Evidence work · forensic examinations across Buckinghamshire
Evidence is lost in the first hour, not the last. How the material is handled weighs as much as what it contains. So the exhibit is copied behind a write blocker before a single file is opened, the log is written while the work happens, and the report is built to be pulled apart — by the other side's expert, or by the bench. Independent, discreet, and clear-eyed about the limits of what we can claim.
Speak to an engineer in confidence
0800 6890668
| The problem | What the analysis turns up | What you get back |
|---|---|---|
| A single laptop that a dispute turns on | Imaged behind a write blocker, then the copy is worked: artefacts, files, timeline | A written answer, no jargon |
| A leaver you think took files with them | Stick connections, cloud and webmail residue, deletions, wiping tools — set out in order | Something HR and your solicitor can use |
| Files someone deleted that now matter | Evidence they were there, when they went, and what became of them — recovered forensically | The data itself, with dates and mechanism |
| An encrypted volume you have the right to open | Passware works the encryption where a password or key can be recovered | The contents, plus how we got in |
| A case that will end up in court | The identical examination, written up to what CPR Part 35 or CrimPR Part 19 requires | An expert report the court will accept |
| Video sitting on a CCTV recorder or DVR | Pulled off with custody unbroken — there's more on the CCTV pages | Video that plays, and the custody log behind it |
Work opens with a confidential briefing. You set out what has happened, which devices and accounts are involved, and what the evidence needs to prove. That fixes the scope, and the scope fixes one written quote, agreed before any examination starts. The scoping itself costs nothing.
Nothing gets read until it has been copied through a hardware write blocker. The exhibit itself is the evidence; a quick look round it is what kills cases.
All examination runs against the image — OSForensics and the rest: system artefacts, file activity, what was deleted, when things happened. Notes are written while the work is done, never reconstructed later.
You get an answer to the question you actually put, in ordinary English, with the technical working set out behind it. An unwelcome result is still the result, and it goes in unchanged.
Everything comes to you: the report, the exhibits, the underlying files, the hash values, the continuity log and our bench notes. Another expert — or a tribunal — can then retrace every step of the work for themselves.
Why it pays to preserve privately, and fast: HMICFRS counted over 25,000 devices waiting in police digital-forensics queues in December 2022; BBC and University of Leicester analysis of Crown Prosecution Service data, reported in June 2025, found more than 30,000 prosecutions in England and Wales collapsed between October 2020 and September 2024 where evidence was lost, missing or damaged. Data secured properly on day one never joins any queue.
| Kit | What it does | What it gives us |
|---|---|---|
| X-Ways Forensics | Close examination of disk images — artefacts, records of activity, deleted content and timelines | Spare, quick, and right for a small lab that would rather know one tool properly |
| OSForensics | Trawling, indexing and searching Windows machines, and any image taken from one | Wide first-pass discovery: registry entries, recent-use traces, the history of attached USB devices |
| Passware | Opening locked volumes, where the authority is lawful and a credential is within reach | Honest about encryption: either it opens or it doesn't, and the report says which |
| Atola Insight Forensic | Imaging with write protection in hardware and hashing done during the same run | Its acquisition log builds itself while the copy is made — continuity from the first minute |
| ACE Lab PC-3000 & Data Extractor | Firmware-level repair when the exhibit happens to be a dying drive | A drive can be evidence and half-dead at once — here it gets both trades in one go |
Why spell all that out: criminal procedure has required, since 2019, that anything touching an expert's credibility be disclosed — a missing accreditation among it. Printing it here isn't humility. It's what stops the other side turning our silence into their best point.
A client arrived certain that files had been taken. What we found was far more mundane: a badly configured sync had wiped them off the shared drive, and most came back. The plain answer settled the dispute quicker than any accusation would have.
Taking, examining and reporting electronic evidence so it holds up under challenge. The device is imaged before anyone looks at it, each step is recorded, and the report is written so a second examiner can follow the same path.
Each case is costed on its own particulars. The scoping call is free; after it comes a single written quote covering imaging, analysis and reporting, agreed before any work starts. No hourly billing.
No. Computers, drives, storage media and CCTV recorders are what we take on; handsets and tablets are not. Where a phone turns out to be central to the case, we say so and put you in touch with a specialist.
We are an independent lab: no UKAS accreditation, no ISO certification, and we say so openly — the reports state it too, as the rules require. What we offer instead is a method open to inspection: imaging behind a write blocker, hashes checked, every step documented, reports drafted to CPR 35 or CrimPR 19.
Loop recording writes over the old footage, and deadlines won't wait. Open a case now — the first look costs nothing and stays confidential.