When material leaves through a mailbox or an online account, it is recorded twice, by the online service and by the device, so a sound investigation has to read both sides of the record before it says anything. Rules, histories of attachments and sign-in patterns are extracted from the tenancy. Browser artefacts and sync-client logs are retrieved from the endpoint. Both types of information are then lined up into one dated account. This is for professional firms, agencies and IT departments throughout Berkshire, Surrey and London.
◇ Footing first, bench afterwards. An investigation along with its full written report is £800 + VAT; a verified image with the deleted files extracted and no report written is £400 + VAT, which is the same point as a recorder disk. There is no charge for the diagnostic, and the scope goes into writing first. Forensic work is paid upfront at the time you accept our fixed quote. On other services, in most cases you only pay if we recover your data (electronic and mechanical failures, chip-level work and physical damage are 50% upfront, with the balance only if we recover your data). Standard rates for ordinary recovery bands can be found on the data recovery cost page.
In isolation each of these may have an innocent reason for being there. However, together they create a pattern worth examining.
A mailbox being used to move material becomes recognisable in its way of operating. Attachments grow; however, the recipient list begins to narrow down to a single private address. A rule appears and starts moving selected emails outward without anyone touching it, and the place these emails go is often a folder which nobody checks. The search history stops looking like someone getting through the day's work and starts to look like the person was hunting: client names, project titles, rate cards, tender numbers. The mailbox is accessed in the evenings or on Sunday afternoons. All of those things are recorded by the platform routinely; therefore, each item is retrieved, dated and attributed during the examination instead of being described in general terms.
The device provides the other half that people usually forget about. There are browser artefacts showing a personal cloud account being created and signed into on company hardware. The OneDrive client keeps its own diagnostic and activity logs under the user profile, documenting which folders were set to mirror and since when. Dropbox and Google Drive also have local databases and cache folders doing this same type of work. The residue of an upload (cached pages, confirmation screens, recent-file lists, thumbnail caches) lives far longer than a cleared browsing history, and the system resource usage database quietly records how many bytes each application sent out and at what time. A personal sync client that has appeared on a work machine during someone's last month will rarely be there by mistake, and the log will tell you what it was carrying.
Microsoft 365 and Google Workspace both create a case file automatically, whether anyone asks them to or not, and it often decides the matter outright. Mail movement, sharing and downloads are recorded in the unified audit log and can then be brought out through Purview eDiscovery. Gmail and Drive content is preserved by Vault holds, and every time an item is shared or downloaded from Drive, the admin console's Drive log records which account did it and when. Bulk retrieval is recorded for SharePoint and OneDrive. Dropbox keeps a version history and recoverable deletions. The catch, however, is that retention periods are measured in months rather than years, the exact figure depends on the licence the business bought, and none of them pause while a decision is being taken upstairs.
A finding is far stronger when it comes from two directions at once. The tenancy shows 2.1 GB downloaded at 21:14. Three minutes later the same file names show up in a personal sync folder on the laptop. The browser record ties these two events together. Platform evidence and endpoint evidence go into one sequence, and where the two disagree, the disagreement is put in the report rather than tidied out of it, because the expert on the other side is going to find it anyway. Everything that has been collected (this includes mailbox exports, audit extracts and disk images) is hashed before any account is suspended or any licence reclaimed. The order of those steps is not a detail, and it is not something we can compromise on.
The bench method behind all of it is set out at our forensic recovery hub. Credentials and server records continue at insider threat forensics, the employer casework at employee data theft, and holding materials properly at legal hold and chain of custody. Our ordinary recovery bands are listed on the prices page.
Platform records and endpoint artefacts compared with one another instead of being reported separately.
Size, recipient and date for everything that went to a private address.
Forwarding and delete rules, the date each was made, and what was caught afterwards by each.
Sign-in times and locations, with clusters marked up where out-of-hours access occurred.
Private accounts, mirrored folders and upload leftovers sitting on the laptop.
Share, download and export events lifted from the tenancy's own logging.
