The coroner in the Gareth Williams case delivered a damning verdict that was highly critical of the Metropolitan police's counter-terrorism branch and MI6 as she ruled that the officer had probably been killed unlawfully.

The cause of death of Williams, 31, who was found padlocked in a holdall in the bath at his flat in Pimlico, central London, was "unnatural and likely to have been criminally mediated", said Dr Fiona Wilcox.

Passing a narrative verdict, she said she was satisfied that "a third party placed the bag in the bath and on the balance of probabilities locked the bag".

She was, therefore, "satisfied that on the balance of probabilities that Gareth was killed unlawfully".

Wilcox levelled devastating criticism at Williams's employers at MI6 who failed to report him missing for seven days when he did not turn up for work. The explanation from his line manager lacked credibility, she said, and she could "only speculate as to what effect this [delay] had on the investigation".

The lawyer for the Secret Intelligence Service, Andrew O'Connor, delivered deep regrets and an unprecedented apology to the family from Sir John Sawers, chief of the SIS, who recognised that "failure to act more swiftly" when Williams was absent had contributed to their "anguish and suffering".

Officers in the Met's counter-terrorism branch, SO15, whose role was to interview SIS witnesses, were also strongly criticised. SO15 failed to inform DCI Jackie Sebire, senior investigating officer, of the existence of nine memory sticks and a black holdall found at Williams's MI6 office until two days before the inquest ended, the coroner said. On discovering this, Wilcox said she had seriously questioned whether she should adjourn the inquest at that point.

No formal statements were taken by S015 officers who interviewed Williams's colleagues, "and I find this did affect the quality of evidence heard in this court," she said.

She also criticised the handling of an iPhone belonging to Williams and found in his work locker, which contained deleted images of him naked in a pair of boots. The officer involved kept it in his possession before handing it to homicide detectives the following day, "demonstrating disregard for the rules governing continuity of evidence", she said.

Many agencies "fell short of the ideal", she said, including LGC Forensics in relation to DNA contamination, and the coroner's office for failing to inform police officers of a second postmortem.

Williams, a fitness fanatic from Anglesey, north Wales, was probably alive when put in the bag but probably suffocated very soon afterwards either from CO2 poisoning, hypercapnia, or the effects of a short-acting poison, she said.

Scotland Yard has always treated the death as suspicious and unexplained, but held back from describing it as murder or manslaughter. Recording her verdict, Wilcox stated her belief that a criminal hand was involved, although police said afterwards that there was no evidence of this. The Guardian understands police inquiries have focused on the theory that Williams died accidentally in a private sexual liaison that went wrong.

The coroner, however, ruled out bondage or auto-erotic activity as explanations.

The dead man's family said in a statement that their grief had been exacerbated by the failure of his employers at MI6 to make "even the most basic inquiries of his whereabouts and welfare" when he was absent from work for seven days.

They were "extremely disappointed at the failure and reluctance of MI6" to provide relevant information and called on the Metropolitan police commissioner, Bernard Hogan-Howe, to conduct a review of how the investigation would proceed "in the light of the total inadequacy of S015's investigations into MI6".

Wilcox said there was no evidence to suggest that any SIS colleague had been involved, but it remained a legitimate line of inquiry given Williams socialised with so few people, and never let anyone he didn't know into his flat. So any third party would be "someone he knew or someone there without invitation".

An SIS spokesman said: "We fully co-operated with the police and will continue to do so during the ongoing investigation. We gave all the evidence to the police when they wanted it; at no time did we withhold any evidence."

An iPhone found in his living room had recently been wiped and restored to factory settings, and it could not be ruled out that contact with a third party had been made via the internet on that phone, she said.

Wilcox was "sure that a third party moved the bag containing Gareth into the bath". There were two possibilities: either he entered the bag outside the bathroom and it was carried in by a third party, or he was locked in the bag by a third party and lifted into the bath.

She dismissed an interest in bondage, and female clothing, as being irrelevant, condemning leaks to the media about him cross-dressing as a possible attempt "by some third party to manipulate a section of the evidence".

She said: "Gareth was naked in a bag, not cross-dressed, not in high-heeled shoes." If his interest was bondage, she would have expected much more internet activity on such websites, when his visits made up a tiny percentage of his browsing. His interest was in fashion, she said. Dismissing any auto-erotic activity, she said he was a "scrupulous risk assessor" and if he had locked himself into the bag would have taken a knife in with him to escape.

She said that despite a 21-month police inquiry: "Most of the fundamental questions in relation to how Gareth died remained unanswered."

Detectives believe scientific tests on a crumpled green hand towel found in his flat may yet yield crucial DNA evidence, as the Metropolitan police launched a review into the case.

The towel was originally in the bathroom, and moved to the kitchen, police believe, by the "third party". More tests are being conducted on the bag. The memory sticks, which have now been examined by police, are said not to have produced any significant evidence, but will be examined more closely.

Martin Hewitt, deputy assistant commissioner of the Met, said the circumstances of the death were particularly complex and continued to be the subject of a thorough investigation.

He added: "We have listened to the detailed ruling by the coroner and the concerns raised by Gareth's family. We are giving both very careful consideration."

Detectives were "currently undertaking actions in order to develop existing DNA profiles, to trace unidentified individuals who may have information about Gareth's death, and to further develop analysis of telephone communications".