An account manager hands in their notice at a software firm based on one of the A329(M) parks; a buyer leaves a distributor on the Reading side of the M4. Eight weeks later a competitor is working a client list that nobody outside your building could have assembled. The laptop that came back normally knows what took place, and it remembers all of it right up until someone logs in and begins to overwrite the answer with new information. Work here is done on a copy that verifies, and as such the report claims nothing that the copy will not support.
◇ Footing first, bench afterwards. An investigation along with its full written report is £800 + VAT; a verified image with the deleted files extracted and no report written is £400 + VAT, which is the same point as a recorder disk. There is no charge for the diagnostic, and the scope goes into writing first. Forensic work is paid upfront at the time you accept our fixed quote. On other services, in most cases you only pay if we recover your data (electronic and mechanical failures, chip-level work and physical damage are 50% upfront, with the balance only if we recover your data). Standard rates for ordinary recovery bands can be found on the data recovery cost page.
Any one of these on its own is sufficient to take the device out of use and leave it untouched until a copy exists, and that is the same answer whether the firm trades from Bracknell, Wokingham, Slough or south London.
The majority of these cases are decided by restraint, rather than by how much effort goes into them. Each time someone signs into the computer they are writing new information on top of the old. A well-meant look round by the IT team moves precisely the access times that will matter later. A rebuild for the next starter effectively ends the enquiry altogether, and no amount of money can buy that back afterwards. Thus the opening routine is short and unexciting: shut the machine down instead of logging out, label it, write down everyone who has handled it since it came back, and store it somewhere nobody will helpfully open it. After that, the examination is carried out entirely on a copy that verifies, while the hardware stays sealed, which is also what allows an expert instructed by the other side to examine the same machine and form their own view of it.
An operating system is typically a better witness than most people, since it has no motive to shade anything. USBSTOR holds an entry for every stick, card reader and portable drive the machine has met, including maker, product and serial, and modern builds of Windows also add the time each was first connected and last removed. setupapi.dev.log dates the first appearance of each of them. Shortcut files and jump lists tie named company documents to the drive letter and volume serial belonging to the removable volume. Shellbags record the folder structure that somebody browsed while it was mounted. Finally, the change journal records a timestamp for each operation across the weeks at issue. By putting this material in order, a suspicion can be moved into territory where a solicitor can do something with it.
The majority of it now goes out via a browser tab and a sync client. The image turns up webmail sessions attaching files to a private email address, mailbox rules quietly forwarding selected traffic outside the organisation, uploads to file-transfer sites, and a personal sync client mirroring folders on the computer into private storage while its own logs record which folders and from what date. There are two patterns we would like to call by name, as they occur often enough. First, there is mass access: several hundred files opened in directories the role had never gone near, clustered in the few days either side of a resignation. Second, there is printing. The print service log records the document name, the user, the printer and how many pages were printed, and spool remnants left in the spool directory and in unallocated space frequently survive long after the job itself has finished. If the business uses Microsoft 365 or Google Workspace, the tenancy audit records come in too, so the endpoint's account of an afternoon can be compared directly with the platform's account of the same afternoon.
The report is written for a tribunal panel, possibly with a technical assessor sitting beside it. The findings lead, numbered and dated, each tied to the artefact it came from, and the technical reasoning goes into an appendix (and not within the findings), where it belongs. The exhibit schedule has a SHA-256 value against every image on it. If the matter heads for the High Court instead, to seek an interim injunction or a search order aimed at a former employee, the same material would carry the application, simply because it was taken early and written up while it was being taken. Nothing is asserted beyond the record, and there is another important point for employers: an investigation of this kind processes personal data, so it must have a lawful basis and a proportionate scope under the UK GDPR and the Data Protection Act 2018. Agreeing the date range and the categories in advance is not bureaucracy; it is what keeps the findings usable.
How capture and custody work across the practice can be viewed by going to the forensic recovery hub. Plug-in history has a separate page of its own at USB device forensics, routes out through a tenancy are at email and cloud exfiltration, the obligation to preserve is at legal hold and chain of custody, and bands for ordinary recovery are on the prices page.
Each item below is presented as a numbered finding which includes the date and the name of the artefact it rests on, in a document a tribunal panel can work from without a translator.
