Litigation alters what a laptop is. From the moment proceedings are in prospect, a device or an account stops being an IT asset and becomes possible evidence, and the handling of it will be gone over as hard as the contents. For solicitors in the city centre, and for the clients they act for, preservation is put on a documented footing that stands being picked over.
◇ Scope first, then work. The free diagnostic comes at the start and the written scope follows it; forensic fees are paid in full before an examination begins. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Full pricing is on the data recovery cost page.
Preserving evidence is cheapest at the stage where doing it still feels unnecessary.
Before anything else, a hold is a record. Devices and accounts within scope are listed one by one. Each is captured, and the capture is logged with the hour, the operator and the equipment used. SHA-256 values are computed as each image is made, so a change afterwards turns up as a verification that fails rather than as a surprise in the witness box. Originals go sealed into secure evidence storage, and every move after that — bench to safe, safe to court — is entered with nothing unaccounted for in between. Continuity is what an opposing expert reaches for first, and making it dull is the whole object of this service.
Handling answers to the digital-evidence principles ACPO published for UK policing and the NPCC now maintains. Nothing done ought to alter the original. Whoever accesses it must be able to account for what they did. The audit trail has to let an independent party repeat the exercise and arrive at the same place. One named person holds overall responsibility. Work here is prepared to evidential standards, whether it is bound for an employment tribunal or for proceedings civil or criminal. Admission is the court's to decide, so no honest practice will promise it; what can be promised is a method that leaves a court nothing to pause over.
Evidence lost to litigation is mostly lost innocently. A laptop goes to a new starter. An account is purged during ordinary housekeeping. A technician has a well-meant look round. With proceedings in prospect, reuse is the danger: it writes over, it moves dates, and it invites the suggestion that the missing part was convenient. The advice is unglamorous. Arrange capture for the day the hardware is handed back, rather than after three weeks in a drawer. Hand a machine on only once an image of it verifies. Write down every step in between.
Preserved material has to be produced sooner or later, so the output is shaped for that from the start. Findings come first, in plain English. Method goes into an appendix an opposing expert can follow back. The exhibit schedule lists each image with its hash values, its custody history and the device it came off. Matters heading for the Business and Property Courts are structured with the disclosure duties under Practice Direction 57AD in view, and a joint instruction or agreed directions are followed to their terms.
The bench discipline all of this rests on is described at the forensic recovery hub. Capture belongs to workstation deep imaging, and the matter a hold most often protects to employee data theft. Costs are on the prices page.
A file the other side is welcome to read line by line, which is rather the object.
Devices and accounts inside scope, listed out and dated.
Hour, operator and equipment recorded against each image taken.
SHA-256 at capture, and at every verification made since.
Exhibits sealed in secure evidence storage, movements entered.
A signed trail across each handover, with nothing missing.
Disclosure-ready, tying every image to a source and a hash.
Each instruction opens with the free diagnostic, which takes 2 working days from the day a device reaches the bench. Forensic casework itself falls outside no fix, no fee. The full forensic investigation with report is £800 + VAT, payable 100% upfront. The less expensive Forensic binary image and deleted-file extraction service, without the report, is £400 + VAT. Any Forensic work required will be payable upfront. Both figures also appear on the prices page, and no money is taken until a written scope has been agreed.
Hold and preservation work is done for a company on its own estate, and for solicitors on written instruction. Three footings open the door and there is no fourth: kit the company itself owns; a written instruction from solicitors, an insurer or the court; or a device that is genuinely the client's, which in a family matter means their own machine or one owned jointly. We do not hack. Live communications are not intercepted. Where a client has no right to look inside a device, neither have we.
A hold is scoped by telephone before anything moves: call 0800 689 0668, run through devices, accounts and dates with us, and exhibits then come by tracked, insured post or over the counter. They are signed into secure storage at our Cambridge location, with custody logged from arrival.
Is the drive still bolted inside a laptop, desktop, MacBook, iMac, server or CCTV / DVR recorder? The hard drive or SSD needs to come out first, and only the bare drive travels — taking drives out of machines is not something we do here. Storage soldered to a motherboard (Apple Silicon Macs, one or two very thin laptops) is the single thing beyond us: if it will not come out, it cannot come in.
↓ Print the shipping & booking-in form (PDF)
Mark the parcel for the attention of Cambridge Data Recovery. From Norwich it is about an hour and twenty down the A11, then two minutes off the A14 at Junction 32 — or next working day by tracked post. You hear from us as soon as it is booked onto the bench.
Unsure what to put in the box? Ring 0800 689 0668 before you seal it, or run the free online diagnostic.
A hold arranged this month is cheaper than one you have to explain next year.