Two separate questions arrive on this page and they are worth pulling apart on the first telephone call. The first is whether something left your business, by which route and under whose account. The second is whether your version of a design existed before somebody else's, which turns on dates and hash values and requires proving nobody's conduct at all. Clients almost always ring about the first. The second is answered more often, more cheaply, and in a good many disputes it is the one that settles the argument.
◇ Preserve in week one. Argue in month three. £400 + VAT images, verifies, extracts and seals a device; £800 + VAT examines it and writes the report. The £400 is what a recorder drive or an encrypted volume costs. Free diagnostic, written scope. Forensic jobs sit outside no fix, no fee. Bands.
Where a rival product has appeared and your engineers are certain they saw it first, the useful exercise is frequently provenance rather than pursuit. Showing that a particular revision of a drawing, a model or a source tree existed in your possession on a given date draws on file system clocks, the change journal, the mail that carried it as an attachment, backup generations and version-control history, with a hash tying the copy you rely on today to the one described in the report. That is a narrow question with a clean answer and it costs a fraction of a full exfiltration investigation. It also survives the awkward possibility that nobody took anything at all and two teams simply arrived at similar geometry, which does happen, and which a report ought to be able to accommodate rather than argue past.
Intrusions are rare in this work. The access was granted, it suited the job, and somewhere in the final weeks it started being used for something else. So an examiner is not hunting for a forced door; the subject is a change in behaviour with dates on it, which is a much better thing to have. Scale is the usual tell. A repository taken in full where a branch would have done. A parts library copied wholesale by somebody who had spent two years opening three assemblies at a time. A customer table exported on a Tuesday evening by an account with no export history whatsoever. Set against half a year of that same account behaving ordinarily, the shift is a number rather than an impression, and numbers travel better in a witness box than adjectives do.
Material can only leave by a finite number of routes and each leaves its own kind of residue, so all of them get worked rather than whichever surfaces first. Removable media registers itself in the hive and drops shortcut records behind. A personal sync client keeps a local database of everything it mirrored and pushed up. Webmail leaves browser residue and now and then the attachment itself. Transfer services leave session entries. Version control writes clone and fetch lines against a named account on the server, where nobody sitting at the endpoint can get at them to tidy up. And the office printer keeps a spool and a job history that a startling proportion of investigations never look at, which is a shame, because a two-hundred-page print run at half past seven on a Thursday is not subtle. A case built on one channel falls over the moment the other side offers a second.
Contents are only half of what a document carries. Office formats and CAD files hold embedded properties: the author, the organisation, revision identifiers, template paths, editing history and often the original name and folder the file lived in. Drawings keep title-block entries and part numbering schemes that are peculiar to one company. Source files keep comments, naming habits and — in the cases that end quickly — the same mistakes. Where a competitor's document has reached you properly, through disclosure or because somebody simply sent it to you, those properties are compared against your originals and the relationship set out precisely. An unaltered file is settled by hashing and there is not much to argue about afterwards. An edited one is handled by near-duplicate comparison, which produces a degree of similarity rather than a yes, and the report says so in those terms.
The instinct in these matters is to go and look at the competitor, and it has to be resisted. Nothing here is obtained by reaching into anybody else's systems, and material gathered that way does not quietly help the claim — it becomes a second argument running alongside the first, with the judge spending an afternoon on your conduct rather than on the drawings. The same limit applies to a departed employee's own laptop or private cloud account: those need their agreement, a protocol between the solicitors, or an order. What sits inside the line is everything your own systems and your own hardware recorded about the transfer, and in practice that is where the usable material has always been. Where an injunction or a search order is under consideration, solicitors will want the preservation in place before the application in any event.
This is the paragraph to act on rather than file. Server logs roll. Tenancy auditing expires on whatever schedule the licence dictates. Backup generations write over one another. The laptop at the centre of it is, while you read this, quietly consuming the free space an examination would have read. None of that comes back. So the maximum any investigation will ever be able to establish is decided in the first two weeks, by whether anybody thought to freeze things, and no amount of money spent in month four moves that ceiling by a single finding. Preservation is the cheap half and it can be arranged in days.
Method and custody sit on the forensic practice hub. Credentials and standing access are dealt with at insider threat forensics, removable media at USB device forensics, and the freezing step above is legal hold and chain of custody.
