Key employees leave for a rival, or competitors turn up with copies of your source code, designs, customer list or pricing information. We prove what was taken and where it went, on behalf of businesses throughout Staines, Surrey and elsewhere, to a standard suitable for obtaining an injunction. Free diagnostic; freephone advisory service.
Confidentiality and quality of evidence. Every case starts with a free diagnostic and a written scope prior to conducting the investigation.
When a key employee departs for a competitor, or you find a competitor holding your property, these are the signs that trade secrets may have left the premises across Staines, Surrey and beyond.
Trade secret theft does not usually happen in a dramatic fashion. As a rule, it is one of your company's most trusted employees, in their final weeks, quietly removing the items that give the business its value: source code, CAD and engineering drawings, product formulations, the customer and pricing database, live bids and R&D. At times it is a competitor who now holds something that could only have come from you. In either case the questions remain the same (what was taken, how did it leave, and can it be proved?) and the answers come from a forensic analysis of your own systems.
We take an image of the departing employee's laptop, workstation or the file server and then reconstruct how the files were taken out. USB history can show a large volume of design or code files being copied to an external hard drive. Browser and client logs can reveal uploads to a personal Dropbox, Google Drive or webmail account. Print logs and file-access records show the confidential set being opened and printed or output. We carve deleted files back off the drive and run a keyword search across the entire image to locate documents by name, project code or confidentiality marking.
Proving a leak typically requires showing lineage. Office documents, PDFs and CAD files carry embedded metadata (original author, company, revision history, creation and edit timestamps, and internal identifiers) which can tie a document held by a competitor back to your business and show that a 'new' document is really derived from yours. If an expert can match this metadata against your originals, what began as a suspicion of copying becomes something that can be backed up.
In IP cases time is critical: acting immediately can support a springboard or search-order application and prevent the material being used before the trail goes cold. We preserve all devices straight away, then work exclusively from write-blocked, hash-verified images with a documented chain of custody. We also produce a report to expert-witness standard, including findings and a technical appendix, suitable for an injunction or a High Court claim. Where a court has ordered imaging of a respondent's device, we follow that order strictly, and we never covertly access anyone's private device.
Our forensic data recovery service includes IP theft cases; the hub details the tools and procedures we use to make our findings court-ready.
Working from a forensic image of your own systems, these are the threads that evidence an IP theft.
Transfers of design, code and database files via USB and cloud.
Hits on filenames, project codes and confidentiality-marking keywords.
Evidence of authorship, revision history and IDs linking files back to you.
Evidence of uploads and sends to personal or competitor accounts.
Extracted from unallocated space and archive formats.
Who opened, exported or printed the confidential set.
We investigate your own company's systems and hardware. Where a court has ordered the imaging of an opponent's device (for instance, under a search order), we follow that order exactly and preserve everything to evidential standard. We never covertly access a competitor's or an individual's private device. In intellectual property litigation the lawful, court-backed path is also the one that wins, since improperly obtained evidence is useless in front of a judge.
Cases involving intellectual property rely on both speed and preservation. Call us on 0800 689 0668 before you touch the devices. We will agree which hard drives (not computers) should be sent and how to keep them evidentially sound, and document the chain of custody from the moment they arrive at our secure location in Guildford.
Sending a drive from a computer, laptop, MacBook, iMac, CCTV/DVR or server? You will need to remove the internal hard drive or SSD and send us just the drive, as we are unable to remove the drive for you. We also cannot recover storage soldered onto a motherboard, such as in Apple Silicon Macs and some thin laptops. Only drives that can be removed from a machine and sent to us can be recovered. If you are unsure whether your device has a removable drive, please call us before sending. RAID, server and SAN drives need to be removed from their enclosure and labelled by bay. For a NAS, send the disks themselves if they are removable, otherwise the entire NAS device. An external single drive should come to us whole, along with its cable and power supply.
↓ Print the booking-in & shipping form (PDF)
Please mark the package for the attention of Guildford Data Recovery, and we will call you as soon as we have diagnosed your media.
Unsure as to how to proceed with sending the item in for recovery? Then simply call 0800 689 0668, or complete the free online diagnostic prior to dispatching the item to obtain your price quotation.
Quickly: preserve the devices, then start a free diagnostic or call our freephone number; early imaging supports an injunction.