Workplace matters · digital evidence for employers
It comes in the same shapes every time: a personal Dropbox filling up at midnight, a memory stick plugged in on a Sunday, a returned laptop that looks a little too tidy. Nearly all of it leaves marks. We lift those marks lawfully — the device locked down early, imaged to an evidential standard, written up in a form HR and your solicitor can put to use.
Speak to an engineer in confidence
0800 6890668
| What we need | What it means in practice | How we handle it |
|---|---|---|
| UK GDPR and the DPA 2018 | A lawful basis is needed before anyone examines a device, company-owned or not — legitimate interests, weighed and recorded | We keep the scope tight — only what the suspicion actually warrants |
| ICO guidance on monitoring workers, October 2023 | Be open with staff as a rule; a DPIA where the risk is high | Your policies get read before anything else, and we flag when a DPIA is due |
| Working covertly | Defensible only in exceptional cases — suspected criminality, gross misconduct — signed off at senior level | No examination begins until that authorisation is in writing |
| The ACAS standard | A fair, proportionate investigation has to sit behind any disciplinary step | The examination stays independent; conclusions leave as written |
| What a tribunal does with it | Evidential weight is measured against the way it was gathered | A custody trail that adds weight rather than handing the other side an argument |
Work opens with a confidential briefing. You set out what has happened, which devices and accounts are involved, and what the evidence needs to prove. That fixes the scope, and the scope fixes one written quote, agreed before any examination starts. The scoping itself costs nothing.
Whatever it is — laptop, tower, a bare disk — it sits behind a write blocker and is copied inside a few days, ahead of the rebuild, the reissue or the well-meaning colleague who has a look.
From the copy come the records of which sticks were attached, what synced to cloud accounts or webmail, what was deleted and whether a wiper was used. Those go into a single sequence: what went, when it went, and how.
A plain written account, built for HR and legal use, measured against the ACAS test of a fair investigation and the ICO's 2023 monitoring guidance. Should it turn criminal, Thames Valley Police can work from it unchanged.
Everything comes to you: the report, the exhibits, the underlying files, the hash values, the continuity log and our bench notes. Another expert — or a tribunal — can then retrace every step of the work for themselves.
The one number worth quoting: Symantec and Ponemon's 2013 study put it at roughly half — half of people who had just left a job admitted holding on to confidential material belonging to their former employer. Later percentages mostly come from vendors and scatter all over the place. What the bench shows is duller: where an employer already has a suspicion, the artefacts usually bear it out.
It started when a Towcester employer saw a rival's pitch deck. The digital timeline filled in the rest: files gathered into a single folder, a sign-in to a personal cloud account, then the uploads — twenty days before the resignation letter arrived. Undertakings settled it soon after.
Yes, usually — so long as there is a lawful basis and staff were told their devices might be examined, which is the job an acceptable-use policy does. Covert work is unusual: it's kept back for suspected crime or for gross misconduct, with sign-off at senior level.
Seldom. Covert monitoring is permitted under the ICO's October 2023 guidance only where circumstances are exceptional — suspected crime is the stock example — with senior authorisation, a narrow scope and a written record.
Lock the device away and don't touch it. Leave their accounts open and unwiped, and get an image taken before any colleague starts looking. Even a harmless look through the files destroys the traces that prove data left the building.
A tribunal weighs what the material proves against the way it was collected. Screenshots in a folder become evidence only with a lawful basis behind them, a scope that stayed proportionate, and custody logged as the work went on.
Loop recording writes over the old footage, and deadlines won't wait. Open a case now — the first look costs nothing and stays confidential.