An account manager hands in notice at a software firm on one of the A329(M) parks; a buyer leaves a distributor on the Reading side of the M4. Eight weeks later a competitor is working a client list that nobody outside your building could have assembled. The laptop that came back usually knows what happened, and it knows it right up until the first person logs in and starts writing over the answer. Work here runs on a copy that verifies, and the report claims nothing the copy will not support.
◇ Footing first, bench afterwards. An investigation with its full written report is £800 + VAT; a verified image with deleted-file extraction and no report written is £400 + VAT, the same point as a recorder disk. The diagnostic is free and the scope goes in writing first. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Ordinary recovery bands are published on the data recovery cost page.
One of these on its own is enough to take the device out of circulation and leave it untouched until a copy exists — the same answer whether the firm trades from Bracknell, Wokingham, Slough or south London.
Restraint decides more of these cases than effort does. Every sign-in writes fresh data over the old. A well-meant look round by the IT team moves precisely the access times that will matter later. A rebuild for the next starter ends the enquiry outright, and no amount of money afterwards buys it back. So the opening routine is short and unexciting: shut the machine down rather than logging out of it, label it, write down everyone who has touched it since it came back, and put it somewhere nobody will helpfully open it. The examination then runs entirely against a copy that verifies, while the hardware stays sealed — which is also what allows an expert instructed by the other side to look at the same machine and form their own view of it.
An operating system makes a better witness than most people, because it has no reason to shade anything. USBSTOR carries an entry for every stick, card reader and portable drive the machine has met, with maker, product and serial, and modern builds add first-connected and last-removed times to each. setupapi.dev.log dates the first appearance of each of them. Shortcut files and jump lists tie named company documents to the drive letter and volume serial belonging to the removable volume. Shellbags keep the folder structure somebody browsed while it was mounted. The change journal stamps a time on each operation across the weeks at issue. Put in order, that material moves a suspicion into territory where a solicitor can do something with it.
These days most of it leaves through a browser tab and a sync client. The image turns up webmail sessions attaching files to a private address, mailbox rules quietly pushing selected traffic outward, uploads to file-transfer sites, and a personal sync client mirroring folders into private storage while its own logs record which folders and from what date. Two patterns are worth naming because they recur constantly. The first is mass access: several hundred files opened across directories the role had never gone near, clustered in the days either side of a resignation. The second is printing. The print service log records document name, user, printer and page count, and spool remnants left in the spool directory and in unallocated space frequently survive long after the job itself completed. Where the business runs Microsoft 365 or Google Workspace, the tenancy audit records come in too, so the platform's account of an afternoon can be set beside the endpoint's account of the same afternoon.
The intended reader is a tribunal panel, possibly with a technical assessor sitting beside it. Findings lead, numbered and dated, each tied to the artefact it came from, and the technical reasoning goes into an appendix where it belongs. The exhibit schedule carries a SHA-256 value against every image on it. Should the matter head for the High Court instead — an interim injunction, or a search order aimed at a former employee — the same material carries the application, and it does so precisely because it was taken early and written up while it was being taken. Nothing is asserted beyond the record, and one further point is worth making to any employer: an investigation of this kind processes personal data, so it needs a lawful basis and a proportionate scope under the UK GDPR and the Data Protection Act 2018. Agreeing the date range and the categories in advance is not bureaucracy. It is what keeps the findings usable.
How capture and custody work across the practice is set out at the forensic recovery hub. Plug-in history has a page of its own at USB device forensics, routes out through a tenancy at email and cloud exfiltration, and the obligation to preserve at legal hold and chain of custody. Bands for ordinary recovery are on the prices page.
Each item below arrives as a numbered finding with a date on it and the artefact it rests on named beside it, in a document a tribunal panel can work from without a translator.
Captured before it is reissued, a leaver's computer will normally surrender the lot.
Every device ever mounted, by maker, product and serial, with its dates.
Journal entries and destination clocks placing named files on a device at a stated hour.
Shortcuts and jump lists binding documents to the volume they were opened from.
Webmail sends, mailbox rules and sync-client logs still sitting on the machine.
Mass folder access, print runs, late sessions and messages about the move.
Capture date against leaving date, with hash values that still verify today.
Start with the part people are least often told: a forensic examination sits outside no fix, no fee. That guarantee belongs to logical recovery work, and the stated exclusions are electronic and mechanical failures, chip-level work, DVR jobs and forensic jobs. An examination is bench time spent answering a question, so it is charged whether the answer helps you or not. What it does have is two published figures, which is two more than most laboratories will put in front of you. An examination that ends in a full written report is £800 + VAT. An examination that stops at the evidence itself — a verified binary image with the deleted material extracted out of it, handed over for somebody else to interpret — is £400 + VAT. That second figure is the same point on the list as a recorder disk or a BitLocker volume, so it adds nothing new to the five bands the rest of the site publishes.
The examination and the full written report that comes out of it, produced so an expert acting against you can follow every step and test it.
The verified binary image with deleted files extracted from it, and no report written. The same figure a recorder disk or an encrypted volume carries, not an extra band.
Both figures assume one machine and one question put to it. Nine laptops, a file server and a tenancy export is a larger exercise, so anything spanning several devices is measured after the free diagnostic and written down before you agree to it. Diagnosis still costs nothing and still closes 2 working days after the device is booked in, and the fee is settled before an examiner opens the image rather than after. Everything that is not forensic keeps its published band on the prices page.
These investigations run on equipment the business bought and issued, with HR standing behind them or a solicitor giving the instruction. Three routes reach this bench and there has never been a fourth. Equipment the business itself bought and issued. A written instruction from a solicitor, an insurer or the court. Or a device that genuinely belongs to the person asking, which in a family matter means one owned outright or owned jointly. Nothing is broken into here. We do not work out somebody else's password, we do not put monitoring software on a device the client does not own, and live traffic is never intercepted — interception belongs to the bodies named in the Investigatory Powers Act 2016 and to nobody else. Where a client has no lawful right to look inside a device, instructing us does not create one. Handsets and tablets fall outside the practice altogether.
The moment a machine becomes an exhibit it travels on terms fixed beforehand, so ring 0800 689 0668 and we will settle packaging and paperwork before the box is closed. There is no collection anywhere in this network and no Bracknell counter, so it reaches Guildford by tracked, insured post or comes in over the counter there in office hours. The custody record opens at booking-in.
Is the storage still bolted into a machine — laptop, tower, iMac, MacBook, rack server, a DVR under the till? Free it first and send the bare unit. Stripping hardware is not something this lab does, though it is ten minutes' work for any repair shop on your high street. There is a single case with no way round it: memory chips soldered flat onto the mainboard, which is how Apple Silicon machines and certain ultrabooks are built. Where the storage cannot be unbolted, there is no parcel to make up.
↓ Print the shipping & booking-in form (PDF)
The name on the parcel wants to be Guildford Data Recovery. Driving it over from Bracknell is roughly forty minutes on the A322 then the A3; posting it costs you a stamp and a day. Either way, a message goes out to you as soon as it is logged onto the system, and two working days later the diagnostic is finished.
Unsure whether something should go in the box? Ring 0800 689 0668 while the lid is still open, or work through the free online diagnostic and let it tell you.
Shut it down, ring the freephone, and let a copy that verifies do the talking on your behalf.