Individual messages and entire mailboxes brought back from hold or backup.
Let's start with the part people are least often told about: a forensic examination is paid upfront, once you accept the fixed quote. The arrangement where in most cases you only pay if we recover your data belongs to recovery work, and even there electronic and mechanical failures, chip-level work and physical damage are 50% upfront, while DVR, forensic, BitLocker and ransomware work is paid upfront. An examination is bench time spent answering a question, so it is charged whether the findings help you or not. What it does have is two published figures, which is two more than many other laboratories will put in front of you. An examination that ends in a full written report is priced at £800 + VAT. An examination that stops at the evidence itself, a verified binary image with the deleted material extracted out of it and handed over for another party to interpret, is priced at £400 + VAT. That second figure is the same point on the list as a recorder disk or a BitLocker volume, so it adds nothing new to the five bands listed throughout the rest of the site.
The examination itself, together with the full written report that comes out of it, produced so that an expert acting against you can follow each and every step and test it.
The verified binary image with the deleted files extracted from it, and no report written. It is the same figure a recorder disk or an encrypted volume carries, not an additional band.
Both figures are based on one machine and one question to be answered from it. Nine laptops, a file server and a tenancy export is a larger exercise, so anything involving several devices will be measured after the free diagnostic, with the price written down before you agree to it. The diagnostic still costs nothing and still closes 2 working days after you book the device in, and forensic work is paid upfront once you accept the fixed quote, before the examiner opens the image rather than after. If several mailboxes, or a whole tenancy, need to be examined, that is a larger scope and a separate written quote will be provided once the free diagnostic has closed. All non-forensic services keep their published bands on the prices page.
Mailbox and cloud instructions are carried out on tenancies and devices the company owns, or on written instruction from a solicitor. There have always been three routes to this bench, and never a fourth. Hardware the business itself bought and issued. A written instruction from a solicitor, an insurer or the court. Or a device that genuinely belongs to the person asking, which in a family matter means one owned outright or owned jointly. We do not break into anything here. We will not work out someone else's password, we will not put monitoring software onto a device the client does not own, and we never intercept live traffic: interception belongs to the bodies named in the Investigatory Powers Act 2016 and to nobody else. If a client has no lawful right to look inside a device, instructing us does not give them one. Handsets and tablets are completely outside the practice.
Cloud material is mostly preserved by export rather than sent as a parcel, so please ring us on 0800 689 0668 for a quote first, and we will work out what can be captured remotely and what genuinely has to be sent to the lab. We only need the drives, not the machines, and they can be posted to us by tracked, insured post or a courier you book yourself, or taken over the counter at the Guildford lab, Monday to Friday, 9am to 5:30pm, without an appointment being necessary. There is no collection anywhere in this network and there is no counter in Bracknell. Custody is recorded from the moment they arrive.
Is the hard drive still bolted into a machine, whether that is a laptop, a tower, an iMac, a MacBook, a rack server or a DVR stored under the till? Get a quote first, then pull the drive out of the machine and send only the bare drive (never the entire machine): from a server the disks come out labelled by bay, and from a DVR you just send the disk. Stripping hardware is not something our lab does, though any repair shop on your high street can do it in about ten minutes. The one case with no way round it is memory chips soldered flat onto the mainboard, which is how T2 and Apple Silicon Macs and certain ultrabooks are built, and that storage is not taken on. Call us first if you're not sure which kind you have. Where the storage cannot be unbolted, there is no parcel to make up.
↓ Print the shipping & booking-in form (PDF)
With your quote in hand, the name on the parcel wants to be Guildford Data Recovery. Driving it over from Bracknell takes roughly forty minutes along the A322 followed by the A3, and you do not need an appointment; posting it costs you a stamp and a day. Either way, a message goes out to you as soon as the package has been logged onto our system, and two working days after that the diagnostic is finished.
Unsure which items should go in the box? Call 0800 689 0668 whilst the box is still open, or work through the free online diagnostic and let it guide you.
Retention runs by the platform's timetable, not yours, so call our freephone before anything gets purged.