Berkshire runs on smaller businesses: two-director consultancies off Western Road, agencies and studios around the Lexicon, family contractors working in Binfield and Warfield, surveyors and accountants out towards Ascot and Camberley. When the people who run the company stop speaking, its records are the first casualty. All the work here stays on systems the business itself owns. We date every deletion, rebuild whatever was taken out, and name the account that did it.
◇ Footing first, bench afterwards. An investigation along with its full written report is £800 + VAT; a verified image with the deleted files extracted and no report written is £400 + VAT, which is the same point as a recorder disk. There is no charge for the diagnostic, and the scope goes into writing first. Forensic work is paid upfront at the time you accept our fixed quote. On other services, in most cases you only pay if we recover your data (electronic and mechanical failures, chip-level work and physical damage are 50% upfront, with the balance only if we recover your data). Standard rates for ordinary recovery bands can be found on the data recovery cost page.
In a two-director company, or any family-run business anywhere in the county, any one of these is the point at which images should be taken.
A partnership dispute is two sides telling their story out of the same set of records, which makes for a rather nice fit with how an examiner works. The estate is corporate throughout (servers, office machines, business mailboxes, shared drives), so the work can be done without anybody's private property coming near the bench. It also holds the material that neither side can go back and change: deletions, edits, the times attached to them, and the login under which each one happened. We establish that and let it stand exactly where it falls, whichever director gets the benefit. Where the claim is an unfair prejudice petition under section 994 of the Companies Act 2006, or turns on the directors' duties at sections 171 to 177, this is usually the material the pleadings end up resting on.
Ledgers taken out on the way through the door are seldom gone for good. Images of the office machines and the server bring back erased invoices, statements, contracts and letters, as well as the exports and working files that accounting software leaves behind while it runs. When the firm uses Sage, the company data resides on the machine itself, so the data files and the backup sets come back with the rest; if it uses Xero or QuickBooks Online, the ledger lives in somebody else's data centre, and what the endpoint holds is the exports, the spreadsheets and the browser record of who pulled them and on what date. Every recovered item carries the time it was removed, which makes the shape plain at a glance: routine housekeeping, or a burst of deletions in the week the argument began. If valuation becomes the issue, the whole set is handed over to a forensic accountant in a form they can actually use.
Most of these disputes come down to whether trade was steered away, and systems keep a record of the steering. An enquiry address forwarding quietly to an outside mailbox. A customer database exported all at once a fortnight before the split. Quotations turning up on another letterhead with your own internal reference still buried in the file. Material leaving on a pen drive, or being uploaded into a private cloud account. Tie each of those to a date, a login and a piece of hardware and it stops being one director's grievance and becomes the company's own record of what happened.
These findings will be read by people who have stopped trusting each other, so neutrality has to live in the procedure rather than in a covering letter. Originals pass through a write-blocker into E01 files, which are then verified using SHA-256. Notes are kept throughout as the work is done. Custody is signed at every handover. Passware is used on protected files only where there is a right to the contents. The instruction may come from either side, from both, or from the court, and CPR 35.3 makes it clear that the expert's duty lies with the court in every one of those cases; where the parties agree a single joint expert under CPR 35.7 that is simply made explicit. Claims issued in the Business and Property Courts are organised around the disclosure duties in Practice Direction 57AD, so both sides work from one schedule instead of two.
The underlying method is described on the forensic recovery hub. Mailbox and tenancy material is dealt with on its own page, the timing of a deletion belongs with deleted-file forensics, and preserving evidence with legal hold and chain of custody. Ordinary recovery bands can be found on the prices page.
Across the server, the desktops and the mailboxes, there is usually a record of what happened already sitting there.
Deleted invoices and statements, plus accounting exports and backup sets.
What was sent, deleted and redirected, with each entry carrying its own date.
Where enquiries and quotations were being routed instead, and who was logged in when it was done.
Removals and moves across shared storage, compiled into one dated sequence.
Pen drives and private cloud accounts that received company files.
