This page is narrower than people expect, and deliberately so. We examine a computer that the client owns, or owns jointly, or that a solicitor or the court has named in an instruction — and nothing else. We do not help anybody get into a partner's device, accounts or messages, and we do not install monitoring software of any kind. Family solicitors across Berkshire, Surrey and London instruct on that footing because it is the only footing on which the material is any use once it reaches a judge.
◇ Footing first, bench afterwards. An investigation with its full written report is £800 + VAT; a verified image with deleted-file extraction and no report written is £400 + VAT, the same point as a recorder disk. The diagnostic is free and the scope goes in writing first. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Ordinary recovery bands are published on the data recovery cost page.
Your own machine, one genuinely owned between you, or a device named in a solicitor's instruction or a court direction. There is no fourth category.
It is worth being blunt at the top of the page, because the wrong instruction wastes everybody's time and can do real harm. We will not attempt to open a device belonging to your spouse or partner. We will not guess, reset or defeat somebody else's password. We will not put tracking or monitoring software onto a phone, tablet or computer, and we do not examine handsets or tablets at all in any event. Reaching another person's data without authority is unauthorised access under the Computer Misuse Act 1990, installing software to watch them can engage it a second time, and in the context of a relationship that behaviour can also amount to controlling or coercive behaviour under section 76 of the Serious Crime Act 2015. None of that is a technicality. It is the difference between evidence and a criminal offence.
Self-help disclosure was settled by the Court of Appeal in Imerman v Tchenguiz. A spouse who takes, copies or reads the other's confidential documents commits a breach of confidence; the material generally has to be handed back, it may be excluded, and the party who gathered it can end up meeting the costs of the argument about it. The practical answer is to go through the front door. Expert evidence in family proceedings is governed by Part 25 of the Family Procedure Rules, which requires the court's permission before an expert's report can be put in, and which places the expert's duty to the court above any duty to whoever instructs or pays. We take single joint expert appointments on that basis, and we would rather your solicitor made the instruction than that you made it yourself.
On a machine that may lawfully be examined, more comes back than most people expect. Deleted correspondence, spreadsheets and accounting exports. Documents with their created, modified and deleted times still readable, so the sequence can be rebuilt. Browser and sign-in activity across the days in dispute. In financial remedy proceedings, where both parties owe a duty of full and frank disclosure and answer for it on Form E, that frequently means the working papers behind figures already filed — the statements, the transfers, the bookkeeping. What does not come back is worth stating too. Nothing returns complete. A modern SSD with TRIM running may have discarded deleted content within minutes. Anything genuinely overwritten is gone. Recovered material is reported at the confidence it deserves and not a notch higher.
A family instruction is not a licence to read a household's entire private life, and treating it as one is how an examination gets attacked later. So the scope is written down first: which device, which date range, which categories of material, which search terms. The examination stays inside it. Anything that appears to be privileged correspondence between the other party and their own solicitor is set aside and referred back rather than read. Handling follows the same discipline as every other page here — write-blocked capture, E01 image, SHA-256 verification, notes taken while the work is done, custody signed at each handover — and the report is written so that a district judge can take the findings straight off the page without an interpreter.
Capture, verification and storage are set out at the forensic recovery hub. Putting an hour on a deletion is deleted-file forensics, taking a whole machine is workstation deep imaging, and keeping material safe while proceedings run is legal hold and chain of custody. Bands for ordinary recovery sit on the prices page.
Taken only from a machine you own, own jointly, or have been directed to produce.
Deleted correspondence, statements and accounting files, restored where they survive.
Created, modified and deleted values fixing each item to a date.
Working material behind the figures a party has already disclosed.
Sign-in and browsing activity through the period in dispute.
Device, date range, categories and search terms, agreed before work starts.
Hashes, seals and signatures, so the handling cannot be attacked later.
Start with the part people are least often told: a forensic examination sits outside no fix, no fee. That guarantee belongs to logical recovery work, and the stated exclusions are electronic and mechanical failures, chip-level work, DVR jobs and forensic jobs. An examination is bench time spent answering a question, so it is charged whether the answer helps you or not. What it does have is two published figures, which is two more than most laboratories will put in front of you. An examination that ends in a full written report is £800 + VAT. An examination that stops at the evidence itself — a verified binary image with the deleted material extracted out of it, handed over for somebody else to interpret — is £400 + VAT. That second figure is the same point on the list as a recorder disk or a BitLocker volume, so it adds nothing new to the five bands the rest of the site publishes.
The examination and the full written report that comes out of it, produced so an expert acting against you can follow every step and test it.
The verified binary image with deleted files extracted from it, and no report written. The same figure a recorder disk or an encrypted volume carries, not an extra band.
Both figures assume one machine and one question put to it. Nine laptops, a file server and a tenancy export is a larger exercise, so anything spanning several devices is measured after the free diagnostic and written down before you agree to it. Diagnosis still costs nothing and still closes 2 working days after the device is booked in, and the fee is settled before an examiner opens the image rather than after. Everything that is not forensic keeps its published band on the prices page.
Family instructions run on your own device, on one genuinely owned between you, or on a direction from a solicitor or the court. Three routes reach this bench and there has never been a fourth. Equipment the business itself bought and issued. A written instruction from a solicitor, an insurer or the court. Or a device that genuinely belongs to the person asking, which in a family matter means one owned outright or owned jointly. Nothing is broken into here. We do not work out somebody else's password, we do not put monitoring software on a device the client does not own, and live traffic is never intercepted — interception belongs to the bodies named in the Investigatory Powers Act 2016 and to nobody else. Where a client has no lawful right to look inside a device, instructing us does not create one. Handsets and tablets fall outside the practice altogether.
Authority gets settled on the telephone before any parcel is made up. Ring 0800 689 0668 yourself, or ask your solicitor to, and the agreed device then goes to Guildford by tracked, insured post or comes in over the counter there in office hours. No part of this network collects and Bracknell has no counter. Custody is recorded from the moment of arrival.
Is the storage still bolted into a machine — laptop, tower, iMac, MacBook, rack server, a DVR under the till? Free it first and send the bare unit. Stripping hardware is not something this lab does, though it is ten minutes' work for any repair shop on your high street. There is a single case with no way round it: memory chips soldered flat onto the mainboard, which is how Apple Silicon machines and certain ultrabooks are built. Where the storage cannot be unbolted, there is no parcel to make up.
↓ Print the shipping & booking-in form (PDF)
The name on the parcel wants to be Guildford Data Recovery. Driving it over from Bracknell is roughly forty minutes on the A322 then the A3; posting it costs you a stamp and a day. Either way, a message goes out to you as soon as it is logged onto the system, and two working days later the diagnostic is finished.
Unsure whether something should go in the box? Ring 0800 689 0668 while the lid is still open, or work through the free online diagnostic and let it tell you.
Ring us, or have your solicitor do it — whether the device may lawfully be examined is what gets settled before anything else.