No one who does serious harm to a company from the inside announces that they are doing so. A login carries on working long after the leaving date. An export runs quietly on a Tuesday afternoon. A large archive gets assembled the evening before the resignation letter arrives. The entire investigation is built from records that the business was already creating anyway, on endpoints, on servers and on the network, and it reports only what those records will actually support, tied to named accounts, sessions and hours. We are instructed by software houses, logistics operators and professional firms based throughout Berkshire, Surrey and London.
◇ Footing first, bench afterwards. An investigation along with its full written report is £800 + VAT; a verified image with the deleted files extracted and no report written is £400 + VAT, which is the same point as a recorder disk. There is no charge for the diagnostic, and the scope goes into writing first. Forensic work is paid upfront at the time you accept our fixed quote. On other services, in most cases you only pay if we recover your data (electronic and mechanical failures, chip-level work and physical damage are 50% upfront, with the balance only if we recover your data). Standard rates for ordinary recovery bands can be found on the data recovery cost page.
Each of these is the point at which an uneasy feeling becomes clear enough to turn into a written instruction.
Access outlives employment far more often than boards expect. When a user profile is copied, its cached credentials and the password manager store go along with it. The keys and tokens taken in the last week before leaving carry on functioning as usual until someone remembers to revoke them. A colleague's password, seen once over a shoulder while they were logging in, works perfectly well from a kitchen table in Camberley. Using any of that after the employment has finished is unauthorised access under the Computer Misuse Act 1990. Therefore the work runs in two stages: first identify which credentials left the building, then read the authentication records against the endpoint artefacts until every system they reached has been listed with hours and source addresses beside it. The entries that fall after the leaving date are usually the ones that settle the matter.
Endpoints are usually the smaller half of these cases. Query history shows bulk extraction: a single statement that lifted the customer table, timed and tied to an account. Backups and snapshots compared with one another date the point when records were altered or deleted. File-server auditing discloses which shares were opened and by whom, and where that pattern departed from habit; wholesale access across directories that a role had no business in is one of the most reliable indicators available. Print service logging and the spool remnants left behind show protected material reaching paper, with the document name, the user and the page count. Firewall and proxy records show sustained transfers to destinations that no process accounts for. Server evidence also decays faster than anything else, as log rotation runs to a timetable measured in weeks, so it goes at the head of the preservation list rather than trailing behind it.
Judges and tribunal panels distinguish carelessness from planning, so the examination collects whatever bears on that distinction and leaves the conclusion wherever it lands. Messages about the move or the material, held in the Teams and Slack caches on the endpoint. Archives built during a final week, whose file listings can frequently be recovered even where the archive body itself cannot. Recruitment sites and a rival's product pages threaded through the browsing history. Document metadata whose "last saved by" field puts a named account on a named file at a named minute. None of these settles anything on its own, and the report says as much. Laid out in sequence across a fortnight, they usually do.
A personal laptop used on the office network sits right on a legal boundary, and we stay on the lawful side of that line without exception. The records the infrastructure kept belong to the company and are fair evidence: association times, hardware identifiers, the amount of traffic carried and the destinations reached. There is no access to the device itself without the owner's agreement, a protocol agreed between solicitors, or a direction from the court. Live traffic is never intercepted here, under any circumstances, as interception is reserved to the bodies named in the Investigatory Powers Act 2016. The report uses only what the network lawfully shows, and it describes those limits in exact terms, which is the very reason the report stays standing when someone sets about attacking it.
The capture discipline that sits underneath all of the above is discussed in detail at the forensic recovery hub. Exits via a tenancy are covered at email and cloud exfiltration, taking an endpoint properly at workstation deep imaging, and the trade-secret version of the same story at trade secret and IP theft. When, however, the incident turns out to have come from outside the organisation instead, that is part of ransomware recovery.
Each one is pinned to an account, given an hour and traced back to the record it came from.
The keys, tokens and saved passwords that were removed from the estate, and when they were removed.
All the systems those credentials touched, including the hours and the originating addresses.
Bulk exports of data out of databases and shares, along with the query record behind them.
Directories opened well outside the normal role, clustered around the date of a resignation.
Archived items, messages, print runs and browsing activity that point to intent.