One single timeline of edits, deletions and transfers that both sides can read.
Let's start with the part people are least often told about: a forensic examination is paid upfront, once you accept the fixed quote. The arrangement where in most cases you only pay if we recover your data belongs to recovery work, and even there electronic and mechanical failures, chip-level work and physical damage are 50% upfront, while DVR, forensic, BitLocker and ransomware work is paid upfront. An examination is bench time spent answering a question, so it is charged whether the findings help you or not. What it does have is two published figures, which is two more than many other laboratories will put in front of you. An examination that ends in a full written report is priced at £800 + VAT. An examination that stops at the evidence itself, a verified binary image with the deleted material extracted out of it and handed over for another party to interpret, is priced at £400 + VAT. That second figure is the same point on the list as a recorder disk or a BitLocker volume, so it adds nothing new to the five bands listed throughout the rest of the site.
The examination itself, together with the full written report that comes out of it, produced so that an expert acting against you can follow each and every step and test it.
The verified binary image with the deleted files extracted from it, and no report written. It is the same figure a recorder disk or an encrypted volume carries, not an additional band.
Both figures are based on a single machine and a single question put to it. An exercise with nine laptops, a file server and a tenancy export is a greater scope of work, so anything which spans several devices is measured after the free diagnostic and written down before you agree to proceed. Diagnosis still costs nothing and still closes 2 working days after the device is booked in, and the fee is settled before an examiner opens the image, not afterwards. Everything other than forensic work keeps its published band on the prices page.
This work stays inside the firm's own systems, and it fits best under a joint instruction or a direction of the court. There are three routes to this bench, and there has never been a fourth. Equipment the business itself bought and issued. A written instruction from a solicitor, an insurer or the court. Or a device that genuinely belongs to the person asking, which in a family matter means one owned outright or owned jointly. Nothing is broken into here. We do not work out somebody else's password, we do not install monitoring software on a device the client does not own, and live traffic is never intercepted; interception belongs to the bodies named in the Investigatory Powers Act 2016 and nobody else. If a client does not have the lawful right to look inside a device, instructing us will not give them that right. Handsets and tablets fall outside the practice altogether.
A server estate needs planning, so get a quote first with an initial call to us on 0800 689 0668 before anybody pulls the plug on anything. We only need the drives, not the machines, and the server disks come out labelled by bay. If both sides would rather give joint instructions, that can be done too. Once you have the quote, the drives reach Guildford by tracked, insured post (or a courier you book yourself) or are handed over the counter at the Guildford lab, Monday to Friday, 9am to 5:30pm, with no appointment needed. No part of this network collects and there is no counter in Bracknell, and every item is signed into custody as it arrives.
Is the hard drive still bolted into a machine, whether that is a laptop, a tower, an iMac, a MacBook, a rack server or a DVR stored under the till? Get a quote first, then pull the drive out of the machine and send only the bare drive (never the entire machine): from a server the disks come out labelled by bay, and from a DVR you just send the disk. Stripping hardware is not something our lab does, though any repair shop on your high street can do it in about ten minutes. The one case with no way round it is memory chips soldered flat onto the mainboard, which is how T2 and Apple Silicon Macs and certain ultrabooks are built, and that storage is not taken on. Call us first if you're not sure which kind you have. Where the storage cannot be unbolted, there is no parcel to make up.
↓ Print the shipping & booking-in form (PDF)
With your quote in hand, the name on the parcel wants to be Guildford Data Recovery. Driving it over from Bracknell takes roughly forty minutes along the A322 followed by the A3, and you do not need an appointment; posting it costs you a stamp and a day. Either way, a message goes out to you as soon as the package has been logged onto our system, and two working days after that the diagnostic is finished.
Unsure which items should go in the box? Call 0800 689 0668 whilst the box is still open, or work through the free online diagnostic and let it guide you.
A free diagnosis, a scope in writing, a fixed quote paid upfront once you accept it, and no fuss about taking joint instructions from either side.