A recovery job is finished when the files come back. A forensic job is finished when somebody paid to disagree with you has read the report and cannot find a hole in it, which may be eighteen months later. So the disk is copied once, hashed as it is copied, and every conclusion is written to be understood by a judge or a tribunal panel rather than by another engineer. The instructions arrive from HR departments on the A329(M) business parks, from software and pharmaceutical offices along the M4 between Reading and Slough, and from solicitors in Bracknell, Camberley, Reading and across the London boroughs.
◇ Footing first, bench afterwards. An investigation with its full written report is £800 + VAT; a verified image with deleted-file extraction and no report written is £400 + VAT, the same point as a recorder disk. The diagnostic is free and the scope goes in writing first. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Ordinary recovery bands are published on the data recovery cost page.
Pulling files off a failing disk is engineering, and plenty of firms can do it. Forensics is the written account of how those files were obtained, produced in a form that survives someone attacking it. Nothing in the order is improvised. A hardware write-blocker goes in first. The disk is captured into E01 evidence files. SHA-256 is taken during the write and checked again afterwards. The exhibit is sealed, labelled and entered in the custody file. Notes are made while each of those steps happens, not typed up at the end of the week. Every question after that is asked of the copy, and each finding is numbered, dated and tied to the artefact it rests on. Take that away and you have a recovery with an invoice attached, which is a different thing.
Reports are written the other way round from the way engineers think. Conclusions come first in plain English, the technical reasoning goes into an appendix, and where the evidence supports two readings the report says so instead of picking the one the client would prefer. That habit comes straight from the rules: in civil proceedings CPR Part 35 and its practice direction require an expert to give the range of opinion where there is one, to set out the substance of the instructions received, and to sign a statement of truth. Employment tribunals run under their own procedure rather than the CPR, and they expect the same independence from anyone offering an opinion.
Three headings organise the ten pages below. Finding out what happened covers the examinations themselves — a deletion, a stick, a mailbox, a whole machine. Preservation and custody covers how the material was kept, which is the first thing an opponent tests and the easiest thing to lose. Insider investigations point both of those at one named dispute and one fixed run of dates.
Four examinations that answer the factual question: what was removed and when, what travelled on removable media, what left through a mailbox or a cloud tenancy, and what a single whole-machine capture holds on to.
Evidence is worth what its handling can be shown to be worth. Once litigation is reasonably anticipated the duty to preserve has already started, which makes imaging, hashing, sealed storage and a legible custody file a discipline in their own right. Locked and wiped machines belong with workstation deep imaging, where BitLocker and FileVault volumes are captured while the keys can still be produced and erase runs are identified and dated.
Here the subject is a person rather than a box: access used where it should not have been, the records a server keeps without being asked, and the four instructions that arrive most weeks.
The page you arrived on decides the subject matter. It does not decide any of this.
A hardware write-blocker sits between the exhibit and the workstation for the whole of the capture, so nothing done at this bench can reach the disk you sent.
The disk becomes an E01 evidence container with its metadata inside it — a format any competent examiner can mount, verify and pull apart without needing us to explain it.
SHA-256 is calculated as the image is written and recalculated at each verification. An image that has been altered fails the comparison and says so in the log.
Contemporaneous notes record what was done, by whom, with which equipment and at what time. Reconstructed notes are the first thing a competent opponent goes after.
Indexing, carving, artefact extraction and timeline work run against the image in OSForensics. Passware is used on protected files only where the client owns the right to the contents.
Seals, signatures and movements are logged from the moment the parcel is booked in at Guildford until the exhibit goes back, and the file is meant to be read by the other side.
Start with the part people are least often told: a forensic examination sits outside no fix, no fee. That guarantee belongs to logical recovery work, and the stated exclusions are electronic and mechanical failures, chip-level work, DVR jobs and forensic jobs. An examination is bench time spent answering a question, so it is charged whether the answer helps you or not. What it does have is two published figures, which is two more than most laboratories will put in front of you. An examination that ends in a full written report is £800 + VAT. An examination that stops at the evidence itself — a verified binary image with the deleted material extracted out of it, handed over for somebody else to interpret — is £400 + VAT. That second figure is the same point on the list as a recorder disk or a BitLocker volume, so it adds nothing new to the five bands the rest of the site publishes.
The examination and the full written report that comes out of it, produced so an expert acting against you can follow every step and test it.
The verified binary image with deleted files extracted from it, and no report written. The same figure a recorder disk or an encrypted volume carries, not an extra band.
Both figures assume one machine and one question put to it. Nine laptops, a file server and a tenancy export is a larger exercise, so anything spanning several devices is measured after the free diagnostic and written down before you agree to it. Diagnosis still costs nothing and still closes 2 working days after the device is booked in, and the fee is settled before an examiner opens the image rather than after. Recorder disks and BitLocker volumes reach £400 + VAT by the ordinary route rather than by being forensic, and DVR jobs carry their own exclusion from the guarantee. Ransomware is not forensic casework and is never charged as though it were: it takes the hardware bands like any other loss, £300 + VAT on a single drive and from £500 + VAT on a server, NAS or array. Everything that is not forensic keeps its published band on the prices page.
Most instructions come from employers, HR teams and solicitors, and a private client is dealt with on identical terms. Three routes reach this bench and there has never been a fourth. Equipment the business itself bought and issued. A written instruction from a solicitor, an insurer or the court. Or a device that genuinely belongs to the person asking, which in a family matter means one owned outright or owned jointly. Nothing is broken into here. We do not work out somebody else's password, we do not put monitoring software on a device the client does not own, and live traffic is never intercepted — interception belongs to the bodies named in the Investigatory Powers Act 2016 and to nobody else. Where a client has no lawful right to look inside a device, instructing us does not create one. Handsets and tablets fall outside the practice altogether.
An exhibit does not travel like an ordinary parcel. Ring 0800 689 0668 before anything is packed and we will fix the packaging, the paperwork and the timing between us. Nothing is collected anywhere in this network and Bracknell has no counter, so it goes by tracked, insured post to Guildford, or over the Guildford counter if you would rather hand it across. Custody opens the moment it is booked in.
Is the storage still bolted into a machine — laptop, tower, iMac, MacBook, rack server, a DVR under the till? Free it first and send the bare unit. Stripping hardware is not something this lab does, though it is ten minutes' work for any repair shop on your high street. There is a single case with no way round it: memory chips soldered flat onto the mainboard, which is how Apple Silicon machines and certain ultrabooks are built. Where the storage cannot be unbolted, there is no parcel to make up.
↓ Print the shipping & booking-in form (PDF)
The name on the parcel wants to be Guildford Data Recovery. Driving it over from Bracknell is roughly forty minutes on the A322 then the A3; posting it costs you a stamp and a day. Either way, a message goes out to you as soon as it is logged onto the system, and two working days later the diagnostic is finished.
Unsure whether something should go in the box? Ring 0800 689 0668 while the lid is still open, or work through the free online diagnostic and let it tell you.
Free diagnosis, a written scope, images that verify. Ring the freephone and we will tell you what a machine can settle and what it never will.