This page is much narrower than many people would expect, and that is intentional. The only computer we will review is one owned by the client (either alone or jointly with someone else) or one that a solicitor or the court has named in an instruction, and nothing else. We cannot help anyone get into a partner's device, accounts or messages, nor do we install any type of monitoring software. That is why family solicitors throughout Berkshire, Surrey and London instruct us on this basis, as it is the only way the material is of any value once it is in front of a judge.
◇ Footing first, bench afterwards. An investigation along with its full written report is £800 + VAT; a verified image with the deleted files extracted and no report written is £400 + VAT, which is the same point as a recorder disk. There is no charge for the diagnostic, and the scope goes into writing first. Forensic work is paid upfront at the time you accept our fixed quote. On other services, in most cases you only pay if we recover your data (electronic and mechanical failures, chip-level work and physical damage are 50% upfront, with the balance only if we recover your data). Standard rates for ordinary recovery bands can be found on the data recovery cost page.
Your own machine, one that genuinely belongs to the two of you jointly, or a device that has been named in an instruction from your solicitor or in a direction from the court. There is no fourth category.
To get right to the point from the start: the wrong instruction will waste everyone's time and could cause real harm. We will not attempt to open a device belonging to your spouse or partner. We will not guess, reset or bypass other people's passwords. We will not install or activate any sort of tracking or monitoring software on a phone, tablet or computer, and in any case we do not look at phones or tablets at all. Under the Computer Misuse Act 1990, accessing another person's data without authority is unauthorised access, and installing software to monitor them can engage it a second time. Additionally, in the context of a relationship, that behaviour may amount to controlling or coercive behaviour under section 76 of the Serious Crime Act 2015. This is not a technicality, because it is the difference between gathering evidence and committing a criminal offence.
The Court of Appeal settled the question of self-help disclosure in Imerman v Tchenguiz. Anyone who takes, copies or reads their partner's confidential documents is in breach of confidence. Normally that material has to be returned, it may well be excluded from consideration, and the person who gathered it could end up having to pay the costs of the argument over it. In practice, this means going through the "front door". Part 25 of the Family Procedure Rules regulates expert evidence in family proceedings: permission from the court is required before an expert's report can be placed into evidence, and at all times the expert owes their duty to the court, which takes precedence over any duty to whoever instructs or pays them. We accept single joint expert appointments on that basis, and we would rather your solicitor made the instruction than you made it yourself.
In reality, a machine that can lawfully be examined will give back a lot more than many people think. Deleted correspondence, spreadsheets and accounting exports can all be recovered, and the times when documents were created, modified and deleted can still be read, so the order of events can be put back together. Browser and sign-in activity over the disputed days can also be found. In financial remedy cases, both parties are under a duty to make full and frank disclosure and answer for it on Form E, and this often means the working papers behind figures already filed: the statements, the transfers and the bookkeeping. What does not come back is just as worth noting. Nothing ever comes back complete. On a modern SSD with TRIM running, deleted content may have been discarded within minutes of deletion, and anything that has genuinely been overwritten is completely gone. All recovered material is reported at the level of confidence it deserves, and never a notch higher.
A family instruction does not give anyone a licence to look through a household's whole private life, and treating it as one is exactly why an examination gets challenged later. Therefore the scope is written down first: which device is being searched, which date range, which categories of material and which search terms. After that, the examination stays within the documented scope. Anything that appears to be privileged correspondence between the other party and their own solicitor is put aside and referred back instead of being read. Handling follows the same discipline as every other page here (write-blocked capture, E01 image, SHA-256 verification, notes made while the work is done, custody signed over at each handover), and the report is prepared in such a way that a district judge can take the findings straight from the page without needing anybody else to interpret them.
The protocols for capture, verification and storage are set out at the forensic recovery hub. Putting an hour on a deletion is deleted-file forensics, taking an entire machine is workstation deep imaging, and keeping material secure while proceedings run is legal hold and chain of custody. Pricing bands for ordinary recovery are listed on the prices page.
Only taken from a machine that you own, co-own, or have been directed to produce.
Deleted correspondence, statements and accounts files, restored where they have survived.
Created, modified and deleted values, assigning each item to a date.
