Employee Data Theft and What a Returned Laptop Holds

The laptop that comes back on somebody's last Friday is, without anybody intending it, a written account of how they left. It knows what hardware was attached to it and at what hour. It knows which files were opened and off which volume. It knows which private accounts were signed in on company equipment. And it knows what happened to all of that across the final fortnight. That account is at its fullest on the day the machine is handed over and it starts wearing away from that morning onwards, which is why every other instruction on this page comes after one: stop using it.

The fee is agreed before the answer is known. £800 + VAT examined and written up, £400 + VAT for the verified image with its deleted material lifted out — a recorder disk carries the same figure. Diagnosis costs nothing and the scope is written down first. Forensic work is one of four published exclusions from no fix, no fee. Prices.

A laptop in use is spending the evidence on it

These cases are lost in the fortnight after the handover far more often than they are lost on the facts. The pattern is familiar to anybody who has watched one go wrong: the machine comes back, a helpful colleague has a look through it, the asset ticket already says reimage, and a month later somebody's solicitor is asking what the downloads folder held. Ordinary use eats free space, and free space is where an examination does most of its reading. So the machine goes out of service, the rebuild is cancelled in writing, the handling since the handover is written down, and an image is taken. The rest of this page assumes those four things have happened.

A fortnight, put back together

What an employer buys is a sequence rather than a heap of artefacts. Windows records more than anybody configures it to record — the devices it has met, the documents opened and the volumes they came off, the folders browsed on media that has since gone, the programs that ran and how often, the file operations in the order they occurred, and the account signed in around each of them. Individually those are fragments and each has an innocent reading available. Sorted by time and cross-checked against one another, they describe a fortnight: what was looked at, what moved, at which hours, under whose login. The technical detail of the device records sits on the USB page rather than being repeated here.

The USB port gets the attention and is no longer the main road

Sticks remain a route and they are not the majority route, which matters because an examination aimed only at them will miss most of what a current case turns on. A personal cloud client authenticated beside the corporate one, mirroring a folder away in the background. Webmail open in a browser tab with attachments going out through it. Large-file transfer services. Company mail pushed onward by a rule that also removes the evidence of itself from sent items. An entire document library pulled down across one evening. And printing, which nearly everybody forgets about, and which leaves a spool record and a job history sitting there waiting to be read.

What an employer may look at, and what belongs to somebody else

The line is ownership and it is not always where people assume. Company hardware, company accounts and company systems can be examined on the company's own authority, and no separate permission is needed to look inside your own equipment. An employee's personal drive, private mailbox or home computer cannot, whatever was plugged into what. Between those two sits personal material on a work device, which still attracts obligations under data protection law: the examination is scoped to the question being asked, the reason for that scope is recorded, and private correspondence that is plainly irrelevant is not trawled through because it happens to be within reach.

The report has to survive two audiences

The first is your own board, which will make a decision on it long before any tribunal sees it and which does not want a tool's output. The second is a panel and an opponent, who will look for the seam. Both are served by the same document: numbered findings in plain English, each fastened to a dated artefact; both readings given wherever an artefact allows two; method in an appendix so the other side can rerun it; and a clear statement whenever the evidence shows what an account did rather than what a person did. That last distinction is where these reports usually fail, because it is tempting to close the gap and it is the panel's job to close it, not an examiner's.

The imaging and custody discipline is on the forensic practice hub. The removable-media half of this work is USB device forensics, the mailbox and cloud half is email and cloud exfiltration, and preserving the hardware properly is legal hold and chain of custody. Where what is at stake is drawings, source code or formulations rather than a customer list, trade secret and IP theft is the version written for that.

// six reasons to take the image today

Signs the laptop should be preserved now

Any single one of these justifies pulling the device out of circulation and leaving it alone until a copy exists — the same answer for a two-van firm in Bedworth as for a supplier on the Ansty estates.

