Suspected copying comes down to just three questions: which device was attached, when it was attached, and what actually ended up on it. Windows answers the first two without being asked, and it gives up most of the third to a careful examiner. Those answers are read directly from a verified image and set out in order, for employers across Bracknell Forest, along the Reading and Slough corridor and within the London boroughs.
◇ Footing first, bench afterwards. An investigation along with its full written report is £800 + VAT; a verified image with the deleted files extracted and no report written is £400 + VAT, which is the same point as a recorder disk. There is no charge for the diagnostic, and the scope goes into writing first. Forensic work is paid upfront at the time you accept our fixed quote. On other services, in most cases you only pay if we recover your data (electronic and mechanical failures, chip-level work and physical damage are 50% upfront, with the balance only if we recover your data). Standard rates for ordinary recovery bands can be found on the data recovery cost page.
More of the disputes that reach this bench turn on a pen drive than on any other single piece of hardware.
Windows keeps track of removable hardware whether anyone wants it to or not. The USBSTOR key under the system hive stores the manufacturer, the product and the instance identifier of each stick, card reader and portable drive, and for devices that report one, that identifier is the serial number printed on the casing. Since Windows 8 each of those entries also has first-connected, last-connected and last-removed timestamps in its properties. setupapi.dev.log dates the first installation of the driver to the second. Mounted-device and portable-device keys tie a serial number to the drive letter and the friendly volume name it showed up under, and the partition diagnostic log records disks being attached along with their capacity and serial. All this, pulled from an image of the computer, adds up to a register covering the machine's whole working life, usually including hardware nobody mentioned until it turned up on the schedule.
Attachment demonstrates that a device was there. A case normally needs to demonstrate that files moved. Shortcut files in the recent folder record company documents that were opened from the letter the volume held, and each of these shortcut files also records the target path, the size of the file and the volume serial number, which is what lets us associate a document with a particular stick instead of with sticks in general. Jump lists perform the same function for each application, and they survive the shortcut being deleted. Shellbags keep the folder structure somebody browsed on the device long after the device itself has gone. The change journal puts everything around it in order, minute by minute. Where the stick itself is produced, its own image completes the picture: what it holds now, when each item landed on it, and what has been taken off since.
Copying leaves a signature in the clocks, and the ability to read it correctly is half the skill. When a file is copied onto another volume, the created time records the moment of the copy, while the modified time travels unchanged with the contents. Thus, if a document was created at 22:47 on a Sunday but last modified fourteen months earlier, it is telling you when it was copied rather than when it was written. Compare that with the device register and the journal, and each transfer gets a date. A group of these occurring outside working hours, in the fortnight before a notice period ends, is rarely the innocent explanation it is offered as.
Pen drives are just the most common example; the same route is used to image and analyse SD and microSD cards out of cameras, dashcams and survey equipment, CF cards from older kit, and portable SSDs. Card instructions can run in either direction: documents traced onto a card, or deleted stills and video pulled back off one. When a card is central to the matter, it is examined alongside whichever computer wrote to it, so that neither version of events goes unchecked. There are two limits that should be said out loud. A serial number identifies hardware and never a human being. And a drive that has been reformatted and filled with something else is going to give up far less than one handed straight back, which is a reason to ask for it sooner rather than waiting until disclosure.
Method and custody are detailed at the forensic recovery hub. Dating a removal is continued at deleted-file forensics, and the employer casework this feeds is under employee data theft. If a stick has simply failed and nobody is in dispute, that is ordinary USB recovery at the band on the prices page.
Each entry names its date, the profile it is under and the artefact it came from.
A record of every device the computer has ever mounted, with the maker, product and serial for each one.
When each one first appeared, when it was last present and when it was removed.
Shortcuts and jump lists binding named files to one named volume, never to just any volume.
Shellbag entries describing which directories were explored directly on the device.
The clock pattern left by a copy, used to date each transfer onto the media.
