A process engineer leaves a spin-out in the Knowledge Quarter and, two quarters later, a competitor demonstrates something your people spent three years building. Merseyside's research companies around the two universities, the manufacturers at Speke and Halewood, and the process firms at Runcorn and Widnes all know that moment. We turn it into an itemised account with dates on it: what left, which route it took, and how the rival's material compares with your originals.
◇ Scope first, then work. Diagnosis is free and comes at the beginning; the written scope follows, and the forensic fee is paid in full before an examiner opens the image. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. The whole price list sits on the data recovery cost page.
Engineering and product teams usually spot these first. Preserve, then investigate, and confront only after both.
Trade secrets rarely leave through a break-in. They leave under a valid login, in the middle of an ordinary week, hidden in the traffic of a busy system, and the loss surfaces months later as a tender lost narrowly or a product with familiar lines. That leaves three questions, all of them answerable: what moved, by which channel, and on which days. The systems you already own hold the answers.
Working from images of the relevant workstations and of the file server, the exit is reconstructed from end to end. Device records show drawing sets and repositories leaving in a single movement. Browser and sync-client traces show uploads into personal storage. Printing clusters around protected folders. Deleted material returns where somebody tidied up afterwards. The image is then searched for your part numbers, project names and confidentiality markings, so that renaming a file on the way out buys nobody anything.
Once material is in someone else's hands, origin becomes the argument. Office documents, PDFs and CAD files carry embedded records that survive renaming and light editing: author, organisation, revision history, reference numbers, save times. Compared with your originals, those can demonstrate that one document descends from another. The comparison only counts if the rival's copy arrived lawfully, through disclosure or under an order of the court, and on that footing a resemblance becomes something a judge can weigh.
An intellectual property claim takes its shape immediately. Imaging at once fixes the record before any tidying, and that determines whether an application for an interim injunction, or for a search order in the High Court, rests on evidence or on inference. Machines come out of service and are captured. The report is prepared to evidential standards, findings before appendix. Where the court has ordered a defendant's hardware to be imaged, the order is executed exactly as drawn and nothing outside it is examined. Covert collection is not offered here at any price.
The bench method behind it is described at the forensic recovery hub. Sticks and cards are dealt with under USB device forensics, misused logins under insider threat forensics, and the numbers on the prices page.
Together they move a suspiciously familiar rival product from grievance into evidence.
Drawing libraries, repositories and databases leaving in a single operation.
Part numbers, project names and confidentiality banners located on the image.
Embedded records tracing a rival file back to the document it came from.
Webmail, transfer sites and personal cloud uploads, each with a date.
Erased files and archives returned to the record.
When the protected material was opened, exported and printed.
Diagnosis is free and takes 2 working days from the morning the parcel is opened. Nothing forensic runs under no fix, no fee. A forensic investigation ending in a written report is £800 + VAT, settled in full before the examination opens. Where no report is wanted, the binary image with deleted-file extraction stands on its own at £400 + VAT. Forensic work is paid for in advance, without exception. The same two figures appear on the prices page, and you are asked for nothing until the written scope has been agreed.
IP instructions run on your own corporate systems, or on hardware the court has ordered imaged, confined strictly to the terms of that order. Only three routes reach an examination and there is no fourth. Hardware the business itself bought. A written instruction from solicitors, from an insurer or from the court. Or a device belonging to the client, which in a family matter extends to a machine the couple own between them. Nothing is broken into on this bench. Live traffic is never intercepted: that power belongs to the agencies named in the Investigatory Powers Act 2016 and nowhere else. If a client may not lawfully look inside a device, the answer here is the same one.
The opening days decide what can be proved later. Ring 0800 689 0668, leave the machines exactly as they are, and we will agree which hardware travels. It goes by tracked, insured post to the Manchester laboratory, because nothing is collected, with custody recorded from arrival.
Still screwed inside a laptop, tower, MacBook, iMac, server or a CCTV recorder? Take the drive out and post that on its own. We do not strip machines here, and any computer shop will do it in a few minutes. The one job nobody can take on is flash soldered straight to a logic board, as on Apple Silicon Macs and a handful of very slim laptops: if the storage will not unbolt, there is nothing to send.
↓ Print the shipping & booking-in form (PDF)
Address it to Manchester Data Recovery. It is roughly 35 miles from Liverpool along the M62 if you fancy the run, and next working day by tracked post if you do not. We ring or email the moment it is booked in, and the free diagnostic closes 2 working days after that.
Not sure what belongs in the parcel? Call 0800 689 0668 before you tape it shut, or step through the free online diagnostic first.
Take the machines out of service and ring the freephone — an early image is what an application stands on.