A laptop that came back holding a Windows installation nobody in IT approved
Sticks and cards turning up on a desk that had never had any near it before
Four weeks of small outbound messages, every one to the same private mailbox
A consumer cloud account authenticated next to the corporate one
Late sessions opening a great deal more of the shared drive than the job required
Customers mentioning that they have been approached from wherever the leaver went
// the first hour, in order

Seven things to do before you ring anybody

None of this costs money and all of it is worth more than the examination that follows. Roughly in order of importance:

  • Stop using the device and stop anybody else using it. Switched off is better than sitting on a desk logged in.
  • Cancel the rebuild, reimage or disposal ticket in writing, so nobody clears the machine in good faith next Tuesday.
  • Write down who has handled it since the handover, when, and what they opened.
  • Preserve the mailbox and export the tenancy audit log now. Those expire on a timer and the timer is shorter than people expect.
  • Put aside every stick, portable disk and memory card that came back alongside the hardware. Unopened, unformatted, not reissued to anybody.
  • Note the leaving date, the last working day and the date the equipment was returned. The gaps between those three matter.
  • Decide who inside the business is allowed to know. A confrontation before the evidence exists is how machines get wiped.
// six threads out of one laptop

What an employer's instruction produces

Every thread carries a date, belongs to a named profile, and is traced back to the specific artefact it was read out of.

Hardware attached

An inventory of the removable devices, their serials, and the hours of contact.

Documents in motion

Journal lines and destination clocks putting named files onto a named volume.

Opened from where

The records fastening a document to the particular device it was read off.

The route out

Browser sends, mailbox rules and sync-client logs still sitting on the disk.

Conduct around it

Bulk folder reads, print runs, late sessions, messages about the next job.

Handling that holds

The gap between departure and capture, with hash figures that still match.

// the fee, and who may lawfully ask for it

What it costs, and the authority it stands on

Settled before anybody knows the answer

Employers ask about this order of things more than anyone else does, so it is worth being blunt. The fee is agreed and paid before an examiner opens the image, which means you are buying the examination and not the finding. An investigation that clears the leaver took exactly the same bench hours as one that does not, and a laboratory paid on results would have an interest in the outcome, which is the last thing anybody wants in front of a tribunal. That is also why forensic work is one of the four exclusions published against no fix, no fee, beside electronic and mechanical failure, chip-level work and DVR jobs.

£800 + VATOne laptop, one question, examined and written up — findings numbered and dated, method in an appendix, ready to go behind a witness statement.
£400 + VATThe verified image with deleted material extracted, no report. Same figure as a recorder disk or an encrypted drive, not an extra band.

Two machines and three questions is a different job from one and one, so anything beyond a single device is measured during the free diagnostic and quoted in writing before you commit. The diagnostic costs nothing and finishes two working days after the exhibit reaches Oxford and is booked in, which is the same moment the custody file opens. If the laptop has simply died and nobody is in dispute, that is ordinary recovery at the published band and this page is the wrong one.

What an employer may hand over, and what it may not

An employer instructs over its own hardware and its own accounts, and no separate consent is needed for that. A solicitor's written instruction is welcome and is not a precondition. Those are two of the three routes onto this bench; the third is a private client with hardware that is genuinely theirs. An employee's own laptop, personal mailbox or home computer is none of the three, whatever was once plugged into what, and remains theirs. The standing refusals apply to every instruction: nobody else's password is defeated or guessed, monitoring software is not supplied, fitted or advised on, and live traffic is not intercepted — interception belongs to the bodies named in the Investigatory Powers Act 2016 and a private laboratory is not one. Buying an examination does not create a right to look that the buyer did not already have. Phones and tablets are not examined here in any case.