An image of the stick or card in its own right, with deleted contents brought back.
Let's start with the part people are least often told about: a forensic examination is paid upfront, once you accept the fixed quote. The arrangement where in most cases you only pay if we recover your data belongs to recovery work, and even there electronic and mechanical failures, chip-level work and physical damage are 50% upfront, while DVR, forensic, BitLocker and ransomware work is paid upfront. An examination is bench time spent answering a question, so it is charged whether the findings help you or not. What it does have is two published figures, which is two more than many other laboratories will put in front of you. An examination that ends in a full written report is priced at £800 + VAT. An examination that stops at the evidence itself, a verified binary image with the deleted material extracted out of it and handed over for another party to interpret, is priced at £400 + VAT. That second figure is the same point on the list as a recorder disk or a BitLocker volume, so it adds nothing new to the five bands listed throughout the rest of the site.
The examination itself, together with the full written report that comes out of it, produced so that an expert acting against you can follow each and every step and test it.
The verified binary image with the deleted files extracted from it, and no report written. It is the same figure a recorder disk or an encrypted volume carries, not an additional band.
Both figures are based on a single machine and a single question put to it. An exercise with nine laptops, a file server and a tenancy export is a greater scope of work, so anything which spans several devices is measured after the free diagnostic and written down before you agree to proceed. Diagnosis still costs nothing and still closes 2 working days after the device is booked in, and the fee is settled before an examiner opens the image, not afterwards. Everything other than forensic work keeps its published band on the prices page.
This work is performed on company computers and media the firm issued, or under written instructions from a solicitor. There have always been three ways to get to this bench, and there has never been a fourth. Equipment the business itself bought and issued. A written instruction from a solicitor, an insurer or the court. Or a device that genuinely belongs to the person asking, which in a family matter means one they own outright or co-own with another. Nothing is broken into here. We do not work out someone else's password, we do not install monitoring software on a device the client does not own, and we never intercept live traffic; interception belongs to the bodies named in the Investigatory Powers Act 2016 and to nobody else. If a client has no lawful right to look inside a device, instructing us will not provide one. Handsets and tablets fall outside the practice altogether.
A stick and the drive out of the computer that wrote to it are best looked at as a pair (we only need the drives, not the machines), so ring us on 0800 689 0668 for a quote first, and we will agree the set with you before the box is taped shut. There is no collection anywhere in this network and no counter in Bracknell: items arrive at Guildford by tracked, insured post, or you can drop them off in person at the Guildford lab (Building 2, Ground Floor, Guildford Business Park, Guildford GU2 8XH), Monday to Friday, 9am to 5:30pm, and you do not need an appointment. Each item is entered in the custody record on arrival.
Is the hard drive still bolted into a machine, whether that is a laptop, a tower, an iMac, a MacBook, a rack server or a DVR stored under the till? Get a quote first, then pull the drive out of the machine and send only the bare drive (never the entire machine): from a server the disks come out labelled by bay, and from a DVR you just send the disk. Stripping hardware is not something our lab does, though any repair shop on your high street can do it in about ten minutes. The one case with no way round it is memory chips soldered flat onto the mainboard, which is how T2 and Apple Silicon Macs and certain ultrabooks are built, and that storage is not taken on. Call us first if you're not sure which kind you have. Where the storage cannot be unbolted, there is no parcel to make up.
↓ Print the shipping & booking-in form (PDF)
With your quote in hand, the name on the parcel wants to be Guildford Data Recovery. Driving it over from Bracknell takes roughly forty minutes along the A322 followed by the A3, and you do not need an appointment; posting it costs you a stamp and a day. Either way, a message goes out to you as soon as the package has been logged onto our system, and two working days after that the diagnostic is finished.
Unsure which items should go in the box? Call 0800 689 0668 whilst the box is still open, or work through the free online diagnostic and let it guide you.
Leave the computer alone, hang on to the drive, and ring the freephone before anybody reformats anything.