Forensic work in Cardiff · evidence for courts & tribunals
Most of the harm in these cases is done inside the first hour, before anyone thinks to stop. Someone powers the machine up for a look, and traces go. So the exhibit sits behind a hardware write blocker and gets imaged before anybody opens a file; the continuity log is filled in at the bench, not from memory a week later; and the report is written expecting an opposing expert to take it apart. Independent, discreet, and honest about the point where the evidence stops telling you anything.
Speak to us in confidence
0800 6890668
| What shows up | What the evidence tells you | What comes back |
|---|---|---|
| A laptop the whole dispute hangs on | Write-blocked, imaged, then examined on the copy: artefacts, documents, the order things happened | A plain-English answer, in writing |
| An ex-employee you suspect took data | Every USB device attached, uploads to cloud storage or webmail, deletions and wipes — with dates | A document HR and your solicitor can work from |
| Files deleted that a case now rests on | Proof that they existed, the date they vanished, and what came next — all recovered under continuity | The material itself, dated, with the method shown |
| A sealed volume that is lawfully yours to open | If a key or password is within reach at all, Passware is pointed at it | The contents, and how the lock gave way |
| Something headed for a hearing | Bench work as before, then written to whichever shape applies — CPR Part 35, or CrimPR Part 19 | A report that will hold in front of a judge |
| Footage locked inside a DVR or CCTV recorder | Pulled off with the chain unbroken — the CCTV pages go further into it | Video you can play, plus the paperwork behind it |
It starts with a private conversation, and that costs nothing. Three things shape everything after it: what has happened, where it reaches — which machines, which accounts — and what the evidence needs to establish. Those answers set the scope. The scope sets the single written price, quoted before a device is touched.
The blocker goes on first, and the copy is taken before anyone reads anything at all. The device is the evidence in its own right, and in case after case the harm was done by the person who could not resist a quick look.
From there the work is done on the copy, OSForensics among the tools in use: system artefacts, what was opened and when, what was removed, and the order it all falls into. Notes go down while the work happens rather than being assembled afterwards.
Your question gets a plain answer at the top, with the technical detail below it for anyone who wants to check the working. A finding that suits neither side is still a finding, and it stays where it is.
A report is only worth what someone else can check, so it never travels alone. Out go the exhibits, the source files, the continuity log, every hash value, and the notes made at the bench. An expert instructed against you can walk it again and reach the same place.
Why secure the evidence early, and secure it yourself: the Westminster Commission on Forensic Science, whose report appeared in June 2025, traced the collapse of upwards of 30,000 prosecutions across England and Wales over four years to evidence that had been lost, mislaid or made unusable. When HMICFRS examined police digital-forensics backlogs in December 2022, over 25,000 devices were queued. A device imaged properly on day one never sits in a queue at all.
| The tools | The job it does | Why it helps |
|---|---|---|
| X-Ways Forensics | Close examination of disk images: artefacts, usage history, deleted data, timelines | Quick and uncluttered — it suits a small bench that would rather know one tool properly |
| OSForensics | Indexing a Windows machine, or an image of one, so all of it can be searched | The broad first sweep: registry hives, recent-file records, every USB device ever attached |
| Passware | Encrypted volumes, opened where the authority is lawful and a key is within reach | Either it opens or it does not; the report records which, with nothing dressed up |
| Atola Insight Forensic | Acquisition behind a hardware write block, hashed on the same pass | It writes its own log of the whole acquisition, so continuity begins at sector one |
| ACE Lab PC-3000 & Data Extractor | Firmware-level repair, where the exhibit is a dying drive too | A single drive is often evidence and a repair job at once; both trades sit in this room |
Why put it in writing: an expert has been required by the criminal procedure rules, since 2019, to disclose anything that touches on credibility, and an absent accreditation qualifies. Saying it out loud is not modesty. It takes away the cheapest attack available to the other side.
The client came in sure the files had been lifted deliberately. The evidence told a flatter story: a sync client set up wrong had cleared them out of the shared folder, and most of it came back. That finding closed the argument quicker than any accusation would have.
Copying electronic material, examining the copy, and setting out what it shows in a form that survives challenge. Nothing is read until a copy exists. Notes are made as the work goes along, and the write-up is full enough that a second examiner could follow it and land in the same place.
No two instructions are the same shape, so there is no tariff to quote from. Working out the scope is free. Then you get a single figure in writing covering imaging, examination and the report, settled before anything is opened. Nobody here runs a clock.
No. This bench takes disks, storage media, computers, Macs and CCTV or DVR recorders. A handset or a tablet is not on that list. Where a phone turns out to be the heart of a matter, we say so plainly and pass you the name of a lab that works on them.
No. We hold no UKAS accreditation and no ISO certificate, and the front page of every report says so, because the rules make us declare it. What you get instead is a method open to inspection: the image taken behind a hardware blocker, hashes verified, every move noted as it is made, and a report laid out the way CPR 35 or CrimPR 19 wants it.
While that recorder keeps writing, the clip you need is being covered over — and your deadline has not moved. Book it in. The first look is free, and it stays private.