Legal Hold and Chain of Custody

Litigation changes what a laptop is. The moment proceedings are reasonably in prospect, a device or an account stops being an IT asset and turns into potential evidence — and from then on its handling gets examined every bit as closely as its contents. For solicitors across Berkshire, Surrey and the London boroughs, and for the businesses they act for, this page is about putting preservation on a documented footing designed to be picked over.

Footing first, bench afterwards. An investigation with its full written report is £800 + VAT; a verified image with deleted-file extraction and no report written is £400 + VAT, the same point as a recorder disk. The diagnostic is free and the scope goes in writing first. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Ordinary recovery bands are published on the data recovery cost page.

// when the duty has already started

Moments that call for a hold

Preservation costs least at precisely the point where arranging it still feels premature.

A letter before action, or a preservation request, has landed on somebody's desk
A tribunal claim has been lodged, or is plainly on its way
Hardware is queued for reissue while questions about it remain open
Disclosure is approaching and not one device has been captured yet
The other side has started attacking the integrity of what you hold
A regulator or an insurer has asked to see the records

The duty starts earlier than people think

It does not begin when a claim form lands. Under Practice Direction 57AD, which governs disclosure in the Business and Property Courts, the duty to preserve documents bites as soon as a party knows it may become a party to proceedings that may be commenced — that is, when litigation is reasonably anticipated. It carries specific obligations with it: send a written notification to relevant employees and former employees telling them to preserve, suspend routine deletion and any automatic overwriting that would destroy relevant material, and take reasonable steps in respect of documents held by third parties on your behalf. Outside the Business and Property Courts the mechanics differ and the logic does not. A court that finds relevant material was destroyed after the duty arose is entitled to draw its own conclusions about why, and it frequently does.

Before it is anything else, a hold is paperwork

Devices and accounts in scope get listed one by one instead of being described in the general. Each is captured, and that capture is logged against the time, the examiner and the equipment used. Hash values go into the record as the image is written, so that any later alteration announces itself as a failed verification rather than arriving as a surprise halfway through cross-examination. Notes are taken while the work is happening. Originals go into sealed evidence storage, and every movement afterwards — bench to safe, safe to court and back — is entered, with nothing missing from the sequence. Continuity is the first thing a competent opponent probes, so making it tediously complete is the entire object.

In practice the job is capturing things before anyone tidies

Nearly all the evidence lost in litigation is lost innocently rather than deliberately. A laptop is handed to a new starter. A mailbox goes in routine housekeeping. A technician has a well-meant dig through it over a lunch hour. A director clears an old disk out of a cupboard because it was in the way. Once proceedings are in prospect, continued use is where the real risk lies: it writes over things, it moves dates about, and it hands the other side an easy suggestion that whatever has gone missing was the inconvenient part. The advice is boring and it works. Book the capture for the day the equipment comes back, not after a month in a drawer. Do not reissue a machine until its image has verified. Turn off the retention policies that would otherwise delete on schedule. Write each step down as you take it.

Built for disclosure from the first day

Preserved material has to be produced sooner or later, so it is shaped for that from the outset. Findings come first and in plain English, with the reasoning behind them in an appendix that an opposing expert can walk through unaided. On the exhibit schedule each image is bound to its hash values, its custody history and the device it was taken from. In a civil claim, Part 35 and its practice direction govern what the report has to do: the duty to the court at rule 35.3, the substance of the instructions set out on the face of it, the range of opinion given wherever a range exists, and a statement of truth at the end. Where the appointment is as single joint expert under rule 35.7, or the parties have agreed directions between themselves, those terms govern instead — and the custody file reads exactly the same whoever settled the invoice.

The bench discipline underneath all of this is described at the forensic recovery hub. Taking the image is workstation deep imaging, the dispute a hold most often protects is employee data theft, and retention inside a tenancy is covered at email and cloud exfiltration. Bands for ordinary recovery live on the prices page.

// the four principles the handling answers to

The principles this is measured against

Published by ACPO for UK policing and maintained now under the NPCC, these four are the yardstick an opposing expert will hold your evidence up to. They are short enough to quote and awkward enough to fail.

The Forensic Science Regulator's Code of Practice became statutory in October 2023 and binds forensic science activities carried out for the criminal justice system in England and Wales. Most instructions on these pages are civil or employment matters, which the Code does not reach. The handling is built to it anyway, because it is the standard a court already understands.

// what the custody file contains

Six documents a hold produces

The other side is welcome to read every line of it, which is the whole reason for keeping it.

Scope schedule

Each device and account inside the hold, listed one by one and dated.

Capture log

Time, examiner and equipment recorded against every image as it was taken.

Hash register

Values at acquisition and at each verification since, with the results shown.

Working notes

What was done and why, written at the time rather than reconstructed later.

Storage record

Sealed evidence storage, with every movement in and out entered against a date.

Exhibit list

Ready for disclosure, binding each image to its source device and its hashes.

