Employers across Berkshire · evidence off work devices
Preservation comes first, and it is the cheap part: image the machine before IT hands it to the next starter. Even a laptop returned in good order repays a look. Windows keeps records of its own, so do the sync clients, and neither is touched by a tidy-up. A rule quietly copying inbound mail out to a personal address. A memory stick first seen late on a Friday evening. A Downloads folder emptied the morning of an exit meeting. So the machine goes out of service, gets imaged to an evidential standard, and what it holds is written up for HR and for the solicitor. From £800 + VAT, fixed in writing before anything starts.
Talk it through in confidence
0800 6890668
| What the answer rests on | What you must do | How we apply it |
|---|---|---|
| The Data Protection Act 2018, with UK GDPR | The device being yours is not a lawful basis. Choose one — legitimate interests, usually — put the balancing test in writing, and do it before the work starts | We scope the examination to the allegation you gave us, and no wider than that |
| The ICO's guidance on monitoring workers | Transparency is the starting point, and a DPIA is expected where risk is high. The ICO has this guidance under review following the Data (Use and Access) Act 2025 | Your policies are read before the disk is, and where a DPIA is needed we say so |
| Examining it in secret | Defensible only in exceptional cases — suspected crime, or gross misconduct — with senior management putting its name to it | Nothing imaged and nothing opened until that authority exists in writing |
| What Acas expects | A disciplinary outcome has to rest on an investigation that was proportionate and fair | Findings go in as found, whoever they end up assisting |
| Weight at a tribunal | Evidence is worth no more than the method that produced it | A continuity log that strengthens your case rather than opening a door for the other side |
The scoping call costs nothing, and nothing chargeable starts until you have a price in writing. What the call fixes is the ground it covers: the events, the machines and accounts in play, and precisely what the evidence must establish. Forensic instructions start at £800 + VAT, and the scope decides where yours lands.
Most of what disappears goes inside a fortnight, and almost none of it on purpose. The laptop is rebuilt for the next arrival. The drive ends up in a spares cupboard. Somebody's manager takes a quiet look round it. An image made early, behind a blocker, gets there before all three.
The image carries the work from then on, and the original is left alone. Removable drives are listed one by one, with the time each went in and how long it was there. So is anything pushed to a personal cloud account, anything attached to webmail, anything deleted, and any sign of a wiping tool having run. The lot goes on a single timeline.
An HR panel, a tribunal or a solicitor will be reading this, not an engineer, and the report is written for them. What we did is measured against the ICO on monitoring, and against the proportionate, fair investigation Acas expects. Should the police become involved later, the document stands as it is.
Hand the other side a finding they cannot test and you have handed them an argument. So it all goes in the bundle: exhibit numbers, the image each conclusion came off, dated handovers, the hashes, and the working notes typed as the job ran. The examiner on the other side can run the whole thing again and reach the same answer.
The one figure we will stand behind: in 2013 Symantec, working with the Ponemon Institute, found that around half of those who had recently changed jobs admitted holding on to confidential material from the employer they had left. Nearly everything since has come from companies with something to sell, and the numbers contradict one another. What we see is duller. The employer who rings up able to say what they think went, rather than generally uneasy, is usually borne out by the artefacts.
Because the laptop was company property, authorising the examination took no argument at all. What it showed ran in a clear order: a folder assembled, then a personal cloud account opened in a browser, then the upload itself. Twenty days after the last of that came the resignation letter. The Didcot employer had begun with little more than a competitor's pitch deck. The matter closed on undertakings.
Ownership on its own settles very little. What is needed is a lawful basis, plus staff who were told in advance that work machines can be examined — that is the job an acceptable-use policy does. Where nothing was said beforehand, the point gets argued afterwards. Going through a device without telling the user is kept for suspected crime or gross misconduct, and it takes authority from senior management.
Rarely, and never as routine. Exceptional circumstances are what the ICO's guidance on monitoring workers reserves covert work for: a suspicion of crime, or of gross misconduct. Even in those cases it looks for authorisation from senior management, for a DPIA, for a scope drawn tightly, and for the reasoning written down. That guidance is under review following the Data (Use and Access) Act 2025.
Preservation, before anything else at all. Turn the machine off, put it into access-controlled storage, and leave the mailbox and the cloud accounts running instead of closing them. Not a folder gets opened until a forensic image exists — even a well-meant look through moves the date stamps that would have shown the files going.
How you got there weighs as much as what you found. The moment the road to a damaging finding can be pulled apart, the finding loses its force. For a screenshot to be worth anything, a lawful basis has to have stood behind it, the search has to have kept inside the suspicion that set it off, and each stage of the handling has to be on a log.
Every day the laptop stays in circulation, more of the record goes: one look through it moves the date stamps, and a fresh build for the next starter takes the rest. Shut it down, keep IT off it, and get it imaged before anyone goes through the folders or the mailbox. The first look costs nothing, a fixed figure follows in writing, and nothing you tell us goes anywhere else.