The outcome of a deletion dispute depends upon two things: what the original file was, and how it came to leave. A Windows volume normally has enough information to answer both questions, and more often than not the second answer is the one that matters. The bin index, the change journal, the shadow copies and the security log each give a different view of the same afternoon, and putting them side by side is what produces a timeline rather than an assertion. Instructed by employers, solicitors and private clients throughout Berkshire, Surrey and the London boroughs.
◇ Footing first, bench afterwards. An investigation along with its full written report is £800 + VAT; a verified image with the deleted files extracted and no report written is £400 + VAT, which is the same point as a recorder disk. There is no charge for the diagnostic, and the scope goes into writing first. Forensic work is paid upfront at the time you accept our fixed quote. On other services, in most cases you only pay if we recover your data (electronic and mechanical failures, chip-level work and physical damage are 50% upfront, with the balance only if we recover your data). Standard rates for ordinary recovery bands can be found on the data recovery cost page.
This page covers anything where the hour of a deletion is as important as what is contained within the file.
Sending a file to the recycle bin produces a small companion record holding its original location, its size and the time it was moved there, and these records typically remain long after the bin has been emptied. A shift-delete bypasses the bin altogether, and all that is lost is the index entry: the contents are left right where they were until the space they occupied gets reused. A file that is overwritten in place is something else again. Working out which grade applies, and at what hour, is generally the first job of the examination, and very often the answer speaks to intent before anyone has looked at what the file contained.
A timeline is a record of events listed in order, and it only has value if the sources support each other. Each entry in the master file table carries the created, modified and accessed times for live and deleted records alike. The change journal records operations one at a time as they happen (created, renamed, deleted, extended). The transaction log fills in the minutes around an event in finer detail. Security event logs give the account that was signed in, the type of logon used and what it had touched beforehand. When all four agree, an hour can be stated with confidence. If there is disagreement among them, the report says which one it prefers and explains why.
A Windows machine quietly stores several different versions of its own past. Shadow copies (written for restore points and by backup software) preserve earlier states of the volume: files removed since then, older drafts from before an edit, folder listings from a fortnight ago. Compare one with the live disk and whatever went missing between the two dates shows up in a single comparison. It is the cleanest exhibit this kind of case can have: there on the 3rd, gone by the 10th, with the journal placing the removal on the Wednesday in between. Backup sets, Previous Versions and the bin on a mapped network drive do the same job where they exist.
Wiping software is far from subtle. The search begins with the evidence left behind by the tools used to wipe: installation and uninstallation entries, prefetch records naming the executable and holding up to eight of its run times, the regular pattern an overwrite lays down across a surface, and the suspicious absence of artefacts that any working machine should have. A wipe destroys material and creates evidence in one step, since the tool, the hour it was run, the account responsible for running it and everything beyond the tool's reach all survive. Runs which were interrupted or directed at the wrong volume are commonly found; whatever such a run failed to touch is recovered normally and described as what it is.
Solid-state drives are the honest exception. If TRIM is active and the volume is not encrypted, the controller may discard the contents of a deleted file within minutes of it being deleted, and no software will recover what the flash has already erased. Typically enough of the metadata trail remains intact to evidence that the file was deleted and at what hour, although the file itself cannot be produced. On a spinning hard disk that has stayed in normal daily use, unallocated space is consumed week by week. And once a file has genuinely been overwritten, there is no coming back from it, regardless of anything anyone promises you. You are told which of those you are in before the quotation is written, not afterwards.
The imaging and custody discipline underneath this page is set out at the forensic recovery hub. Deletions involving sticks and cards carry on through USB device forensics, and whole-machine capture through workstation deep imaging. The non-forensic version of this job (files deleted where nobody is in dispute) is ordinary recovery work at the bands on the prices page.
No single artefact is relied upon on its own. Where all six report the same hour, that hour is stated; where they differ, the disagreement is reported.
The path, size and time of the move, still readable long after the bin itself was emptied.
For both live and deleted entries, the values showing when they were created, modified and accessed.
