Suspected copying narrows down to three questions. Which device was attached. When it was attached. What went onto it. Windows answers the first two without being asked and gives up most of the third to a careful examiner. Those answers are read off a verified image and set out in order, for employers across Bracknell Forest, the Reading and Slough corridor and the London boroughs.
◇ Footing first, bench afterwards. An investigation with its full written report is £800 + VAT; a verified image with deleted-file extraction and no report written is £400 + VAT, the same point as a recorder disk. The diagnostic is free and the scope goes in writing first. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Ordinary recovery bands are published on the data recovery cost page.
More disputes reaching this bench turn on a pen drive than on any other single piece of hardware.
Windows takes notes on removable hardware whether anyone wants it to or not. The USBSTOR key under the system hive records the manufacturer, the product and the instance identifier of each stick, card reader and portable drive, and for devices that report one that identifier is the serial number printed on the casing. Since Windows 8 each of those entries also carries first-connected, last-connected and last-removed timestamps in its properties. setupapi.dev.log dates the first installation of the driver to the second. Mounted-device and portable-device keys tie a serial to the drive letter and the friendly volume name it appeared under, and the partition diagnostic log records disks being attached with their capacity and serial. Pulled from an image, that is a register covering the machine's whole working life, usually including hardware nobody mentioned until it turned up on the schedule.
Attachment shows a device was there. A case normally needs to show files moved. Shortcut files in the recent folder record company documents opened from the letter the volume held, and each one keeps the target path, the file size and the volume serial number, which is what matches a document to a particular stick rather than to sticks in general. Jump lists do the same job per application and survive the shortcut being cleared. Shellbags preserve the folder structure somebody browsed on the device long after the device has vanished. The change journal orders everything around it minute by minute. Where the stick itself is produced, its own image completes the picture: what it holds now, when each item landed on it, and what has been taken off since.
Copying leaves a signature in the clocks, and reading it correctly is half the skill. When a file is copied onto another volume the created time records the moment of the copy while the modified time travels unchanged with the contents. A document created at 22:47 on a Sunday but last modified fourteen months earlier is therefore telling you when it was copied, not when it was written. Set that against the device register and the journal and each transfer gets a date. A cluster of them outside working hours, in the fortnight before a notice period ends, is rarely the innocent explanation it is offered as.
Pen drives are only the commonest example. SD and microSD cards out of cameras, dashcams and survey equipment, CF cards from older kit and portable SSDs are all imaged and analysed by the same route. Card instructions run in either direction: documents traced onto a card, or deleted stills and video pulled back off one. Where a card is central to the matter it is examined next to whichever computer wrote to it, so that neither version of events goes unchecked. Two limits deserve saying out loud. A serial number identifies hardware and never a human being. And a drive that has been reformatted and filled with something else gives up far less than one handed straight back, which is a reason to ask for it sooner rather than at disclosure.
Method and custody are described at the forensic recovery hub. Dating a removal continues at deleted-file forensics, and the employer casework this feeds is at employee data theft. Where a stick has simply failed and nobody is in dispute, that is ordinary USB recovery at the band on the prices page.
Each entry names its date, the profile it belongs to, and the artefact it was taken from.
Maker, product and serial for every device the computer has ever mounted.
When each one first appeared, when it was last present, when it was pulled.
Shortcuts and jump lists binding named files to one named volume, not to any volume.
Shellbag entries showing which directories were explored on the device itself.
The clock pattern a copy leaves, used to date each transfer onto the media.
The stick or card imaged in its own right, deleted contents brought back.
Start with the part people are least often told: a forensic examination sits outside no fix, no fee. That guarantee belongs to logical recovery work, and the stated exclusions are electronic and mechanical failures, chip-level work, DVR jobs and forensic jobs. An examination is bench time spent answering a question, so it is charged whether the answer helps you or not. What it does have is two published figures, which is two more than most laboratories will put in front of you. An examination that ends in a full written report is £800 + VAT. An examination that stops at the evidence itself — a verified binary image with the deleted material extracted out of it, handed over for somebody else to interpret — is £400 + VAT. That second figure is the same point on the list as a recorder disk or a BitLocker volume, so it adds nothing new to the five bands the rest of the site publishes.
The examination and the full written report that comes out of it, produced so an expert acting against you can follow every step and test it.
The verified binary image with deleted files extracted from it, and no report written. The same figure a recorder disk or an encrypted volume carries, not an extra band.
Both figures assume one machine and one question put to it. Nine laptops, a file server and a tenancy export is a larger exercise, so anything spanning several devices is measured after the free diagnostic and written down before you agree to it. Diagnosis still costs nothing and still closes 2 working days after the device is booked in, and the fee is settled before an examiner opens the image rather than after. Everything that is not forensic keeps its published band on the prices page.
This work is done on company computers and on media the company issued, or on written instruction from a solicitor. Three routes reach this bench and there has never been a fourth. Equipment the business itself bought and issued. A written instruction from a solicitor, an insurer or the court. Or a device that genuinely belongs to the person asking, which in a family matter means one owned outright or owned jointly. Nothing is broken into here. We do not work out somebody else's password, we do not put monitoring software on a device the client does not own, and live traffic is never intercepted — interception belongs to the bodies named in the Investigatory Powers Act 2016 and to nobody else. Where a client has no lawful right to look inside a device, instructing us does not create one. Handsets and tablets fall outside the practice altogether.
A drive and the computer that wrote to it are best looked at as a pair, so ring 0800 689 0668 and we will agree the set before the box is taped up. There is no collection anywhere in this network and no counter in Bracknell: items reach Guildford by tracked, insured post or over the counter there in office hours, and each is entered in the custody record on arrival.
Is the storage still bolted into a machine — laptop, tower, iMac, MacBook, rack server, a DVR under the till? Free it first and send the bare unit. Stripping hardware is not something this lab does, though it is ten minutes' work for any repair shop on your high street. There is a single case with no way round it: memory chips soldered flat onto the mainboard, which is how Apple Silicon machines and certain ultrabooks are built. Where the storage cannot be unbolted, there is no parcel to make up.
↓ Print the shipping & booking-in form (PDF)
The name on the parcel wants to be Guildford Data Recovery. Driving it over from Bracknell is roughly forty minutes on the A322 then the A3; posting it costs you a stamp and a day. Either way, a message goes out to you as soon as it is logged onto the system, and two working days later the diagnostic is finished.
Unsure whether something should go in the box? Ring 0800 689 0668 while the lid is still open, or work through the free online diagnostic and let it tell you.
Leave the computer alone, keep hold of the drive, and ring the freephone before anybody reformats anything.