Deletion disputes turn on two things: what the file was, and how it came to leave. A Windows volume normally keeps enough to answer both, and the second answer is often the one that matters. The bin index, the change journal, the shadow copies and the security log each describe the same afternoon from a different angle, and putting them side by side is what produces a timeline rather than an assertion. Instructed by employers, solicitors and private clients throughout Berkshire, Surrey and the London boroughs.
◇ Footing first, bench afterwards. An investigation with its full written report is £800 + VAT; a verified image with deleted-file extraction and no report written is £400 + VAT, the same point as a recorder disk. The diagnostic is free and the scope goes in writing first. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Ordinary recovery bands are published on the data recovery cost page.
Anything where the hour of a deletion counts for as much as the contents of the file belongs on this page.
Sending a file to the recycle bin creates a small companion record holding the original path, the size and the moment it was moved, and that record habitually outlives the bin being emptied. A shift-delete skips the bin entirely, but all that is surrendered is the index entry: the contents sit where they were until the space is reused. A file overwritten in place is a different animal again. Working out which grade applied, and at what hour, is normally the first job of the examination, and the answer frequently speaks to intention before anybody looks at what the file contained.
A timeline is recorded events put in order, and it is only worth having when the sources corroborate each other. The master file table carries created, modified and accessed times for live and deleted entries alike. The change journal logs operations one at a time as they occur — created, renamed, deleted, extended. The transaction log fills in the minutes around an event in finer detail. Security event logs supply the account that was signed in, the type of logon and what it had touched beforehand. Where those four agree, an hour can be stated with confidence. Where they disagree, the report says which one it prefers and why.
A Windows machine quietly keeps several versions of its own past. Shadow copies, written for restore points and by backup software, freeze earlier states of the volume — files that were deleted afterwards, drafts from before an edit, folder listings from a fortnight ago. Set one against the live disk and whatever went missing between the two dates falls out of a single comparison. It is the cleanest exhibit this kind of case can have: there on the 3rd, absent on the 10th, with the journal placing the removal on the Wednesday in between. Backup sets, Previous Versions and the bin on a mapped network drive do the same job where they exist.
Wiping software is not subtle. The search begins with the residue such tools leave: installation and uninstall entries, prefetch records naming the executable and holding up to eight of its run times, the regular pattern that an overwrite lays down across a surface, and the suspicious absence of artefacts that any working machine ought to have. A wipe destroys material and creates evidence in one movement, since the tool, the hour, the account behind it and everything beyond its reach all survive. Runs that were interrupted or aimed at the wrong volume turn up frequently; whatever such a run failed to touch is recovered normally and described as what it is.
Solid-state drives are the honest exception. Where TRIM is active and the volume is not encrypted, the controller can discard the contents of a deleted file within minutes and no software recovers what the flash has already erased — the metadata trail usually survives, so the fact and the hour of the deletion can still be evidenced even when the file cannot be produced. On a spinning disk that has stayed in daily use, unallocated space is consumed week by week. And a file that has been genuinely overwritten is gone, whatever anybody promises. You are told which of those you are in before the quotation is written, not afterwards.
The imaging and custody discipline underneath this page is set out at the forensic recovery hub. Deletions involving sticks and cards carry on at USB device forensics, whole-machine capture at workstation deep imaging, and the non-forensic version of this job — files deleted with nobody in dispute — is ordinary recovery work at the bands on the prices page.
No single artefact is trusted on its own. The hour is stated where the six agree, and the disagreement is reported where they do not.
Path, size and time of the move, readable long after the bin itself was emptied.
Creation, modification and access values, for live and deleted entries alike.
Every create, rename, delete and extend, logged as it happened, one line each.
The account signed in around each event, and the type of logon it used.
Frozen earlier states of the volume, still carrying what the live disk has lost.
Tool name, run times, the account that launched it, and everything it left behind.
Start with the part people are least often told: a forensic examination sits outside no fix, no fee. That guarantee belongs to logical recovery work, and the stated exclusions are electronic and mechanical failures, chip-level work, DVR jobs and forensic jobs. An examination is bench time spent answering a question, so it is charged whether the answer helps you or not. What it does have is two published figures, which is two more than most laboratories will put in front of you. An examination that ends in a full written report is £800 + VAT. An examination that stops at the evidence itself — a verified binary image with the deleted material extracted out of it, handed over for somebody else to interpret — is £400 + VAT. That second figure is the same point on the list as a recorder disk or a BitLocker volume, so it adds nothing new to the five bands the rest of the site publishes.
The examination and the full written report that comes out of it, produced so an expert acting against you can follow every step and test it.
The verified binary image with deleted files extracted from it, and no report written. The same figure a recorder disk or an encrypted volume carries, not an extra band.
Both figures assume one machine and one question put to it. Nine laptops, a file server and a tenancy export is a larger exercise, so anything spanning several devices is measured after the free diagnostic and written down before you agree to it. Diagnosis still costs nothing and still closes 2 working days after the device is booked in, and the fee is settled before an examiner opens the image rather than after. Everything that is not forensic keeps its published band on the prices page.
Deletion work is done on company machines, on hardware you own yourself, or on written instruction from a solicitor. Three routes reach this bench and there has never been a fourth. Equipment the business itself bought and issued. A written instruction from a solicitor, an insurer or the court. Or a device that genuinely belongs to the person asking, which in a family matter means one owned outright or owned jointly. Nothing is broken into here. We do not work out somebody else's password, we do not put monitoring software on a device the client does not own, and live traffic is never intercepted — interception belongs to the bodies named in the Investigatory Powers Act 2016 and to nobody else. Where a client has no lawful right to look inside a device, instructing us does not create one. Handsets and tablets fall outside the practice altogether.
Ordinary use costs a deletion case something every day it continues, so take the machine out of service before you ring 0800 689 0668 rather than after. There is no collection anywhere in this network and no Bracknell counter: send the drive to Guildford by tracked, insured post, or hand it in at the Guildford counter during office hours. Custody starts at booking-in.
Is the storage still bolted into a machine — laptop, tower, iMac, MacBook, rack server, a DVR under the till? Free it first and send the bare unit. Stripping hardware is not something this lab does, though it is ten minutes' work for any repair shop on your high street. There is a single case with no way round it: memory chips soldered flat onto the mainboard, which is how Apple Silicon machines and certain ultrabooks are built. Where the storage cannot be unbolted, there is no parcel to make up.
↓ Print the shipping & booking-in form (PDF)
The name on the parcel wants to be Guildford Data Recovery. Driving it over from Bracknell is roughly forty minutes on the A322 then the A3; posting it costs you a stamp and a day. Either way, a message goes out to you as soon as it is logged onto the system, and two working days later the diagnostic is finished.
Unsure whether something should go in the box? Ring 0800 689 0668 while the lid is still open, or work through the free online diagnostic and let it tell you.
Withdraw the machine, ring the freephone, and let six independent records answer the question between them.