Each time an item is created, renamed, deleted or extended, a one-line record is logged as it happens.
Which account was signed in around each event and what type of logon it used.
Earlier states of the volume, frozen at some point in the past and still carrying data that the live disk has since lost.
The tool name, its run times, the account it was launched under, and everything it left behind.
Let's start with the part people are least often told about: a forensic examination is paid upfront, once you accept the fixed quote. The arrangement where in most cases you only pay if we recover your data belongs to recovery work, and even there electronic and mechanical failures, chip-level work and physical damage are 50% upfront, while DVR, forensic, BitLocker and ransomware work is paid upfront. An examination is bench time spent answering a question, so it is charged whether the findings help you or not. What it does have is two published figures, which is two more than many other laboratories will put in front of you. An examination that ends in a full written report is priced at £800 + VAT. An examination that stops at the evidence itself, a verified binary image with the deleted material extracted out of it and handed over for another party to interpret, is priced at £400 + VAT. That second figure is the same point on the list as a recorder disk or a BitLocker volume, so it adds nothing new to the five bands listed throughout the rest of the site.
The examination itself, together with the full written report that comes out of it, produced so that an expert acting against you can follow each and every step and test it.
The verified binary image with the deleted files extracted from it, and no report written. It is the same figure a recorder disk or an encrypted volume carries, not an additional band.
Both figures are based on a single machine and a single question put to it. An exercise with nine laptops, a file server and a tenancy export is a greater scope of work, so anything which spans several devices is measured after the free diagnostic and written down before you agree to proceed. Diagnosis still costs nothing and still closes 2 working days after the device is booked in, and the fee is settled before an examiner opens the image, not afterwards. Everything other than forensic work keeps its published band on the prices page.
Deletion work is performed either on company equipment, on hardware that you own yourself, or on the written instruction of a solicitor. There have only ever been three routes to this bench, and there has never been a fourth. Equipment that the business itself bought and issued. A written instruction from a solicitor, an insurer or the court. Or a device that genuinely belongs to the person asking, which in a family matter means one owned outright or owned jointly. Nothing is broken into here. We will not work out another person's password, nor install monitoring software onto a device the client does not own, and live traffic is never intercepted, as interception belongs to the bodies named in the Investigatory Powers Act 2016 and to no one else. Where a client has no lawful right to look inside a device, instructing us does not create one. Handsets and tablets are excluded from the practice entirely.
Ordinary use costs a deletion case something every day it continues, so remove the machine from service before you ring us on 0800 689 0668 and not after. There is no collection anywhere in this network, and no Bracknell counter either: once you have a quote over the phone or through our free online diagnostic, send only the drive (not the machine) to Guildford by tracked, insured post, or drop it off personally at the Guildford lab, Monday to Friday, 9am to 5:30pm, with no appointment needed. Custody begins at booking-in.
Is the hard drive still bolted into a machine, whether that is a laptop, a tower, an iMac, a MacBook, a rack server or a DVR stored under the till? Get a quote first, then pull the drive out of the machine and send only the bare drive (never the entire machine): from a server the disks come out labelled by bay, and from a DVR you just send the disk. Stripping hardware is not something our lab does, though any repair shop on your high street can do it in about ten minutes. The one case with no way round it is memory chips soldered flat onto the mainboard, which is how T2 and Apple Silicon Macs and certain ultrabooks are built, and that storage is not taken on. Call us first if you're not sure which kind you have. Where the storage cannot be unbolted, there is no parcel to make up.
↓ Print the shipping & booking-in form (PDF)
With your quote in hand, the name on the parcel wants to be Guildford Data Recovery. Driving it over from Bracknell takes roughly forty minutes along the A322 followed by the A3, and you do not need an appointment; posting it costs you a stamp and a day. Either way, a message goes out to you as soon as the package has been logged onto our system, and two working days after that the diagnostic is finished.
Unsure which items should go in the box? Call 0800 689 0668 whilst the box is still open, or work through the free online diagnostic and let it guide you.
Withdraw the machine from service, ring the freephone number and allow six separate, independent records to answer the question between them.