of it: artefacts a system leaves behind, which documents got opened, at what time, what was removed, and in what sequence. Notes are typed step by step as that goes on.
Your question is answered in the first paragraph, in ordinary English, with the workings set out underneath for anyone who wants to test them. A finding that helps neither side goes in as well, and stays in.
Hand the other side a finding they cannot test and you have handed them an argument. So it all goes in the bundle: exhibit numbers, the image each conclusion came off, dated handovers, the hashes, and the working notes typed as the job ran. The examiner on the other side can run the whole thing again and reach the same answer.
Image it early, and image it before anybody else has a go: a machine in daily use is a different machine a fortnight on. Windows writes to disk without being asked, the space that held deleted material is handed back out, event logs wrap round and begin again. Copy it in week one and you have the state things were in. Copy it after a month and you have a machine that has been working ever since. Where a dispute looks likely, take the image while the answer can still be found, then seal the original and keep it access-controlled.
| Bench tools | Where it applies | Why it is here |
|---|---|---|
| X-Ways Forensics | Detailed work inside an image: usage history, artefacts, timelines, deleted material | Fast, uncluttered, and one tool known thoroughly beats four known partly |
| OSForensics | Indexes a whole Windows machine, or its image, so any part of it can be searched | The wide first pass — registry hives, the lists of recently opened files, and every USB device ever attached |
| Passware | Encrypted volumes, where the examination is authorised and a key can be reached | It opens or it does not, and the report says which. Nothing gets dressed up |
| Atola Insight Forensic | Acquisition made behind a write block, with the hashing done on the same run | It logs its own acquisition, so continuity begins at the very first sector |
| ACE Lab PC-3000 & Data Extractor | Firmware-level repair, for an exhibit that is also a drive on its way out | Now and then the disk is the exhibit and the repair job at the same time, and both trades sit in this room |
Why it is said first: under the criminal rules an expert must disclose whatever might reasonably be thought to detract from their credibility, and CPS guidance puts a missing accreditation in that category. Saying it at the front is not modesty. It removes the cheapest question the other side had ready, and moves the argument onto method — which is the ground we would rather be arguing on.
Nobody had taken anything. A badly configured sync client had emptied the shared folder by itself — duller than the theft the client arrived expecting — and most of what went was still recoverable. The finding ended the dispute with no one accused.
Three stages. A copy is made; the copy is examined; the findings are written so they hold up when somebody sets about testing them. Nothing is opened before the image exists, and the bench notes are typed as the job proceeds — closely enough that another examiner could take the same route and land in the same place.
There is no rate card, because no two instructions are alike. Scoping is free. After it comes a single figure in writing — imaging, examination and report together — settled before a cable is connected. Forensic instructions begin at £800 + VAT, with no hourly clock running underneath.
No. Drives, cards, PCs, Macs and the disks pulled out of CCTV and DVR units are what this bench takes; handsets are not. Where the phone turns out to be the place a case actually lives, you hear that during the call, together with the name of a laboratory that takes them.
No UKAS schedule, no ISO/IEC 17025, and the first page of each report opens with that fact, because an expert is obliged to disclose it. Standing in its place is a method open to inspection: a hardware write block on acquisition, MD5 alongside SHA-256 computed and then verified, every step written down as it is taken, and a report answering to Part 35 in civil work, Part 19 in criminal.
A machine in daily use is a different machine a fortnight on, so the first thing to do is stop using it. Looking is free, the fee is put in writing before the work begins, and what we find goes to the party who instructed us and to no one else.