Captured before it can be issued again, the computer of the person leaving will normally give up the lot.
Every device ever mounted (by maker, product and serial number), with its dates.
Journal entries and destination clocks showing which named file was placed on a device at a stated hour.
Shortcuts and jump lists linking documents to the volume they were opened from.
Webmail sends, mailbox rules and sync-client logs still stored on the machine.
Mass folder access, print runs, late sessions and messages regarding the move.
Capture date against leaving date, with hash values that still verify today.
Let's start with the part people are least often told about: a forensic examination is paid upfront, once you accept the fixed quote. The arrangement where in most cases you only pay if we recover your data belongs to recovery work, and even there electronic and mechanical failures, chip-level work and physical damage are 50% upfront, while DVR, forensic, BitLocker and ransomware work is paid upfront. An examination is bench time spent answering a question, so it is charged whether the findings help you or not. What it does have is two published figures, which is two more than many other laboratories will put in front of you. An examination that ends in a full written report is priced at £800 + VAT. An examination that stops at the evidence itself, a verified binary image with the deleted material extracted out of it and handed over for another party to interpret, is priced at £400 + VAT. That second figure is the same point on the list as a recorder disk or a BitLocker volume, so it adds nothing new to the five bands listed throughout the rest of the site.
The examination itself, together with the full written report that comes out of it, produced so that an expert acting against you can follow each and every step and test it.
The verified binary image with the deleted files extracted from it, and no report written. It is the same figure a recorder disk or an encrypted volume carries, not an additional band.
Both figures are based on a single machine and a single question put to it. An exercise with nine laptops, a file server and a tenancy export is a greater scope of work, so anything which spans several devices is measured after the free diagnostic and written down before you agree to proceed. Diagnosis still costs nothing and still closes 2 working days after the device is booked in, and the fee is settled before an examiner opens the image, not afterwards. Everything other than forensic work keeps its published band on the prices page.
These investigations are carried out on equipment the business bought and issued, with HR standing behind them or a solicitor giving the instruction. There have always been three routes to this bench, and there has never been a fourth. Equipment the business itself bought and issued. A written instruction from a solicitor, an insurer or the court. Or a device that genuinely belongs to the person asking, which in a family matter means one owned outright or owned jointly. Nothing is broken into here. We do not work out somebody else's password, we do not install monitoring software onto a device the client does not own, and we never intercept live traffic: interception can only be carried out by the bodies named in the Investigatory Powers Act 2016 and nobody else. When a client has no lawful right to look inside a device, instructing us will not give them one. Handsets and tablets are entirely outside the practice.
Once a machine has become an exhibit, the conditions of its travel are fixed beforehand, so please call us first on 0800 689 0668 for a quote, and we will settle the packaging and paperwork before the box is closed. We only need the drive; the whole machine does not need to be sent. Nobody in this network collects and there is no Bracknell counter, so it reaches Guildford either by tracked, insured post or by being handed in over the counter at the Guildford lab, Monday to Friday, 9am to 5:30pm, without needing an appointment. The custody record is opened when it is booked in.
Is the hard drive still bolted into a machine, whether that is a laptop, a tower, an iMac, a MacBook, a rack server or a DVR stored under the till? Get a quote first, then pull the drive out of the machine and send only the bare drive (never the entire machine): from a server the disks come out labelled by bay, and from a DVR you just send the disk. Stripping hardware is not something our lab does, though any repair shop on your high street can do it in about ten minutes. The one case with no way round it is memory chips soldered flat onto the mainboard, which is how T2 and Apple Silicon Macs and certain ultrabooks are built, and that storage is not taken on. Call us first if you're not sure which kind you have. Where the storage cannot be unbolted, there is no parcel to make up.
↓ Print the shipping & booking-in form (PDF)
With your quote in hand, the name on the parcel wants to be Guildford Data Recovery. Driving it over from Bracknell takes roughly forty minutes along the A322 followed by the A3, and you do not need an appointment; posting it costs you a stamp and a day. Either way, a message goes out to you as soon as the package has been logged onto our system, and two working days after that the diagnostic is finished.
Unsure which items should go in the box? Call 0800 689 0668 whilst the box is still open, or work through the free online diagnostic and let it guide you.
Turn off the computer, call the freephone, and let a copy that verifies speak on your behalf.