Berkshire runs on small companies: two-director consultancies off Western Road, agencies and studios around the Lexicon, family contractors in Binfield and Warfield, surveyors and accountants out towards Ascot and Camberley. When the people at the top stop speaking, the company's records are the first casualty. Work here stays on systems the business itself owns. We date each deletion, rebuild what was taken out, and name the account that did it.
◇ Footing first, bench afterwards. An investigation with its full written report is £800 + VAT; a verified image with deleted-file extraction and no report written is £400 + VAT, the same point as a recorder disk. The diagnostic is free and the scope goes in writing first. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Ordinary recovery bands are published on the data recovery cost page.
In a two-director company, or a family business anywhere in the county, any one of these is the point at which images should be taken.
A partnership dispute is two stories argued out of a single set of records, which suits an examiner rather well. The estate is corporate throughout — servers, office machines, business mailboxes, shared drives — so the work can be done without anybody's private property coming near the bench. It also holds the material neither side can go back and revise: deletions, edits, the times attached to them, and the login under which each one happened. We establish that and leave it exactly where it falls, whichever director benefits. Where the claim is an unfair prejudice petition under section 994 of the Companies Act 2006, or turns on the directors' duties at sections 171 to 177, this is usually the material the pleadings end up resting on.
Ledgers taken out on the way through the door are seldom gone for good. Images of the office machines and the server bring back erased invoices, statements, contracts and letters, together with the exports and working files that accounting software drops behind it while it runs. Where the firm uses Sage the company data sits on the machine itself, so the data files and the backup sets come back with the rest; where it uses Xero or QuickBooks Online the ledger lives in somebody else's data centre, and what the endpoint holds is the exports, the spreadsheets and the browser record of who pulled them and on what date. Every recovered item carries the time it was removed, which makes the shape plain at a glance — routine housekeeping, or a burst of deletions in the week the argument started. Where valuation becomes the issue, the whole set hands over to a forensic accountant in a form they can actually use.
Most of these disputes are decided by whether trade was steered away, and systems keep a record of steering. An enquiry address forwarding quietly to an outside mailbox. A customer database exported in one movement a fortnight before the split. Quotations turning up on another letterhead with your own internal reference still buried in the file. Material leaving on a pen drive, or climbing into a private cloud account. Fix each of those to a date, a login and a piece of hardware and it stops being one director's grievance and becomes the company's own account of what happened.
These findings are read by people who have stopped trusting each other, so neutrality has to live in the procedure rather than in a covering letter. Originals pass through a write-blocker into E01 files verified on SHA-256. Notes are kept as the work is done. Custody is signed at every handover. Passware is used on protected files only where a right to the contents exists. The instruction may come from one side, from both, or from the court, and CPR 35.3 places the expert's duty with the court in every one of those cases — where the parties agree a single joint expert under CPR 35.7 that is simply made explicit. Claims issued in the Business and Property Courts are organised around the disclosure duties in Practice Direction 57AD, so both sides work from one schedule instead of two.
The underlying method is described at the forensic recovery hub. Mailbox and tenancy material has its own page, dating a deletion belongs with deleted-file forensics, and preservation with legal hold and chain of custody. Ordinary recovery bands are on the prices page.
Across the server, the desktops and the mailboxes, the account of what happened is generally sitting there already.
Erased invoices and statements, plus accounting exports and backup sets.
What was sent, deleted and redirected, each entry carrying its own date.
Where enquiries and quotations were being routed instead, and under whose login.
Removals and moves across shared storage, assembled into one dated sequence.
Pen drives and private cloud accounts taking receipt of company files.
Edits, deletions and transfers in one timeline that both sides can read.
Start with the part people are least often told: a forensic examination sits outside no fix, no fee. That guarantee belongs to logical recovery work, and the stated exclusions are electronic and mechanical failures, chip-level work, DVR jobs and forensic jobs. An examination is bench time spent answering a question, so it is charged whether the answer helps you or not. What it does have is two published figures, which is two more than most laboratories will put in front of you. An examination that ends in a full written report is £800 + VAT. An examination that stops at the evidence itself — a verified binary image with the deleted material extracted out of it, handed over for somebody else to interpret — is £400 + VAT. That second figure is the same point on the list as a recorder disk or a BitLocker volume, so it adds nothing new to the five bands the rest of the site publishes.
The examination and the full written report that comes out of it, produced so an expert acting against you can follow every step and test it.
The verified binary image with deleted files extracted from it, and no report written. The same figure a recorder disk or an encrypted volume carries, not an extra band.
Both figures assume one machine and one question put to it. Nine laptops, a file server and a tenancy export is a larger exercise, so anything spanning several devices is measured after the free diagnostic and written down before you agree to it. Diagnosis still costs nothing and still closes 2 working days after the device is booked in, and the fee is settled before an examiner opens the image rather than after. Everything that is not forensic keeps its published band on the prices page.
This work stays inside the firm's own systems and sits most comfortably under a joint instruction or a direction of the court. Three routes reach this bench and there has never been a fourth. Equipment the business itself bought and issued. A written instruction from a solicitor, an insurer or the court. Or a device that genuinely belongs to the person asking, which in a family matter means one owned outright or owned jointly. Nothing is broken into here. We do not work out somebody else's password, we do not put monitoring software on a device the client does not own, and live traffic is never intercepted — interception belongs to the bodies named in the Investigatory Powers Act 2016 and to nobody else. Where a client has no lawful right to look inside a device, instructing us does not create one. Handsets and tablets fall outside the practice altogether.
A server estate wants planning, so talk to us on 0800 689 0668 before anybody unplugs anything. Instructions can be given jointly where both sides would rather work that way. Equipment reaches Guildford by tracked, insured post or over the counter there in office hours; no part of this network collects and Bracknell has no counter, and every item is signed into custody as it arrives.
Is the storage still bolted into a machine — laptop, tower, iMac, MacBook, rack server, a DVR under the till? Free it first and send the bare unit. Stripping hardware is not something this lab does, though it is ten minutes' work for any repair shop on your high street. There is a single case with no way round it: memory chips soldered flat onto the mainboard, which is how Apple Silicon machines and certain ultrabooks are built. Where the storage cannot be unbolted, there is no parcel to make up.
↓ Print the shipping & booking-in form (PDF)
The name on the parcel wants to be Guildford Data Recovery. Driving it over from Bracknell is roughly forty minutes on the A322 then the A3; posting it costs you a stamp and a day. Either way, a message goes out to you as soon as it is logged onto the system, and two working days later the diagnostic is finished.
Unsure whether something should go in the box? Ring 0800 689 0668 while the lid is still open, or work through the free online diagnostic and let it tell you.
Free diagnosis, a scope in writing, and joint instructions taken without fuss from either side.