// paying for it, and being entitled to ask

What it costs, and who may instruct

Two figures, printed rather than hinted at

Start with the part people are least often told: a forensic examination sits outside no fix, no fee. That guarantee belongs to logical recovery work, and the stated exclusions are electronic and mechanical failures, chip-level work, DVR jobs and forensic jobs. An examination is bench time spent answering a question, so it is charged whether the answer helps you or not. What it does have is two published figures, which is two more than most laboratories will put in front of you. An examination that ends in a full written report is £800 + VAT. An examination that stops at the evidence itself — a verified binary image with the deleted material extracted out of it, handed over for somebody else to interpret — is £400 + VAT. That second figure is the same point on the list as a recorder disk or a BitLocker volume, so it adds nothing new to the five bands the rest of the site publishes.

£800 + VAT

The examination and the full written report that comes out of it, produced so an expert acting against you can follow every step and test it.

£400 + VAT

The verified binary image with deleted files extracted from it, and no report written. The same figure a recorder disk or an encrypted volume carries, not an extra band.

Both figures assume one machine and one question put to it. Nine laptops, a file server and a tenancy export is a larger exercise, so anything spanning several devices is measured after the free diagnostic and written down before you agree to it. Diagnosis still costs nothing and still closes 2 working days after the device is booked in, and the fee is settled before an examiner opens the image rather than after. Everything that is not forensic keeps its published band on the prices page.

The footing an examination needs

Preservation is done for a company across its own estate, and for solicitors on written instruction. Three routes reach this bench and there has never been a fourth. Equipment the business itself bought and issued. A written instruction from a solicitor, an insurer or the court. Or a device that genuinely belongs to the person asking, which in a family matter means one owned outright or owned jointly. Nothing is broken into here. We do not work out somebody else's password, we do not put monitoring software on a device the client does not own, and live traffic is never intercepted — interception belongs to the bodies named in the Investigatory Powers Act 2016 and to nobody else. Where a client has no lawful right to look inside a device, instructing us does not create one. Handsets and tablets fall outside the practice altogether.

// getting the media to the bench

Booking a device in — what actually has to happen

A hold gets scoped on the telephone before a single thing moves. Ring 0800 689 0668, work through the devices, the accounts and the dates with us, and exhibits then reach Guildford by tracked, insured post or over the counter there in office hours. No part of this network collects and Bracknell has no counter. Each item goes into sealed storage with custody recorded from the moment it arrives.

Is the storage still bolted into a machine — laptop, tower, iMac, MacBook, rack server, a DVR under the till? Free it first and send the bare unit. Stripping hardware is not something this lab does, though it is ten minutes' work for any repair shop on your high street. There is a single case with no way round it: memory chips soldered flat onto the mainboard, which is how Apple Silicon machines and certain ultrabooks are built. Where the storage cannot be unbolted, there is no parcel to make up.

  • Pick packaging that holds its shape — a rigid carton or a heavy padded mailer — and pack round the unit so it cannot shift in transit. Leave the caddy, the mains adaptor and the leads at home; none of them are wanted at this end.
  • Print the shipping and booking-in form (PDF), put your name and mobile on it along with a sentence describing how the fault started, and slip it in alongside the media.
  • Send it Special Delivery through the Post Office and it travels tracked and covered. A courier account of your own works just as well. The only thing that matters is that somebody signs for it at this end.
  • If you would sooner deliver it by hand, the Guildford reception on the address card takes devices over the counter, Mon–Fri 9:00am–5:30pm. Neither a Bracknell shopfront nor a pickup van exists — those are the two things we cannot offer.
// write this on the label

Guildford Data Recovery

Building 2, Ground Floor
Guildford Business Park
Guildford, GU2 8XH

↓ Print the shipping & booking-in form (PDF)

The name on the parcel wants to be Guildford Data Recovery. Driving it over from Bracknell is roughly forty minutes on the A322 then the A3; posting it costs you a stamp and a day. Either way, a message goes out to you as soon as it is logged onto the system, and two working days later the diagnostic is finished.

Unsure whether something should go in the box? Ring 0800 689 0668 while the lid is still open, or work through the free online diagnostic and let it tell you.

// holds and custody — asked by instructing solicitors

What a solicitor checks first

Working out which devices and accounts fall inside it, capturing each with hashes that verify, sealing the originals into recorded storage, switching off the retention policies that would otherwise delete, and writing down every step as it happens. Days rather than weeks in most cases. The business runs on replacement equipment meanwhile and the evidence simply stops moving.
No, and a firm that promises it should worry you. That decision is taken in the courtroom on the day. What we contribute is preparation to evidential standards — ACPO principles observed, hashes checked, custody unbroken, method disclosed, notes written at the time — so that the decision is a straightforward one instead of a fight.
Damaging rather than fatal, in most cases. Registries, journals and shadow copies frequently survive being reused, and server and tenancy records cover a fair proportion of what the endpoint gave up. Capture it now, stop all further use, and let the report state the handling history exactly as it went. Saying it plainly costs a fraction of being caught not saying it.
Yes, and it makes the exercise stronger rather than narrower. A joint instruction, an agreed scope or an order of the court governs the work, and the duty attaches to the proceedings instead of to a party. The custody file comes out identical whoever gave the instruction.

Preserve now. Argue from firmer ground later.

A hold arranged this month costs a fraction of the one you have to explain away next year.