Litigation can redefine what a laptop represents. From the time that proceedings become reasonably likely, a piece of equipment or an account no longer represents an IT asset but instead could potentially represent evidence, and from that point forward the way it is handled will be scrutinised with the same level of scrutiny as the information contained within it. For solicitors working throughout Berkshire, Surrey and the various London boroughs, and for the businesses they act for, this page is about putting preservation on a documented footing that is designed to stand up to being picked over.
◇ Footing first, bench afterwards. An investigation along with its full written report is £800 + VAT; a verified image with the deleted files extracted and no report written is £400 + VAT, which is the same point as a recorder disk. There is no charge for the diagnostic, and the scope goes into writing first. Forensic work is paid upfront at the time you accept our fixed quote. On other services, in most cases you only pay if we recover your data (electronic and mechanical failures, chip-level work and physical damage are 50% upfront, with the balance only if we recover your data). Standard rates for ordinary recovery bands can be found on the data recovery cost page.
It is least expensive to arrange preservation at exactly the point when making arrangements to do so may still appear too early.
It also doesn't start the moment a claim form is received. As set out in Practice Direction 57AD, which governs disclosure within the Business and Property Courts, the obligation to preserve documents arises as soon as a party knows that it may become a party to proceedings which may be commenced, in other words when there is reason to anticipate litigation. The obligation has certain specific duties associated with it: send a written notice to relevant employees and former employees advising them to preserve documents; suspend routine deletion, including any automatic overwriting processes that would destroy relevant material; and take reasonable steps regarding documents held by third parties on your behalf. Outside of the Business and Property Courts the mechanics for fulfilling this obligation differ, but the reasoning behind it remains the same. If a court finds that relevant material was destroyed after the duty to preserve arose, it is entitled to draw its own conclusions as to why, and it frequently does.
Devices and accounts in scope are individually listed rather than described in general terms, and each capture gets a log entry recording when it was taken, who took it and what equipment was used. The hash values go into the record at the same time the image is written, so that if anything is altered later it will show up as a failed verification rather than as a surprise halfway through cross-examination. All notes are taken contemporaneously, while the work is happening. Once captured, the originals are placed in sealed evidence storage, and any movements thereafter (bench to safe, safe to court and back again) are documented, with no gaps in the sequence. Continuity is the first thing a competent opponent will probe, so making it tediously complete is the whole point.
Most of the evidence lost during legal disputes is lost innocently, instead of deliberately. A laptop gets handed to a new starter. A mailbox gets deleted as part of routine housekeeping. A technician has a well-meant look through it over a lunch hour. A director throws away an old disk from a cupboard because it is in the way. Once proceedings are in prospect, continued use is where the real risk lies. It writes over things. It changes dates about. And it gives the other side an easy suggestion that whatever went missing was the inconvenient part. The advice is boring and it works. Book the capture for the same day the equipment comes back, not after a month in a drawer, and do not issue the machine again until its image has verified. Turn off the retention policies that would otherwise delete on schedule. Write down every step as you take it.
Preserved material will have to be produced eventually, so it is shaped to meet that objective from the outset. Findings come first and are expressed in plain English, with the reasoning behind them set out in an appendix that an opposing expert can work through independently without assistance. On the exhibit schedule each image is tied to its hash values, its custody history and the device it came from. In a civil claim, Part 35 and its practice direction determine what the report has to do: the duty to the court at rule 35.3, the substance of the instructions set out on the face of it, the range of opinion wherever a range exists, and a statement of truth at the end. If the appointment is as single joint expert under rule 35.7, or if the parties have agreed their own directions, then those terms apply instead, and the custody file is identical regardless of who paid the invoice.
The bench discipline supporting all of the above is described at the forensic recovery hub. Creating the image is workstation deep imaging, the dispute a hold most often protects is employee data theft, and retention within a tenancy is outlined at email and cloud exfiltration. Price bands for ordinary recovery are on the prices page.
Published by ACPO for UK policing and now maintained under the NPCC, these four principles are what an opposing expert will use to test your evidence against. They are short enough to quote and awkward enough to fail.
The Forensic Science Regulator's Code of Practice was made statutory in October 2023 and applies to forensic science activities carried out for the criminal justice system in England and Wales. Most of the instructions on these pages relate to civil or employment matters and therefore fall outside the scope of the Code. The handling is built to the Code anyway, as it represents the standard that is already understood by courts.
