Employers across Berkshire · evidence off work devices
Preservation comes first, and it is the most economical part: image the machine before IT hands it to the next starter. Even a laptop returned in good order will repay a look. Windows keeps records of its own, and so do many sync clients, and neither is affected by a tidy-up. A quiet rule copying all incoming email out to a personal address. A memory stick spotted for the first time late on a Friday evening. A Downloads folder emptied the morning of an exit meeting. So the computer is taken out of service, imaged to an evidential standard, and what it holds is documented for both HR and the solicitor. From £800 + VAT, agreed in writing before anything starts.
Talk it through in confidence
0800 6890668
| What the answer rests on | What you must do | How we apply it |
|---|---|---|
| The Data Protection Act 2018, with UK GDPR | The fact that the device belongs to you does not make a lawful basis. Choose one (usually legitimate interests), write down the balancing test, and do it before the work starts | The scope of our examination will be limited to the allegation you gave us and will not go wider |
| The ICO's guidance on monitoring workers | Transparency is always the starting point, and a DPIA is expected where risk is high. The ICO is currently reviewing this guidance following the Data (Use and Access) Act 2025 | Your policies are read before the disk is accessed, and if a DPIA is needed we will tell you |
| Examining it in secret | Defensible only in exceptional circumstances (suspected crime, or gross misconduct), with senior management signing off on it | No images will be taken and nothing will be opened until that authority is received in writing |
| What Acas expects | A disciplinary outcome must rest on an investigation that was proportionate and fair | All findings are documented as found, regardless of who they end up assisting |
| Weight at a tribunal | Evidence is worth no more than the method that produced it | A continuity log that is beneficial to your case and doesn't open a door for the other side |
The first scoping call costs nothing. There will be no chargeable work on your case until you have a price in writing. The purpose of this call is to define the scope of the work. Specifically, we identify all relevant events, the accounts and machines involved and, most importantly, what the evidence needs to prove. Forensic instructions begin at £800 + VAT, and the scope decides where yours lands.
Almost everything that disappears does so within a fortnight, and nearly none of it on purpose. The laptop is rebuilt for the next person into the job. The drive ends up in a spares cupboard. Somebody's manager takes a quiet look round it. An image made early, behind a blocker, gets there before all three.
From then on, the work is done on the image, while the original device is left alone. Each removable drive is logged individually, with when it was inserted and for how long. So is anything moved to a personal cloud account, any attachment sent through webmail, any deletion, and any evidence that a wiping tool has been run. All of these are placed on a single timeline.
An HR panel, a tribunal or a solicitor will read this, not an engineer, and it is written for them. We measure what we did against the ICO's guidance on monitoring, and against the proportionate, fair investigation Acas expects. If the police become involved later, the document can stand as it is.
Give the other side a finding they cannot check or test, and you are giving them an argument. So it all goes in the bundle: exhibit numbers, the image each conclusion came from, dated handovers, the hashes, and the working notes typed while the job was running. The examiners on the other side will be able to re-run everything and come to the same answer.
The one figure we will stand behind: in 2013, Symantec worked with the Ponemon Institute and found that around half of those who had recently changed jobs admitted holding on to confidential material from their previous employer. Since then, nearly every figure has come from companies with something to sell, and the numbers contradict one another. What we see is duller. An employer who rings able to say what they think went, rather than being generally uneasy, is usually borne out by the artefacts.
Because the laptop was company property, there was no argument about authorising the examination. What it showed followed a clear order: a folder assembled, then a personal cloud account opened in a web browser, then the upload itself. Twenty days later came the resignation letter. The Didcot employer had begun with little more than a competitor's pitch deck. The matter closed on undertakings.
Ownership alone settles very little. A lawful basis is required, along with staff being told in advance that work computers may be examined; that is one purpose of an acceptable-use policy. If no such notice was given, the point will be argued after the fact. Going through a device without telling the user is reserved for suspected crime or gross misconduct, and it takes authority from senior management.
Rarely, and certainly not as standard practice. Exceptional circumstances are where the ICO's guidance on monitoring workers allows covert work: suspected crime, or gross misconduct. Even then it requires authorisation from senior management, a DPIA, a narrow scope and documented reasoning. That guidance is currently under review following the Data (Use and Access) Act 2025.
Preservation is the number one priority, before anything else at all. Turn the computer off, store it in access-controlled storage, and let the mailbox and the cloud accounts continue to run instead of closing them. No folder gets opened until a forensic image exists: even a well-meant look through moves the date stamps that would have shown the files going.
The path you took weighs just as heavily as what you found. If the route to a damaging finding can be pulled apart, the finding loses its force. For a screenshot to be worth anything, a lawful basis had to exist behind it, the search had to stay within the suspicion that set it off, and each stage of the handling had to be logged.
Each day the laptop remains in circulation, more of the record disappears: one look through it moves the date stamps, and a new build for the next starter takes the rest. Shut it down, keep IT off it, and get it imaged before anyone opens the folders or the mailbox. The first look costs nothing, a fixed figure follows in writing, and nothing you tell us will go any further.