Material that leaves through a mailbox or a cloud account gets written down twice — once by the service and once by the machine — and a sound investigation reads both halves before it says anything. Rules, attachment history and sign-in patterns come out of the tenancy. Browser artefacts and sync-client logs come off the endpoint. The two are lined up into a single dated account. For professional firms, agencies and IT departments across Berkshire, Surrey and London.
◇ Footing first, bench afterwards. An investigation with its full written report is £800 + VAT; a verified image with deleted-file extraction and no report written is £400 + VAT, the same point as a recorder disk. The diagnostic is free and the scope goes in writing first. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Ordinary recovery bands are published on the data recovery cost page.
Each of these has an innocent explanation on its own. Together they make a pattern worth examining.
A mailbox being used to move material develops a recognisable manner. Attachments grow while the recipient list narrows to a single private address. A rule appears and starts pushing selected mail outward without anyone touching it, often into a folder nobody checks. The search history stops looking like the day's work and starts looking like hunting — client names, project titles, rate cards, tender numbers. Access drifts into evenings and Sunday afternoons. The platform records all of that as a matter of routine, and each element is retrieved, dated and attributed in the examination rather than described in general terms.
The device supplies the half that people forget about. Browser artefacts show a personal cloud account being created and signed into from company hardware. The OneDrive client keeps its own diagnostic and activity logs under the user profile, recording which folders were set to mirror and from when. Dropbox and Google Drive keep local databases and cache folders that do the same work. The residue of an upload — cached pages, confirmation screens, recent-file lists, thumbnail caches — outlives a cleared browsing history by a long way, and the system resource usage database quietly totals how many bytes each application pushed out and when. A personal sync client that appears on a work machine in somebody's final month is rarely there by accident, and the log will say what it carried.
Microsoft 365 and Google Workspace build a case file whether anyone asks them to or not, and it frequently decides the matter outright. Mail movement, sharing and downloads land in the unified audit log and come out through Purview eDiscovery. Vault holds preserve Gmail and Drive content, while the admin console's Drive log puts an account and a timestamp against every share and every download. SharePoint and OneDrive record bulk retrieval. Dropbox keeps version history and recoverable deletions. The catch sits in the retention: these windows are measured in months rather than years, the exact figure follows the licence the business bought, and none of them pause while a decision is being taken upstairs.
A finding convinces when it arrives from two directions at once. The tenancy shows 2.1 GB pulled down at 21:14. Three minutes later the same file names appear inside a personal sync folder on the laptop. The browser record joins the two ends together. Platform evidence and endpoint evidence go into one sequence, and where the two disagree the disagreement is put in the report rather than tidied out of it, because the expert on the other side is going to find it regardless. Everything captured — mailbox export, audit extract, disk image — is hashed before any account is suspended or any licence reclaimed. The order of those steps is not a detail.
The bench method behind all of it is at the forensic recovery hub. Credentials and server records carry on at insider threat forensics, the employer casework at employee data theft, and holding the material properly at legal hold and chain of custody. Ordinary recovery bands are on the prices page.
Platform records and endpoint artefacts, read against each other rather than reported separately.
Size, recipient and date for everything that went to a private address.
Forwarding and delete rules, the date each was made, and what it caught after that.
Sign-in times and locations, with the out-of-hours clusters marked up.
Private accounts, mirrored folders and upload leftovers sitting on the laptop.
Share, download and export events lifted from the tenancy's own logging.
Individual messages and entire mailboxes brought back from hold or backup.
Start with the part people are least often told: a forensic examination sits outside no fix, no fee. That guarantee belongs to logical recovery work, and the stated exclusions are electronic and mechanical failures, chip-level work, DVR jobs and forensic jobs. An examination is bench time spent answering a question, so it is charged whether the answer helps you or not. What it does have is two published figures, which is two more than most laboratories will put in front of you. An examination that ends in a full written report is £800 + VAT. An examination that stops at the evidence itself — a verified binary image with the deleted material extracted out of it, handed over for somebody else to interpret — is £400 + VAT. That second figure is the same point on the list as a recorder disk or a BitLocker volume, so it adds nothing new to the five bands the rest of the site publishes.
The examination and the full written report that comes out of it, produced so an expert acting against you can follow every step and test it.
The verified binary image with deleted files extracted from it, and no report written. The same figure a recorder disk or an encrypted volume carries, not an extra band.
Both figures assume one machine and one question put to it. Nine laptops, a file server and a tenancy export is a larger exercise, so anything spanning several devices is measured after the free diagnostic and written down before you agree to it. Diagnosis still costs nothing and still closes 2 working days after the device is booked in, and the fee is settled before an examiner opens the image rather than after. Several mailboxes, or a whole tenancy, is a larger scope and gets its own written quotation once the free diagnostic has closed. Everything that is not forensic keeps its published band on the prices page.
Mailbox and cloud instructions run on tenancies and devices the company owns, or on written instruction from a solicitor. Three routes reach this bench and there has never been a fourth. Equipment the business itself bought and issued. A written instruction from a solicitor, an insurer or the court. Or a device that genuinely belongs to the person asking, which in a family matter means one owned outright or owned jointly. Nothing is broken into here. We do not work out somebody else's password, we do not put monitoring software on a device the client does not own, and live traffic is never intercepted — interception belongs to the bodies named in the Investigatory Powers Act 2016 and to nobody else. Where a client has no lawful right to look inside a device, instructing us does not create one. Handsets and tablets fall outside the practice altogether.
Most cloud material is preserved by export rather than by parcel, so ring 0800 689 0668 and we will separate what can be captured remotely from what genuinely has to travel. Hardware reaches Guildford by tracked, insured post, or over the counter there in office hours. No part of this network collects and Bracknell has no counter. Custody is recorded from the moment it arrives.
Is the storage still bolted into a machine — laptop, tower, iMac, MacBook, rack server, a DVR under the till? Free it first and send the bare unit. Stripping hardware is not something this lab does, though it is ten minutes' work for any repair shop on your high street. There is a single case with no way round it: memory chips soldered flat onto the mainboard, which is how Apple Silicon machines and certain ultrabooks are built. Where the storage cannot be unbolted, there is no parcel to make up.
↓ Print the shipping & booking-in form (PDF)
The name on the parcel wants to be Guildford Data Recovery. Driving it over from Bracknell is roughly forty minutes on the A322 then the A3; posting it costs you a stamp and a day. Either way, a message goes out to you as soon as it is logged onto the system, and two working days later the diagnostic is finished.
Unsure whether something should go in the box? Ring 0800 689 0668 while the lid is still open, or work through the free online diagnostic and let it tell you.
Retention runs to the platform's timetable, not to yours — ring the freephone before anything gets purged.