The window in which a returned laptop is worth imaging is a single one, and it closes when the machine is handed over to the next starter. If you capture it inside that window (behind a write-blocker, into E01 files, checked on SHA-256), the image will keep answering questions for years. Left until later, it answers fewer of them with each fortnight that passes. For HR and IT teams on the Bracknell business parks, along the M4 towards Slough and across the London boroughs, the phrase to commit to memory is that the questions will keep but the evidence will not.
◇ Footing first, bench afterwards. An investigation along with its full written report is £800 + VAT; a verified image with the deleted files extracted and no report written is £400 + VAT, which is the same point as a recorder disk. There is no charge for the diagnostic, and the scope goes into writing first. Forensic work is paid upfront at the time you accept our fixed quote. On other services, in most cases you only pay if we recover your data (electronic and mechanical failures, chip-level work and physical damage are 50% upfront, with the balance only if we recover your data). Standard rates for ordinary recovery bands can be found on the data recovery cost page.
Just one of these on its own is enough to justify capturing a machine instead of wiping it.
The sums only point in one direction. An image taken now costs a small fraction of what the same evidence is worth once there is something to spend it on, and the hardware can go straight back into service afterwards, since the evidence no longer relies on it. Skip that step, pass the laptop to the next starter in line, and their work will settle over the previous user's traces a day at a time. Businesses that routinely image each leaver's machine never find themselves explaining a gap to a tribunal. Get a quote first, then take the drive out (or have a local repair shop do it) and send only the drive, never the whole computer: we only need the drive. The one exception with no way round it is storage soldered flat to the mainboard, which is how Apple Silicon machines and a number of ultrabooks are built; that storage is not taken on, so if it cannot come out, there is no parcel to make up. If you're not sure which kind you have, ring us first.
Far more than simply the documents. Browsing history, cache and cookies reconstruct research, uploads and the accounts somebody signed into. Drafts and autosaved copies that nobody consciously kept are mixed in among the temporary files. Fragments of memory, like a document that was open, a chat window and occasionally a credential, are held in the page file and the hibernation file. Teams and Slack keep local caches that can bring back conversations even after they have been deleted from the applications themselves. Prefetch entries record which programs were run, how many times and when. Connection and VPN records put the machine on a particular network at a particular hour. An afternoon of rebuilding disposes of every one of these. A capture keeps them for however long you need them.
Encryption rewards the early mover and punishes those that wait. A BitLocker or FileVault device should be imaged while the recovery key is still in escrow and the password is still known, which means before the leaver's account is closed, before the directory is tidied, and before a rebuild clears the TPM. On Windows estates the key is usually still held in Entra ID, Intune or the Microsoft account tied to the machine, and on Macs the recovery key will generally sit with the MDM or with the user. On a live, unlocked Windows volume there is another option: a shadow copy taken from the running system, which sidesteps the encryption question entirely because the volume is already open while you hold it. The honest limit is blunt. Full-disk encryption on a powered-off machine, with no key anywhere and no escrow, is not something anybody opens.
A claim of wiping gets tested rather than simply accepted. The erase utilities and boot tools used leave behind their own evidence: boot records, tool signatures, the repeating pattern an overwrite leaves across the surface, and timing that can be compared with everything else that happened that week. Wipes are frequently interrupted or run with the wrong settings, which leaves whole regions readable, while a drive-level secure erase can be read against the device's own logs. If the wipe genuinely completed, the report says so and dates it, because deliberately erasing a machine as proceedings come into view is a finding in its own right, and often a more useful one than the files themselves would have been.
Verification and the custody file are covered at the forensic recovery hub. Reading deletion evidence off a copy is deleted-file forensics, and the obligation to preserve evidence is legal hold and chain of custody. If there is nobody in dispute over a locked volume, then it is just an ordinary job instead: see BitLocker recovery and the bands on the prices page.
Acquired once, verified once, and then waiting for whatever the dispute eventually asks of it.
The complete disk image, in a format that any examiner can mount and check for themselves.
SHA-256 hash values showing the image and every working copy stand exactly as they were acquired.
Browsing history, cache and cookies, which reconstruct research, uploads and sign-ins.
Page file and hibernation contents, such as open documents, chats and sometimes a credential.