These are usually spotted by the people who handle the material daily rather than by anybody in IT. Freeze first, trace second, and speak to nobody until both are done.
There is nothing clever about the order. It is simply that three of these can be done next month and one of them cannot.
Cancel the reimage tickets. Pull the audit exports. Hold the mailboxes. Image the machines. An hour's work, almost no money, and the only move with an expiry date on it.
Settle what is being asked and across which weeks. In front of a judge, one narrow question answered without hedging beats five broad ones answered with qualifications.
Work every route the material could have taken rather than stopping at the first one that turns up, and fasten each finding to the artefact and the date behind it.
Last, once the other three are done. Putting it to somebody while the evidence is still on a live laptop is the most dependable way to lose the evidence.
Each part carries its date and its source, and the report marks the point where technical evidence stops and somebody would have to start inferring.
A repository, a parts library or a database going out in a single operation.
Part numbers, project code names and confidentiality banners found on an image.
Embedded properties and revision identifiers linking a rival document to yours.
Stick, sync client, transfer site, webmail, printer — each with the hour it was used.
Deleted files and archives brought back wherever enough of them survived.
Openings, exports and print runs against protected material, each against a login.
IP matters end in a document, so £800 + VAT is what nearly all of them cost: the examination and the written report, findings numbered, each fastened to a dated artefact, method set out in an appendix for an opposing expert to rerun. The other figure is worth knowing about anyway. £400 + VAT preserves a device properly — imaged, verified, deleted material extracted, sealed, logged — without asking it anything, and in the first fortnight of one of these disputes that is frequently the more urgent purchase. It is the price a recorder drive and an encrypted volume already carry rather than a band of its own, so the published table still runs to five prices and not six.
Neither figure falls under no fix, no fee, which covers logical recovery and publishes four exclusions: electronic and mechanical failure, chip-level work, DVR jobs and forensic jobs. In a design argument that matters, because establishing that your revision came first takes the same hours as establishing that it did not. One device and one question is the assumption behind both prices; a repository server, three laptops and a drawing archive is scoped in the free diagnostic and put in writing beforehand. The diagnostic costs nothing and closes two working days after booking in at Oxford.
An IP instruction runs on systems and hardware the company itself owns, or on a solicitor's written instruction where proceedings are in prospect; an insurer or a court instructing in writing is the same route. A private client's own hardware is the third and it seldom features here. The boundary matters more on this page than most, because the temptation is to go and look at the competitor. Nothing is obtained by reaching into anybody else's systems, no password belonging to another party is defeated or guessed, no monitoring software is supplied, fitted or advised on, and live traffic is not intercepted, that being reserved by the Investigatory Powers Act 2016 to bodies no private laboratory belongs to. Material gathered that way damages a claim rather than advancing it. Phones and tablets are not examined here in any circumstances.
Freezing comes before packing on this kind of matter, so ring 0800 689 0668 first and we will work out what gets captured, in what order, and what genuinely has to be posted at all. Where a disk comes out of a machine, the disk travels and the machine stays with you. Coventry has no counter and nothing is collected anywhere in this network: tracked and insured post to Oxford, or handed in over the counter there in office hours, with the custody file opening as it is booked in.
As a rule the storage comes out and the machine stays where it is. That applies to a laptop, a tower, an iMac and to the recorder sitting under a counter. Taking equipment apart is not something this bench does, and a repair shop will free a drive in a few minutes. Two things go the other way: an external drive stays sealed inside its own case, and a NAS travels as a complete unit with its disks still in their bays. A Fusion Mac is a third case — both of its drives come out and travel together, each one labelled. The single situation nobody can work around is memory soldered flat onto a mainboard, which is how Apple Silicon Macs and a good many slim laptops are built: if the storage will not unbolt, there is no parcel to send.
↓ Print the shipping & booking-in form (PDF)
Put Oxford Data Recovery on the label. From Coventry it is roughly fifty-five miles straight down the M40, about an hour if you would rather drive it in than post it. Either way you are told the moment it is logged, and the free diagnostic finishes two working days later.
Unsure what ought to go in the box? Ring 0800 689 0668 before you seal it, or work through the free online diagnostic and let it do the asking.
Freeze it, settle the question, work every route, and only then speak to anybody. One call will establish which windows are still open and which have already shut.