Somebody leaves a food-processing company near Dereham, or a distributor off the A11, the laptop comes back, and a month later a customer list that was built over many years is being worked by a competitor. The machine will normally settle the issue, so long as no-one has logged in first. As for us, we work on the copy and report what the copy supports.
◇ Scope first, then work. After the free diagnostic and the written scope, forensic casework is payable upfront on acceptance of the fixed price. For all other jobs, in most cases you will only be charged if we recover your data. Full pricing is set out on our data recovery cost page.
One of these by itself is enough reason to set the device aside and leave it alone until an image exists, whether the firm trades from the city, mid-Norfolk or the coast.
These kinds of cases are typically won or lost on restraint, rather than how hard you try. Signing in adds new data over the old. A well-meant look through the folders by IT will update the dates on those exact same folders. Rebuilding a laptop for the next starter is usually going to close the matter completely. As such, the drill is short and dull: power off, label it, record who has had it, and leave it as it is. The examination then runs on a copy that verifies, while the laptop itself stays sealed and unchanged, ready for the other side's expert if they want a look.
The operating system is capable of remembering far more than most witnesses. Each stick, card reader and portable drive which has ever been plugged into the computer will show up as an entry under USBSTOR, with the manufacturer, model and serial number. setupapi.dev.log gives the date each of them first appeared. Then jump lists and LNK records connect named documents with whatever drive letter the removable volume was given. Shellbags keep the folder structure somebody browsed while it was mounted. And $UsnJrnl puts each operation on the clock across the weeks that matter. Read in order, these traces take a case from unease to something a solicitor can act on.
A large part of this is done within a browser. Working on the copy, we pick up webmail sessions where attachments were sent to a personal address, rules added to a mailbox so that selected mail went out automatically, uploads through file-transfer websites, and sync clients mirroring folders up into somebody's own cloud storage. When a business uses Microsoft 365 or Google Workspace, the audit logs for that tenancy are gathered as well, so the machine's view of what happened can be set beside the service's view.
The audience we write for is a panel with a specialist sitting beside it. Our findings come first, each one numbered, dated and pointing back at the trace it was based on. All technical explanations go into an appendix. The exhibit schedule lists every image with its SHA-256 value. Where solicitors have set directions, the examination stays inside them. We put nothing in that the record will not carry, which is often why the record ends up being believed.
How images and custody are handled across the practice is explained at the forensic recovery hub. The history of connections gets a page to itself under USB device forensics, and preservation is under legal hold and chain of custody. Prices can be found on the prices page.
Each of these arrives as a numbered finding with a date on it and the trace it is based on named next to it, so that a court or a tribunal can work from it.
Captured before it is put back into service, a leaver's computer will normally give up all of it.
Manufacturer, model and serial number of every item plugged in, with the first date and the last.
Journal entries and destination timestamps placing files on a device at stated hours.
Jump lists and LNK records tying named documents to the drive letter used.
Webmail sends, mailbox rules and private sync activity left on the machine.
Repeat visits, late sessions and messages related to what was intended.
Capture time and date against the leaving date, with SHA-256 values.
Each instruction starts with the free diagnostic, which takes 2 working days from the day it arrives at the bench. Forensic casework is paid upfront on acceptance of the fixed quote, before work starts. The fixed price for the full investigation with report is £800 + VAT. The less expensive forensic binary image and deleted-file extraction service without report is £400 + VAT. Both figures also appear on the prices page, and no money will be taken until a written scope has been agreed. Send us the drives, not the machines.
Employee matters run on equipment that the company owns, with either HR or a solicitor behind it. There are three footings for opening the door and there is no fourth: the company itself owns the kit; a written instruction from solicitors, insurers or the court; or a device that is genuinely the client's (and in family matters this means either their own machine or one owned jointly). We do not hack. We do not intercept live communications. If the client does not have the right to look inside the device, neither do we.
A drive that is being used as evidence travels under conditions agreed in advance. To make arrangements for the packing, the paperwork and a quote, please call us on 0800 689 0668; send the hard drive, not the computer. We do not offer collection, so it comes via tracked and insured post or over the counter, and once it is signed for at our Cambridge location, the custody file is opened.
Is the drive still bolted inside a laptop, desktop, MacBook, iMac, server or CCTV / DVR recorder? Before sending, remove the hard disk drive (HDD) or solid state drive (SSD), as we do not accept whole units. From a DVR or recorder, send just the disk. From a server or RAID, take out the disks and clearly label each disk by bay number. A network attached storage (NAS) device may be sent as its disks if they can be removed; otherwise please send the NAS itself. There is only one type of drive we are unable to accept: storage soldered onto a motherboard (e.g. Apple Silicon Macs, extremely thin laptops). In such cases, if the storage cannot be taken out it cannot be accepted. If you are unsure whether you have a removable drive or not, call us before sending anything.
↓ Print the shipping & booking-in form (PDF)
Please mark the parcel for the attention of Cambridge Data Recovery. It takes about an hour and twenty minutes to travel from Norwich along the A11, then two minutes off the A14 at Junction 32. Otherwise you can post it using a tracked service and we will receive it the following working day. We will contact you as soon as we have your drive and it is booked onto our bench.
If you're unsure of what to include in the box, please call us on 0800 689 0668 before sealing it. Or, for a first view on what we can do, you can use our free online diagnostic.
Switch it off, call the freephone, and let a verified copy do the answering.