The working material behind the figures a party has already provided as part of disclosure.
Sign-in activity and browsing history through the disputed period.
Device, date range, categories and search terms, all agreed before any work begins.
Hashes, seals and signatures, so the handling cannot be attacked at a later date.
Let's start with the part people are least often told about: a forensic examination is paid upfront, once you accept the fixed quote. The arrangement where in most cases you only pay if we recover your data belongs to recovery work, and even there electronic and mechanical failures, chip-level work and physical damage are 50% upfront, while DVR, forensic, BitLocker and ransomware work is paid upfront. An examination is bench time spent answering a question, so it is charged whether the findings help you or not. What it does have is two published figures, which is two more than many other laboratories will put in front of you. An examination that ends in a full written report is priced at £800 + VAT. An examination that stops at the evidence itself, a verified binary image with the deleted material extracted out of it and handed over for another party to interpret, is priced at £400 + VAT. That second figure is the same point on the list as a recorder disk or a BitLocker volume, so it adds nothing new to the five bands listed throughout the rest of the site.
The examination itself, together with the full written report that comes out of it, produced so that an expert acting against you can follow each and every step and test it.
The verified binary image with the deleted files extracted from it, and no report written. It is the same figure a recorder disk or an encrypted volume carries, not an additional band.
Both figures are based on a single machine and a single question put to it. An exercise with nine laptops, a file server and a tenancy export is a greater scope of work, so anything which spans several devices is measured after the free diagnostic and written down before you agree to proceed. Diagnosis still costs nothing and still closes 2 working days after the device is booked in, and the fee is settled before an examiner opens the image, not afterwards. Everything other than forensic work keeps its published band on the prices page.
Family instructions are carried out on your own device, on one genuinely owned between you, or on a direction from a solicitor or the court. There are three ways to reach this bench, and there has never been a fourth. Equipment the business itself bought and issued. A written instruction from a solicitor, an insurer or the court. Or a device that actually belongs to the person asking, which in a family matter means one owned outright or owned jointly. Nothing is broken into here. We will not work out another person's password, we will not install monitoring software onto a device the client does not own, and we will never intercept live traffic, because that is reserved for the bodies named in the Investigatory Powers Act 2016 and no one else. If a client has no lawful right to look inside a device, instructing us does not give them one. Handsets and tablets fall completely outside the practice.
Authority, and your quote, get settled on a phone call first (or you can start with our free online diagnostic), before any parcel is made up. Call 0800 689 0668 yourself, or have your solicitor ring us for you, and then the drive from the agreed device (we need the drive itself, not the computer) goes to Guildford by tracked, insured post, or you can drop it off in person at the Guildford lab, Building 2, Ground Floor, Guildford Business Park, Guildford GU2 8XH, Monday to Friday, 9am to 5:30pm. No appointment is needed. No part of this network collects, and Bracknell has no counter. Custody is recorded from the moment the drive arrives.
Is the hard drive still bolted into a machine, whether that is a laptop, a tower, an iMac, a MacBook, a rack server or a DVR stored under the till? Get a quote first, then pull the drive out of the machine and send only the bare drive (never the entire machine): from a server the disks come out labelled by bay, and from a DVR you just send the disk. Stripping hardware is not something our lab does, though any repair shop on your high street can do it in about ten minutes. The one case with no way round it is memory chips soldered flat onto the mainboard, which is how T2 and Apple Silicon Macs and certain ultrabooks are built, and that storage is not taken on. Call us first if you're not sure which kind you have. Where the storage cannot be unbolted, there is no parcel to make up.
↓ Print the shipping & booking-in form (PDF)
With your quote in hand, the name on the parcel wants to be Guildford Data Recovery. Driving it over from Bracknell takes roughly forty minutes along the A322 followed by the A3, and you do not need an appointment; posting it costs you a stamp and a day. Either way, a message goes out to you as soon as the package has been logged onto our system, and two working days after that the diagnostic is finished.
Unsure which items should go in the box? Call 0800 689 0668 whilst the box is still open, or work through the free online diagnostic and let it guide you.
Ring us, or have your solicitor do it for you, because whether the device may lawfully be examined is the thing that gets settled before anything else.