Litigation changes what a laptop is. The moment proceedings are reasonably in prospect, a device or an account stops being an IT asset and turns into potential evidence — and from then on its handling gets examined every bit as closely as its contents. For solicitors across Berkshire, Surrey and the London boroughs, and for the businesses they act for, this page is about putting preservation on a documented footing designed to be picked over.
◇ Footing first, bench afterwards. An investigation with its full written report is £800 + VAT; a verified image with deleted-file extraction and no report written is £400 + VAT, the same point as a recorder disk. The diagnostic is free and the scope goes in writing first. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Ordinary recovery bands are published on the data recovery cost page.
Preservation costs least at precisely the point where arranging it still feels premature.
It does not begin when a claim form lands. Under Practice Direction 57AD, which governs disclosure in the Business and Property Courts, the duty to preserve documents bites as soon as a party knows it may become a party to proceedings that may be commenced — that is, when litigation is reasonably anticipated. It carries specific obligations with it: send a written notification to relevant employees and former employees telling them to preserve, suspend routine deletion and any automatic overwriting that would destroy relevant material, and take reasonable steps in respect of documents held by third parties on your behalf. Outside the Business and Property Courts the mechanics differ and the logic does not. A court that finds relevant material was destroyed after the duty arose is entitled to draw its own conclusions about why, and it frequently does.
Devices and accounts in scope get listed one by one instead of being described in the general. Each is captured, and that capture is logged against the time, the examiner and the equipment used. Hash values go into the record as the image is written, so that any later alteration announces itself as a failed verification rather than arriving as a surprise halfway through cross-examination. Notes are taken while the work is happening. Originals go into sealed evidence storage, and every movement afterwards — bench to safe, safe to court and back — is entered, with nothing missing from the sequence. Continuity is the first thing a competent opponent probes, so making it tediously complete is the entire object.
Nearly all the evidence lost in litigation is lost innocently rather than deliberately. A laptop is handed to a new starter. A mailbox goes in routine housekeeping. A technician has a well-meant dig through it over a lunch hour. A director clears an old disk out of a cupboard because it was in the way. Once proceedings are in prospect, continued use is where the real risk lies: it writes over things, it moves dates about, and it hands the other side an easy suggestion that whatever has gone missing was the inconvenient part. The advice is boring and it works. Book the capture for the day the equipment comes back, not after a month in a drawer. Do not reissue a machine until its image has verified. Turn off the retention policies that would otherwise delete on schedule. Write each step down as you take it.
Preserved material has to be produced sooner or later, so it is shaped for that from the outset. Findings come first and in plain English, with the reasoning behind them in an appendix that an opposing expert can walk through unaided. On the exhibit schedule each image is bound to its hash values, its custody history and the device it was taken from. In a civil claim, Part 35 and its practice direction govern what the report has to do: the duty to the court at rule 35.3, the substance of the instructions set out on the face of it, the range of opinion given wherever a range exists, and a statement of truth at the end. Where the appointment is as single joint expert under rule 35.7, or the parties have agreed directions between themselves, those terms govern instead — and the custody file reads exactly the same whoever settled the invoice.
The bench discipline underneath all of this is described at the forensic recovery hub. Taking the image is workstation deep imaging, the dispute a hold most often protects is employee data theft, and retention inside a tenancy is covered at email and cloud exfiltration. Bands for ordinary recovery live on the prices page.
Published by ACPO for UK policing and maintained now under the NPCC, these four are the yardstick an opposing expert will hold your evidence up to. They are short enough to quote and awkward enough to fail.
The Forensic Science Regulator's Code of Practice became statutory in October 2023 and binds forensic science activities carried out for the criminal justice system in England and Wales. Most instructions on these pages are civil or employment matters, which the Code does not reach. The handling is built to it anyway, because it is the standard a court already understands.
The other side is welcome to read every line of it, which is the whole reason for keeping it.
Each device and account inside the hold, listed one by one and dated.
Time, examiner and equipment recorded against every image as it was taken.
Values at acquisition and at each verification since, with the results shown.
What was done and why, written at the time rather than reconstructed later.
Sealed evidence storage, with every movement in and out entered against a date.
Ready for disclosure, binding each image to its source device and its hashes.
Start with the part people are least often told: a forensic examination sits outside no fix, no fee. That guarantee belongs to logical recovery work, and the stated exclusions are electronic and mechanical failures, chip-level work, DVR jobs and forensic jobs. An examination is bench time spent answering a question, so it is charged whether the answer helps you or not. What it does have is two published figures, which is two more than most laboratories will put in front of you. An examination that ends in a full written report is £800 + VAT. An examination that stops at the evidence itself — a verified binary image with the deleted material extracted out of it, handed over for somebody else to interpret — is £400 + VAT. That second figure is the same point on the list as a recorder disk or a BitLocker volume, so it adds nothing new to the five bands the rest of the site publishes.
The examination and the full written report that comes out of it, produced so an expert acting against you can follow every step and test it.
The verified binary image with deleted files extracted from it, and no report written. The same figure a recorder disk or an encrypted volume carries, not an extra band.
Both figures assume one machine and one question put to it. Nine laptops, a file server and a tenancy export is a larger exercise, so anything spanning several devices is measured after the free diagnostic and written down before you agree to it. Diagnosis still costs nothing and still closes 2 working days after the device is booked in, and the fee is settled before an examiner opens the image rather than after. Everything that is not forensic keeps its published band on the prices page.
Preservation is done for a company across its own estate, and for solicitors on written instruction. Three routes reach this bench and there has never been a fourth. Equipment the business itself bought and issued. A written instruction from a solicitor, an insurer or the court. Or a device that genuinely belongs to the person asking, which in a family matter means one owned outright or owned jointly. Nothing is broken into here. We do not work out somebody else's password, we do not put monitoring software on a device the client does not own, and live traffic is never intercepted — interception belongs to the bodies named in the Investigatory Powers Act 2016 and to nobody else. Where a client has no lawful right to look inside a device, instructing us does not create one. Handsets and tablets fall outside the practice altogether.
A hold gets scoped on the telephone before a single thing moves. Ring 0800 689 0668, work through the devices, the accounts and the dates with us, and exhibits then reach Guildford by tracked, insured post or over the counter there in office hours. No part of this network collects and Bracknell has no counter. Each item goes into sealed storage with custody recorded from the moment it arrives.
Is the storage still bolted into a machine — laptop, tower, iMac, MacBook, rack server, a DVR under the till? Free it first and send the bare unit. Stripping hardware is not something this lab does, though it is ten minutes' work for any repair shop on your high street. There is a single case with no way round it: memory chips soldered flat onto the mainboard, which is how Apple Silicon machines and certain ultrabooks are built. Where the storage cannot be unbolted, there is no parcel to make up.
↓ Print the shipping & booking-in form (PDF)
The name on the parcel wants to be Guildford Data Recovery. Driving it over from Bracknell is roughly forty minutes on the A322 then the A3; posting it costs you a stamp and a day. Either way, a message goes out to you as soon as it is logged onto the system, and two working days later the diagnostic is finished.
Unsure whether something should go in the box? Ring 0800 689 0668 while the lid is still open, or work through the free online diagnostic and let it tell you.
A hold arranged this month costs a fraction of the one you have to explain away next year.