Litigation changes what a laptop is. Once proceedings are in prospect, a device or an account can no longer be simply an IT asset, but rather it becomes potential evidence, and the way it is handled will be examined just as hard as its contents. For solicitors in the city centre, and for the clients they act for, preservation is put on a documented footing that can stand up to being picked over.
◇ Scope first, then work. After the free diagnostic and the written scope, forensic casework is payable upfront on acceptance of the fixed price. For all other jobs, in most cases you will only be charged if we recover your data. Full pricing is set out on our data recovery cost page.
Preserving evidence is cheapest when it still feels unnecessary.
A hold is first of all a record. All devices and accounts in scope are listed individually. Each one is captured, and the record shows when it was captured, who did the capture, and the equipment used. A SHA-256 value is generated as each image is made, so a change afterwards shows up as a failed verification rather than as a surprise in the witness box. Originals go sealed into secure evidence storage, and every movement after that, from the bench to the safe to the court, is recorded with nothing unaccounted for in between. Continuity is exactly what an opposing expert looks at first, and keeping it dull is the whole point of this service.
Handling follows the digital evidence principles ACPO published for police in the UK, which the NPCC now maintains. Nothing done should change the original. Anyone who accesses it has to be able to show what they did. An independent party should be able to repeat the process from the audit trail and come up with the same results. One named person has overall responsibility. Work here is prepared to evidential standards, whether it is going to an employment tribunal or to civil or criminal proceedings. Admissibility is decided by the court, so no honest practice can promise it; what can be promised is a method that leaves a court nothing to pause over.
Evidence lost to litigation is mostly lost innocently. A laptop goes to someone who just started. An account gets deleted as part of routine housekeeping. A technician has a look round with the best of intentions. As proceedings draw near, the main threat is reuse: it writes over what you want, it changes the dates, and it invites the suggestion that the missing part was convenient. The advice isn't glamorous. Arrange capture for the day the hardware is handed back, rather than after three weeks in a drawer. Only hand a machine on once an image of it verifies. Write down every step in between.
Preserved material will have to be produced at some point, so it's best to plan it that way from the start. The findings appear first, in plain English. The method goes into an appendix an opposing expert can follow back. The exhibit schedule lists each image with its hash values, how it has been handled since it was made, and the device it came from. Matters heading for the Business and Property Courts are prepared with the disclosure duties under Practice Direction 57AD in mind, and any joint instruction or agreed directions are followed to their terms.
The bench discipline all of this rests on is described at the forensic recovery hub. Capture belongs to workstation deep imaging, and the matter a hold most often protects to employee data theft. Costs are on the prices page.
A file the other side is welcome to read line by line, which is rather the point.
Devices and accounts in scope, listed out and dated.
Hour, operator and equipment recorded against each image taken.
SHA-256 at capture, and at every verification made since.
Exhibits sealed in secure evidence storage, movements entered.
A signed trail across each handover, with nothing missing.
Disclosure ready, tying each image to a source and a hash.
Each instruction starts with the free diagnostic, which takes 2 working days from the day it arrives at the bench. Forensic casework is paid upfront on acceptance of the fixed quote, before work starts. The fixed price for the full investigation with report is £800 + VAT. The less expensive forensic binary image and deleted-file extraction service without report is £400 + VAT. Both figures also appear on the prices page, and no money will be taken until a written scope has been agreed. Send us the drives, not the machines.
Preservation and hold work is done on behalf of a company on its own estate, or for solicitors with written instructions. There are three footings that open the door, and there is no fourth: kit the company itself owns; a written instruction from solicitors, insurers or the court; or a device that genuinely belongs to the client, which in a family matter means their own machine or one owned jointly. We will never hack. Live communications are never intercepted. If a client has no right to look inside a device, then neither do we.
A hold is scoped by telephone before anything moves: call 0800 689 0668, run through devices, accounts and dates with us, then exhibits (the drives, not the machines) come by tracked, insured post or over the counter. They are signed into secure storage at our Cambridge location, with custody logged from arrival.
Is the drive still bolted inside a laptop, desktop, MacBook, iMac, server or CCTV / DVR recorder? Before sending, remove the hard disk drive (HDD) or solid state drive (SSD), as we do not accept whole units. From a DVR or recorder, send just the disk. From a server or RAID, take out the disks and clearly label each disk by bay number. A network attached storage (NAS) device may be sent as its disks if they can be removed; otherwise please send the NAS itself. There is only one type of drive we are unable to accept: storage soldered onto a motherboard (e.g. Apple Silicon Macs, extremely thin laptops). In such cases, if the storage cannot be taken out it cannot be accepted. If you are unsure whether you have a removable drive or not, call us before sending anything.
↓ Print the shipping & booking-in form (PDF)
Please mark the parcel for the attention of Cambridge Data Recovery. It takes about an hour and twenty minutes to travel from Norwich along the A11, then two minutes off the A14 at Junction 32. Otherwise you can post it using a tracked service and we will receive it the following working day. We will contact you as soon as we have your drive and it is booked onto our bench.
If you're unsure of what to include in the box, please call us on 0800 689 0668 before sealing it. Or, for a first view on what we can do, you can use our free online diagnostic.
Arranging a hold this month will cost you less than explaining next year why there wasn't one.