Teams and Slack local stores, even where the conversations have since been deleted.
VPN records and connection logs tying the machine to a specific network at a stated hour.
Let's start with the part people are least often told about: a forensic examination is paid upfront, once you accept the fixed quote. The arrangement where in most cases you only pay if we recover your data belongs to recovery work, and even there electronic and mechanical failures, chip-level work and physical damage are 50% upfront, while DVR, forensic, BitLocker and ransomware work is paid upfront. An examination is bench time spent answering a question, so it is charged whether the findings help you or not. What it does have is two published figures, which is two more than many other laboratories will put in front of you. An examination that ends in a full written report is priced at £800 + VAT. An examination that stops at the evidence itself, a verified binary image with the deleted material extracted out of it and handed over for another party to interpret, is priced at £400 + VAT. That second figure is the same point on the list as a recorder disk or a BitLocker volume, so it adds nothing new to the five bands listed throughout the rest of the site.
The examination itself, together with the full written report that comes out of it, produced so that an expert acting against you can follow each and every step and test it.
The verified binary image with the deleted files extracted from it, and no report written. It is the same figure a recorder disk or an encrypted volume carries, not an additional band.
Both figures assume there is only one machine and one question being put to it. Nine laptops, a file server and a tenancy export is a bigger exercise, so anything involving several devices is measured after the free diagnostic and written down before you agree to it. Diagnosis still costs nothing and still closes 2 working days after you book the device in, and the fee is paid upfront once you accept the fixed quote, before an examiner even opens the image rather than after. Encrypted volumes are treated the same way, so BitLocker and FileVault jobs are also paid upfront rather than only if we recover your data. Everything that is not forensic keeps its published band on the prices page.
Capture is carried out on company-owned equipment, on hardware you own yourself, or on written instruction from a solicitor. There have always been three routes to this bench and there has never been a fourth. Equipment that the business itself bought and issued. A written instruction from a solicitor, an insurer or the court. Or a device that genuinely belongs to the person asking, which in a family matter means one owned outright or owned jointly. We do not break into anything here. We do not work out anybody else's password, we do not put monitoring software onto a device the client does not own, and live traffic is never intercepted, as interception belongs to the bodies listed in the Investigatory Powers Act 2016 and no others. Where a client has no lawful right to look inside a device, instructing us does not give them one. Handsets and tablets are excluded from the practice altogether.
Ring 0800 689 0668 with your two key pieces of information to hand: the number of machines you are talking about, and whether any of them are encrypted. The capture then gets scoped and quoted in writing before a single item moves, and only the drives need to be sent, not the machines themselves. No part of this network collects and there is no counter in Bracknell, so drives reach our Guildford lab by tracked, insured post (or a courier booked by yourselves), or you can drop them off at Guildford Data Recovery, Building 2, Ground Floor, Guildford Business Park, Guildford GU2 8XH, Monday to Friday, 9am to 5:30pm, with no appointment needed. Custody is recorded at booking-in.
Is the hard drive still bolted into a machine, whether that is a laptop, a tower, an iMac, a MacBook, a rack server or a DVR stored under the till? Get a quote first, then pull the drive out of the machine and send only the bare drive (never the entire machine): from a server the disks come out labelled by bay, and from a DVR you just send the disk. Stripping hardware is not something our lab does, though any repair shop on your high street can do it in about ten minutes. The one case with no way round it is memory chips soldered flat onto the mainboard, which is how T2 and Apple Silicon Macs and certain ultrabooks are built, and that storage is not taken on. Call us first if you're not sure which kind you have. Where the storage cannot be unbolted, there is no parcel to make up.
↓ Print the shipping & booking-in form (PDF)
With your quote in hand, the name on the parcel wants to be Guildford Data Recovery. Driving it over from Bracknell takes roughly forty minutes along the A322 followed by the A3, and you do not need an appointment; posting it costs you a stamp and a day. Either way, a message goes out to you as soon as the package has been logged onto our system, and two working days after that the diagnostic is finished.
Unsure which items should go in the box? Call 0800 689 0668 whilst the box is still open, or work through the free online diagnostic and let it guide you.
Everything the machine still knows fits within a single capture, so ring the freephone number while it is still sitting on the shelf.