// employer instructions — the standing questions

What HR and directors put to us first

Usually, and now and then the reset is the finding rather than an obstacle to one. A quick reinstall sits on top of the old volume and leaves most of it readable underneath, and the installation carries its own date. Where that date falls between the resignation and the handover, it is worth having on its own. Even a thorough wipe leaves the name of the tool, the hour it ran and the account that launched it. Stop using the machine and let the free diagnostic report what is genuinely left.
That is the distinction the whole exercise turns on, and it takes several records agreeing. Shortcut and jump-list entries carry the serial of the volume a named document was opened from. A copied file lands at its destination with a fresh creation time while its modification time still belongs to the original. The change journal orders the operations. And where the device itself is produced, hashing settles whether two files resemble each other or are the same.
Yes. Company hardware and company accounts are the company's to examine and no separate consent is needed. Two qualifications. Private material found on a work device still attracts data protection duties, so the examination is scoped to the question asked and the reason is written down. And an employee's own drive or personal account remains theirs, whatever it was once connected to.
One document and its appendices: numbered findings, each dated and attached to the artefact behind it; a method section detailed enough to be repeated by somebody hostile; a schedule of every device and account examined; and the hash values proving the images have not moved since they were taken. The findings describe what an account did. They stop deliberately short of asserting what a person intended, which is the panel's decision to make.
The preservation, which is the part that matters most and costs nothing. Cancelling the rebuild, noting who has handled the machine, exporting the audit logs and putting the mailbox into hold are all jobs for your own IT people and can be done in a morning. The thing to avoid doing in-house is looking around the machine to see what is on it, because every look writes to the disk and every write becomes something that has to be explained afterwards.
// getting your media to Oxford

Posting a device in — what goes in the box

Kill the rebuild and disposal tickets in writing, then call 0800 689 0668 so we can settle what actually needs to travel. Wherever the disk comes out, the disk travels and the computer stays with you. No collection service operates anywhere in this network and there is no Coventry counter: it goes to Oxford tracked and insured, or over the counter there during office hours, entering the custody file as it is booked in.

As a rule the storage comes out and the machine stays where it is. That applies to a laptop, a tower, an iMac and to the recorder sitting under a counter. Taking equipment apart is not something this bench does, and a repair shop will free a drive in a few minutes. Two things go the other way: an external drive stays sealed inside its own case, and a NAS travels as a complete unit with its disks still in their bays. A Fusion Mac is a third case — both of its drives come out and travel together, each one labelled. The single situation nobody can work around is memory soldered flat onto a mainboard, which is how Apple Silicon Macs and a good many slim laptops are built: if the storage will not unbolt, there is no parcel to send.

  • Use a box or padded mailer with some rigidity to it, and pack around the drive until nothing shifts when the parcel is tilted. Mains adaptors, docks and leads are not wanted at this end.
  • Sending a RAID or a server? Only the member disks travel — not the chassis, not the controller — and each one wants its bay number written on it. Take a photograph of the front of the unit before anything is pulled; it costs nothing and now and again it saves a day.
  • Print the shipping and booking-in form (PDF), add a name, a number you will answer and a sentence on how the trouble began, and drop it in beside the media.
  • Most people use Special Delivery, which is tracked and covered; a courier of your own does the same job. You can also bring it: the Oxford reception takes devices over the counter, Mon–Fri 9:00am–5:30pm. Neither a Coventry counter nor a collection round exists.
// write this on the label

Oxford Data Recovery

John Eccles House
Oxford Science Park
Robert Robinson Avenue
Littlemore, Oxford, OX4 4GP

↓ Print the shipping & booking-in form (PDF)

Put Oxford Data Recovery on the label. From Coventry it is roughly fifty-five miles straight down the M40, about an hour if you would rather drive it in than post it. Either way you are told the moment it is logged, and the free diagnostic finishes two working days later.

Unsure what ought to go in the box? Ring 0800 689 0668 before you seal it, or work through the free online diagnostic and let it do the asking.

The laptop already knows. Stop using it.

Cancel the reimage ticket in writing, leave the machine switched off in a drawer, and ring before anybody in the office decides to have a helpful look through it.