The lawful information about a personal device that can be obtained through the company network, and the point at which that stops.
Let's start with the part people are least often told about: a forensic examination is paid upfront, once you accept the fixed quote. The arrangement where in most cases you only pay if we recover your data belongs to recovery work, and even there electronic and mechanical failures, chip-level work and physical damage are 50% upfront, while DVR, forensic, BitLocker and ransomware work is paid upfront. An examination is bench time spent answering a question, so it is charged whether the findings help you or not. What it does have is two published figures, which is two more than many other laboratories will put in front of you. An examination that ends in a full written report is priced at £800 + VAT. An examination that stops at the evidence itself, a verified binary image with the deleted material extracted out of it and handed over for another party to interpret, is priced at £400 + VAT. That second figure is the same point on the list as a recorder disk or a BitLocker volume, so it adds nothing new to the five bands listed throughout the rest of the site.
The examination itself, together with the full written report that comes out of it, produced so that an expert acting against you can follow each and every step and test it.
The verified binary image with the deleted files extracted from it, and no report written. It is the same figure a recorder disk or an encrypted volume carries, not an additional band.
Both figures are based on just one machine and one question put to it. So, if you are looking at nine laptops plus a file server plus a tenancy export, then that's a much bigger job, and therefore anything which involves more than one device is measured after the free diagnostic has been completed and written down before you agree to it. As before, diagnosis is completely free of charge and still closes 2 working days after the device has been booked in, and forensic work is paid upfront once you accept the fixed quote, before the examiner opens the image rather than after. Several servers, or indeed an entire log estate, would be considered a larger scope and would receive its own written quotation once the free diagnostic has closed. Everything that is not forensic keeps its published band on the prices page.
This work is limited to the systems and records the company itself owns, under HR authority or a solicitor's written instruction. Three routes have always reached this bench; there has never been a fourth. Equipment that the business itself bought and issued. A written instruction from a solicitor, an insurer or the court. Or a device that genuinely belongs to the person asking, which in a family matter means one owned outright or owned jointly. Nothing is broken into here. We will not work out another person's password, nor will we install monitoring software onto a device the client does not own, and live traffic is never intercepted: interception is reserved exclusively for the bodies named in the Investigatory Powers Act 2016 and for nobody else. Where a client has no lawful right to look inside a device, instructing us will not give them one. Handsets and tablets fall completely outside the practice.
These instructions generally start with a telephone call rather than a box. Ring 0800 689 0668 for a quote first, tell us everything that is in front of you, and you will leave the call knowing which items need preserving before the logs rotate tonight. Should hardware need to travel, we only need the drives, not the machines. The drives reach Guildford by tracked, insured post or a courier you book yourself, or they can be dropped off over the counter at the Guildford lab, Monday to Friday, 9am to 5:30pm, without making an appointment. Nobody in this network collects, and there is no counter at Bracknell. Every item is signed into custody as it arrives.
Is the hard drive still bolted into a machine, whether that is a laptop, a tower, an iMac, a MacBook, a rack server or a DVR stored under the till? Get a quote first, then pull the drive out of the machine and send only the bare drive (never the entire machine): from a server the disks come out labelled by bay, and from a DVR you just send the disk. Stripping hardware is not something our lab does, though any repair shop on your high street can do it in about ten minutes. The one case with no way round it is memory chips soldered flat onto the mainboard, which is how T2 and Apple Silicon Macs and certain ultrabooks are built, and that storage is not taken on. Call us first if you're not sure which kind you have. Where the storage cannot be unbolted, there is no parcel to make up.
↓ Print the shipping & booking-in form (PDF)
With your quote in hand, the name on the parcel wants to be Guildford Data Recovery. Driving it over from Bracknell takes roughly forty minutes along the A322 followed by the A3, and you do not need an appointment; posting it costs you a stamp and a day. Either way, a message goes out to you as soon as the package has been logged onto our system, and two working days after that the diagnostic is finished.
Unsure which items should go in the box? Call 0800 689 0668 whilst the box is still open, or work through the free online diagnostic and let it guide you.
Get the logs saved before rotation reaches them. Call the freephone and you will be put through to an examiner rather than a queue.