Birmingham forensic examination · evidence for courts & tribunals
Cases are rarely lost on the contents of a disk. They are lost on what somebody did to that disk in the first hour. So the exhibit goes behind a hardware write blocker and is copied before a single file is opened, the custody record is written at the bench rather than reconstructed afterwards, and the report is drafted in the knowledge that an opposing expert will pick through it. Discreet, independent, and clear about where the evidence runs out.
Call us, in confidence
0800 6890668
| What you see | What the evidence can show | What you get back |
|---|---|---|
| A laptop that a dispute turns on | Imaged under write protection, then worked through on the image: artefacts, files, timing | A written answer in plain words |
| A leaver you think walked off with files | Which USB sticks were plugged in, what went to cloud or webmail, what was deleted or wiped — in order | Something HR and your solicitor can use |
| Deletions that now matter in a case | Evidence that they existed, the date they went, and what happened next — recovered under continuity | The files, with dates and method attached |
| Encryption you have the right to break | Where a password or key can realistically be reached, Passware goes to work on it | Whatever it held, and the way in |
| A matter that will reach a courtroom | Identical bench work, written up to the pattern CPR Part 35 or CrimPR Part 19 sets | A report the court can rely on |
| Recordings sitting inside a CCTV box or DVR | Lifted off without breaking continuity — there is more on the CCTV pages | Playable footage, and the record that came with it |
Nothing begins until we have talked it through privately. Tell us what happened, which devices and accounts it reaches, and what the evidence has to prove; those three answers fix the scope, and the scope fixes the one written price you receive before anyone examines a device. That conversation is free.
A hardware write blocker goes on and the copy is made before anybody reads a thing. The device is itself the evidence, and most of the damage in these cases is done by whoever had a quick look first.
Everything after that is done to the image, with OSForensics among the tools on the bench: system artefacts, what was opened and when, deletions, and the sequence they fall into. The notes are written while it happens, not put together later.
The question you asked gets answered in plain English, and everything technical sits underneath for whoever wants to check the working. Where a finding suits neither party, it is still the finding, and it stays in.
Everything goes across: the report, the exhibits, the source files, hash values, the continuity log and the notes written at the bench. An opposing expert, or the tribunal itself, can repeat every step and end up with the same answer.
Why secure it yourself, and early: police digital-forensics backlogs held more than 25,000 devices when HMICFRS looked at them in December 2022. A June 2025 report from the Westminster Commission on Forensic Science put the collapse of over 30,000 prosecutions in England and Wales across four years down to evidence that was lost, missing or unusable. Image a device properly on day one and it never joins a queue.
| Equipment | What it does | What it adds |
|---|---|---|
| X-Ways Forensics | Fine-grained work on disk images: artefacts, usage records, deleted material, timelines | Fast, and free of clutter — the right fit for a small bench that prefers to master a single tool |
| OSForensics | Building a searchable index over a Windows system, or an image of one | The first wide pass: registry hives, recent-file traces, and every USB device the machine has seen |
| Passware | Locked volumes, opened when the authority is lawful and a key or password can be reached | It either gives way or it holds; whichever happens, the report says which — no dressing it up |
| Atola Insight Forensic | Imaging behind hardware write protection, hashing the data on the same pass | It logs the whole acquisition itself, so the continuity record begins with the first sector |
| ACE Lab PC-3000 & Data Extractor | Repair at firmware level, for exhibits that are also dying drives | One drive can be evidence and a repair job at once, and both skills sit in the same room |
Why say any of this: the criminal procedure rules have required experts, since 2019, to disclose anything touching their credibility, and a missing accreditation counts. Setting it out in public is not humility. It removes the easiest point the other side would otherwise have.
The client arrived certain the files had been taken on purpose. What the evidence showed was duller: a sync client set up badly had swept them off the shared drive, and most of it could be brought back. That finding closed the argument faster than an accusation ever would.
Taking electronic material, examining it and writing it up so the result stands when someone attacks it. The device is copied before it is read. Every step goes on the record while it is happening, and the report is detailed enough for another examiner to repeat the work.
There is no price list, because no two instructions are the same size. Scoping the job costs nothing. After that comes one written figure for imaging, examination and the report, agreed before a device is opened. We do not bill by the hour.
No. The list here is disks, storage media, computers and recorders of the CCTV or DVR sort; handsets and tablets are not on it. Should a handset prove to be the centre of a case, we will say so plainly and give you the name of a lab that takes them.
No — there is no UKAS accreditation here and no ISO certificate, and every report states that on its opening page because the rules oblige us to. In place of a badge you get a method anyone can inspect: the copy taken behind a hardware blocker, hashes checked, each step written down as it happens, and the report set out in the form CPR 35 or CrimPR 19 requires.
Every hour the recorder runs, more of what you need is gone, and the deadline stays where it is. Book it in now: the diagnosis is free and stays confidential.