The other side is welcome to read every line of it, because that is what keeping it is all about.
Each device and account within the hold, documented individually and dated.
Time, examiner and equipment used, documented for each image as it was taken.
Acquisition values and the values from each verification since, along with the results from those verifications.
All actions taken and the reasons behind them, documented at the time they were made rather than reconstructed after.
Sealed evidence storage, where every movement into or out of storage is entered against a date.
Prepared for disclosure, binding each image to both the source device it was taken from and its hashes.
Let's start with the part people are least often told about: a forensic examination is paid upfront, once you accept the fixed quote. The arrangement where in most cases you only pay if we recover your data belongs to recovery work, and even there electronic and mechanical failures, chip-level work and physical damage are 50% upfront, while DVR, forensic, BitLocker and ransomware work is paid upfront. An examination is bench time spent answering a question, so it is charged whether the findings help you or not. What it does have is two published figures, which is two more than many other laboratories will put in front of you. An examination that ends in a full written report is priced at £800 + VAT. An examination that stops at the evidence itself, a verified binary image with the deleted material extracted out of it and handed over for another party to interpret, is priced at £400 + VAT. That second figure is the same point on the list as a recorder disk or a BitLocker volume, so it adds nothing new to the five bands listed throughout the rest of the site.
The examination itself, together with the full written report that comes out of it, produced so that an expert acting against you can follow each and every step and test it.
The verified binary image with the deleted files extracted from it, and no report written. It is the same figure a recorder disk or an encrypted volume carries, not an additional band.
Both figures are based on a single machine and a single question put to it. An exercise with nine laptops, a file server and a tenancy export is a greater scope of work, so anything which spans several devices is measured after the free diagnostic and written down before you agree to proceed. Diagnosis still costs nothing and still closes 2 working days after the device is booked in, and the fee is settled before an examiner opens the image, not afterwards. Everything other than forensic work keeps its published band on the prices page.
Preservation takes place for a company across its own estate, or for solicitors on written instruction. There have only ever been three routes to this bench and there has never been a fourth. Equipment that the business itself purchased and issued. A written instruction from a solicitor, an insurer or the court. Or a device that genuinely belongs to the person asking, and when it comes to family matters this means a device owned outright or owned jointly. We do not break into anything here. We do not work out somebody else's password, no monitoring software is placed on a device the client does not own, and we never intercept live traffic: interception is reserved for the bodies named in the Investigatory Powers Act 2016 and nobody else. If a client has no lawful right to look inside a device, instructing us does not give them one. Handsets and tablets fall outside this practice altogether.
A hold gets scoped on the telephone before anything moves. First get a quote by phoning 0800 689 0668 or by using our free online diagnostic, then go over all of the details (the devices, the accounts and the dates) with us, and after that send just the drives by tracked, insured post, as we need the drives and not the machines. If you would rather hand them in, the address is Guildford Data Recovery, Building 2, Ground Floor, Guildford Business Park, Guildford GU2 8XH, open Monday to Friday, 9am to 5:30pm, with no appointment needed. No part of this network collects, and there is no counter at Bracknell. Each item goes into sealed storage with custody recorded from the moment it arrives.
Is the hard drive still bolted into a machine, whether that is a laptop, a tower, an iMac, a MacBook, a rack server or a DVR stored under the till? Get a quote first, then pull the drive out of the machine and send only the bare drive (never the entire machine): from a server the disks come out labelled by bay, and from a DVR you just send the disk. Stripping hardware is not something our lab does, though any repair shop on your high street can do it in about ten minutes. The one case with no way round it is memory chips soldered flat onto the mainboard, which is how T2 and Apple Silicon Macs and certain ultrabooks are built, and that storage is not taken on. Call us first if you're not sure which kind you have. Where the storage cannot be unbolted, there is no parcel to make up.
↓ Print the shipping & booking-in form (PDF)
With your quote in hand, the name on the parcel wants to be Guildford Data Recovery. Driving it over from Bracknell takes roughly forty minutes along the A322 followed by the A3, and you do not need an appointment; posting it costs you a stamp and a day. Either way, a message goes out to you as soon as the package has been logged onto our system, and two working days after that the diagnostic is finished.
Unsure which items should go in the box? Call 0800 689 0668 whilst the box is still open, or work through the free online diagnostic and let it guide you.
A hold arranged this month costs a small fraction of the one you may need to explain away next year.