From engineering firms around Port Talbot to software development teams in the city centre, the problem has a common pattern. A trusted employee leaves one company and goes to work at a rival; you find out that your drawings, code or pricing lists have left with them. We will show you what has been stolen, how it was taken and when, all to a standard that would allow you to pursue injunctive relief.
Discreet investigations are conducted, documented and defendable. There is no cost for an initial diagnosis and a written scope is agreed prior to beginning forensic examination, which is payable upfront.
These are the moments for businesses providing products, services and engineering from Swansea Bay and down the M4 corridor to preserve first and ask later.
Almost nobody steals trade secrets through hacking. They get handed a user name and password and walk away with the secrets. The financial ramifications for the company occur at a later time. This could be in the form of a competitor bidding on the same contract as you, but coming in just under your bid by a suspiciously precise amount. It also occurs when a competitor produces a product that looks very much like something you have produced, however it is being sold under a different label. The forensics will involve a few specific (and answerable) questions about which files were taken, which path(s) those files went out through and on which date(s). Every single one of these questions will be directed at your own systems, where all of the relevant data already exists.
By imaging all of the hard drives that were used on the relevant workstation, laptop or file server we can then reconstruct the complete path taken in the exfiltration. The removable media records show evidence of large batch copying of drawing packages or code repository collections. Browser and sync data records when those files are uploaded into an individual's private cloud storage account, webmail account or a file transfer site. Access and print logs will identify who had accessed or output the confidential set. Deleted items will be recovered and a keyword search over entire images will locate files with project names, part numbers or the confidentiality banners they carry.
Provenance can be decisive. Metadata is embedded in many types of documents (Office files, PDFs, CAD drawings) that includes author and company fields, revision chains, creation stamps and internal identifiers. This information remains intact after someone casually renames these documents. Comparing this to your original file(s), we can determine if a competitor document was derived from your work, as long as the competitor document reached us through a lawful means (such as disclosure, or obtained via a court order). Often, that comparison will turn an unusual similarity into expert evidence.
IP dispute resolution provides a priority advantage to whoever preserves first. The sooner an early image can be obtained, the stronger the foundation for a springboard or search-order request will be, and evidence will be preserved before it can be sanitised. A device will always be secured as quickly as possible; work then continues with write-blocked, hash-verified images using a logged chain-of-custody; and the final report will be written to expert-witness standards with findings at the front followed by a technical appendix at the rear. We follow all instructions exactly when a court orders a respondent's device(s) imaged. Covert access into anyone's private devices is never entertained.
Our forensic data recovery area of the website covers the imaging, hashing and custody discipline that all IP cases operate under. The costs of forensic work are payable at the outset; a fee of £800 + VAT is charged for a full report from each standard case investigated by us (£400 + VAT if no report is required, in relation to a binary image and deleted file extraction), see the data recovery cost webpage. If an exhibit drive has been encrypted then we will undertake BitLocker recovery using keys lawfully held by yourselves.
These elements represent how suspicion may become an evidenced account through a forensic image of your computer systems.
Sets of drawings, repository and database contents being copied to USB drives and/or cloud storage.
Search hits for project name, part number and confidential banner keywords.
Metadata that connects a competitor's document to an originally created version by you.
Webmail, file transfer websites and private cloud account activities are under investigation.
Deleted and archived documents are being recovered as evidence.
Who accessed the confidential set, and what actions were performed upon accessing those files.
Any device we image belongs to you (your company equipment) or is one that a court has ordered us to image, and we follow all instructions exactly. We do not covertly obtain information through a competitor's system, nor do we covertly access an individual's personal computer, not only because it is unlawful, but because if one were to obtain evidence improperly it would collapse before the judge and destroy the credibility of the entire remainder of the case. The legal way in IP litigation is also the way to win a case.
The first hours determine what can be recovered in an IP case; therefore it is advisable to contact 0800 689 0668 for a quotation prior to any examination of the device. We will discuss which hard drives are required by us and how they should be safely transported (we only require the hard drive(s), not the computer itself); and document the chain of custody from when the drive arrives at our secure Bristol location.
Do you want to send a drive from your computer, laptop, MacBook, iMac, CCTV / DVR or server? Please do not send the complete unit of computer or device with a hard disk drive (HDD) or solid state drive (SSD) inside. Please remove it and only send the drive itself. For a server, please remove all disks and label them by their bay. We will also not perform removal of internal drives from devices in order to access data. Also, we will not extract data from devices where storage is soldered onto the motherboard (such as T2 and Apple Silicon Macs and some thin laptops). Additionally, we do not recover data from phones and tablets, only drives that can be removed and sent to us. If you're not sure which kind you have, ring us first.
↓ Print the booking-in & shipping form (PDF)
Clearly mark the parcel with the name Bristol Data Recovery, and when your media has been diagnosed we will call you immediately.
If unsure about what to post, please call us first on 0800 689 0668 (the free phone number), or complete a free online diagnostic.
Remove the computers/equipment from service and call the freephone number. Early imaging is what will keep an injunction active.