Legal Hold and Chain of Custody

Litigation alters what a laptop is. From the moment proceedings are in prospect, a device or an account stops being an IT asset and becomes possible evidence, and the handling of it will be gone over as hard as the contents. For solicitors in the city centre, and for the clients they act for, preservation is put on a documented footing that stands being picked over.

Scope first, then work. The free diagnostic comes at the start and the written scope follows it; forensic fees are paid in full before an examination begins. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Full pricing is on the data recovery cost page.

// when preservation stops being optional

The moments a hold is worth the trouble

Preserving evidence is cheapest at the stage where doing it still feels unnecessary.

A preservation letter or a threat of proceedings has arrived
A tribunal claim has been issued, or is plainly on its way
A device is queued for hand-on while questions about it remain open
A disclosure deadline is approaching and nothing has been captured
The other side has put the integrity of your evidence in issue
A regulator or an insurer wants records produced

Preservation, written down as it is done

Before anything else, a hold is a record. Devices and accounts within scope are listed one by one. Each is captured, and the capture is logged with the hour, the operator and the equipment used. SHA-256 values are computed as each image is made, so a change afterwards turns up as a verification that fails rather than as a surprise in the witness box. Originals go sealed into secure evidence storage, and every move after that — bench to safe, safe to court — is entered with nothing unaccounted for in between. Continuity is what an opposing expert reaches for first, and making it dull is the whole object of this service.

The principles the handling answers to

Handling answers to the digital-evidence principles ACPO published for UK policing and the NPCC now maintains. Nothing done ought to alter the original. Whoever accesses it must be able to account for what they did. The audit trail has to let an independent party repeat the exercise and arrive at the same place. One named person holds overall responsibility. Work here is prepared to evidential standards, whether it is bound for an employment tribunal or for proceedings civil or criminal. Admission is the court's to decide, so no honest practice will promise it; what can be promised is a method that leaves a court nothing to pause over.

How a strong case goes soft

Evidence lost to litigation is mostly lost innocently. A laptop goes to a new starter. An account is purged during ordinary housekeeping. A technician has a well-meant look round. With proceedings in prospect, reuse is the danger: it writes over, it moves dates, and it invites the suggestion that the missing part was convenient. The advice is unglamorous. Arrange capture for the day the hardware is handed back, rather than after three weeks in a drawer. Hand a machine on only once an image of it verifies. Write down every step in between.

Reporting built for disclosure

Preserved material has to be produced sooner or later, so the output is shaped for that from the start. Findings come first, in plain English. Method goes into an appendix an opposing expert can follow back. The exhibit schedule lists each image with its hash values, its custody history and the device it came off. Matters heading for the Business and Property Courts are structured with the disclosure duties under Practice Direction 57AD in view, and a joint instruction or agreed directions are followed to their terms.

The bench discipline all of this rests on is described at the forensic recovery hub. Capture belongs to workstation deep imaging, and the matter a hold most often protects to employee data theft. Costs are on the prices page.

// what the custody file contains

What comes out of a hold instruction

A file the other side is welcome to read line by line, which is rather the object.

The schedule

Devices and accounts inside scope, listed out and dated.

Capture log

Hour, operator and equipment recorded against each image taken.

Hash register

SHA-256 at capture, and at every verification made since.

Storage record

Exhibits sealed in secure evidence storage, movements entered.

Custody forms

A signed trail across each handover, with nothing missing.

Exhibit list

Disclosure-ready, tying every image to a source and a hash.

// what it costs, and who we can act for

Forensic fees and the footing we work on

The fees, plainly

Each instruction opens with the free diagnostic, which takes 2 working days from the day a device reaches the bench. Forensic casework itself falls outside no fix, no fee. The full forensic investigation with report is £800 + VAT, payable 100% upfront. The less expensive Forensic binary image and deleted-file extraction service, without the report, is £400 + VAT. Any Forensic work required will be payable upfront. Both figures also appear on the prices page, and no money is taken until a written scope has been agreed.

The footing we need

Hold and preservation work is done for a company on its own estate, and for solicitors on written instruction. Three footings open the door and there is no fourth: kit the company itself owns; a written instruction from solicitors, an insurer or the court; or a device that is genuinely the client's, which in a family matter means their own machine or one owned jointly. We do not hack. Live communications are not intercepted. Where a client has no right to look inside a device, neither have we.

// getting your device to us

Getting it here — no great performance

A hold is scoped by telephone before anything moves: call 0800 689 0668, run through devices, accounts and dates with us, and exhibits then come by tracked, insured post or over the counter. They are signed into secure storage at our Cambridge location, with custody logged from arrival.

Is the drive still bolted inside a laptop, desktop, MacBook, iMac, server or CCTV / DVR recorder? The hard drive or SSD needs to come out first, and only the bare drive travels — taking drives out of machines is not something we do here. Storage soldered to a motherboard (Apple Silicon Macs, one or two very thin laptops) is the single thing beyond us: if it will not come out, it cannot come in.

  • Bubble wrap and a firm box or padded envelope, packed so nothing shifts about. Cables, caddies and power bricks are no use to us — keep them.
  • Print the shipping & booking-in form (PDF), write your name, your number and a couple of lines on what happened, and put it in with the drive.
  • Royal Mail Special Delivery covers it tracked and insured door to door; a courier of your own does the same job if that suits you better.
  • Rather hand it over yourself? Reception at the address below takes drop-offs, Mon–Fri 9:00am–5:30pm.
// where your device is headed

Cambridge Data Recovery

Compass House, Vision Park
Chivers Way
Cambridge, CB24 9AD

↓ Print the shipping & booking-in form (PDF)

Mark the parcel for the attention of Cambridge Data Recovery. From Norwich it is about an hour and twenty down the A11, then two minutes off the A14 at Junction 32 — or next working day by tracked post. You hear from us as soon as it is booked onto the bench.

Unsure what to put in the box? Ring 0800 689 0668 before you seal it, or run the free online diagnostic.

// legal hold — asked before instruction

What solicitors ask us to confirm

Working out which devices and accounts count, capturing them with hashes that verify, sealing the originals into recorded storage, and documenting each step as it happens. A few days, generally, rather than weeks. Trade carries on with replacement kit while the evidence stands still.
Nobody can, and the offer ought to worry you wherever it is made. Admission gets decided in the courtroom, on the day. Our end of it is preparation to evidential standards — the ACPO and NPCC principles followed, hashes verified, custody without a hole in it, method disclosed — which makes that decision an easy one.
Damaging rather than fatal, usually. Registries, journals and snapshots often live through reuse, and server and cloud records cover gaps the endpoint has lost. Capture it now, stop any further use, and let the report set out the handling history as it was. Saying so costs far less than glossing over it.
Yes, and it makes the exercise stronger. A joint instruction, an agreed scope or a direction of the court is followed to its terms, with the duty attaching to the proceedings and not to a side. That custody file reads identically whoever commissioned the work.

Preserve now. Argue later, from firmer ground.

A hold arranged this month is cheaper than one you have to explain next year.