Evidence work in Hull · for solicitors, HR and insurers
In Hull as anywhere, the damage is usually done in the first hour, by someone trying to help. A machine goes on for a look, files get opened, and dates move that cannot be put back. So it goes behind a hardware write blocker first, and the image comes off before a single file is opened; the continuity log is written at the bench as it happens, not reconstructed a week later; and the report is built expecting another expert to pull at it. Independent, quiet about who is asking, and clear about the point where the evidence stops saying anything.
Ring us, in confidence
0800 6890668
| What you see | What the material shows | What we hand over |
|---|---|---|
| The laptop at the centre of it all | Blocked, imaged, then read on the copy — artefacts, documents, and the order events happened in | A written answer in plain English |
| Someone who left, and files went with them | USB devices plugged in, uploads to webmail or cloud storage, deletions and wipes, each with a date | Something HR and your solicitor can both use |
| Files deleted, and the case needs them back | Evidence they existed, when they went and what followed — lifted with continuity kept | The recovered files, dated, and how they were got |
| An encrypted volume, and the authority to open it | Passware goes at it, once you have shown the authority and a key is in reach | What was inside, and how the lock was opened |
| A matter that is going to a hearing | The same bench work, then written to whichever rules apply — CPR Part 35, or CrimPR Part 19 | A report in the form the rules require |
| Video that is trapped on a CCTV recorder | Taken off the disk with continuity kept — the CCTV pages go into the detail | Playable footage, and the paperwork behind it |
It begins with a conversation in confidence, and there is no charge for it. Three answers shape the rest: what happened, how far it reaches — the machines, the accounts — and what the evidence has to prove. Between them they fix the scope. The scope fixes the one written price, and you have that before any device is touched.
Nothing is read first. The blocker goes on, the image is taken, and only after that does anyone look. The device is evidence in itself, not a box with files in it, so the copy is what gets worked on and the original goes back in the bag.
Everything after that happens on the image. OSForensics is one of the tools: which artefacts the system left, what was opened and at what time, what was removed, and the order of it. Notes are typed while the work happens, not assembled from memory afterwards.
The answer to your question is at the top, in plain words, with the technical detail under it for anyone minded to check. A finding that suits neither side still goes in, and it stays in.
A report nobody can test is worth little. So the bundle carries the working with it: every exhibit, the images it was read from, a log of each handover, the hash of everything, and what was written down at the time. The other side's expert can repeat it and land where we did.
Why secure it early, and secure it yourself: a machine left in use is not the same machine a fortnight later. Windows writes as it runs, deleted material gets reused, and logs roll over. An image taken on day one records how things actually were; one taken after a month of use records something else. If a dispute looks likely, take the copy while the answer is still on the disk, and put the original away.
| The gear | What we use it for | Why we have it |
|---|---|---|
| X-Ways Forensics | Detailed work on disk images: artefacts, usage history, deleted material, timelines | Fast and free of clutter, and a small bench is better off knowing one tool properly |
| OSForensics | Indexes a whole Windows machine, or an image of it, so every file can be searched | The wide first pass: registry hives, recent-file lists, every USB device ever plugged in |
| Passware | Encrypted volumes, where opening them is lawful and a key can be got at | Either it opens or it will not. The report records which, and nothing is dressed up |
| Atola Insight Forensic | Acquisition behind a write block, hashing on the same pass | It logs the acquisition itself, so continuity starts at the first sector |
| ACE Lab PC-3000 & Data Extractor | Firmware-level repair, for when the exhibit is also a failing drive | A drive can be the evidence and the repair job at once — both trades happen in this room |
Why say it out loud: the criminal rules oblige an expert to disclose anything that might detract from their credibility, and a missing accreditation counts. Saying it first is not modesty. It removes the easiest question the other side would otherwise ask.
Theft was what the client expected us to find. The answer was duller. Someone had set a sync client up wrongly, and it had emptied the shared folder on its own. Most of the material was still there to recover. The finding ended the dispute, and no accusation was needed.
Three steps. The material is copied, the copy is examined, and what it shows is set down so it survives being picked apart. Nothing is read before the copy exists. Notes go down at the bench while the work runs, with enough detail that another examiner could cover the same ground and reach the same answer.
Every instruction is a different shape, so nothing can be read off a list. Scoping the job costs nothing. After that you get one figure in writing — imaging, examination and the report together — settled before a device is touched. It starts at £800 + VAT. Nobody here runs a meter.
No. The bench here handles disks, storage media, PCs, Macs and CCTV or DVR recorders, and a handset does not belong on that list. If the phone turns out to be where the case really sits, we say so on the call and point you to a lab that does handset work.
No — no UKAS accreditation and no ISO certificate. It is stated on page one of every report, because the rules require it to be disclosed. What stands in its place is a method anyone can inspect: a hardware write block on acquisition, MD5 and SHA-256 recorded and checked, each step noted as it happens, and a report laid out to CPR 35, or to CrimPR 19 in a criminal matter.
The clip you want is being written over while you read this, and the deadline has not shifted. Log a job. The first look costs nothing, and what you tell us stays private.