There is only one time to capture a returned laptop for forensics, and that time lies between when the laptop is handed back and when it is rebuilt. Captured in that small window, read through a write-blocker into E01 evidence files and checked with SHA-256, it will continue to answer questions for years. If the laptop is placed back into service, however, it will answer fewer questions each week. Employers in Norfolk can apply this easy rule: the questions will keep; the image will not.
◇ Scope first, then work. After the free diagnostic and the written scope, forensic casework is payable upfront on acceptance of the fixed price. For all other jobs, in most cases you will only be charged if we recover your data. Full pricing is set out on our data recovery cost page.
One of these is enough to put a machine on the list, well ahead of the rebuild queue.
The scales are tipped heavily one way. The cost of taking an image today, with the disk read behind a write-blocker into E01 evidence files and checked with SHA-256, is a small fraction of what that evidence may be worth once there is a dispute to spend it on, and the hardware goes back into service afterwards because the evidence no longer depends on it. If the image is not taken and the laptop is handed on, each day of a new user's work is written on top of the previous user's traces. Firms that make a habit of capturing leavers' computers never have to explain a gap.
A great deal more than the documents themselves. The browsing history, cache and cookies can be used to put research and uploads back together. Drafts and copies that were never intentionally saved sit in the temp files. Portions of whatever was in memory (a document left open, a chat window, and sometimes credentials) can remain in the pagefile and hibernation file. Slack and Teams keep local caches that give back conversations since deleted from the apps. Which networks the machine was on, and at what hour, comes from the VPN and connection logs. A rebuild removes everything; a capture keeps it.
Encryption needs to be addressed at an early stage. Where a device is encrypted with BitLocker or FileVault, it should be imaged while its keys are still in escrow and its passwords still known, before the leaver's account is closed, the directory is tidied, or a rebuild clears the TPM. For a live and unlocked Windows volume, there is a second option: pulling Volume Shadow Copies from the running system, as these get around the encryption question since the volume is open while you are holding it. All encrypted-volume work is classed as forensic and, like everything on this page, is paid upfront once you accept the fixed quote.
A claim of wiping is tested instead of taken at face value. Erase utilities and boot tools, DBAN included, leave evidence of their own: boot records, signatures for each tool, the pattern an overwrite leaves behind, and timing which can be tied to everything else going on that week. Runs that were interrupted or only partly completed happen quite often and leave whole regions recoverable, and a hardware erase command can be compared with the drive's own logs. When the wipe really was completed, the report says so and gives the date, since wiping a drive deliberately as proceedings approach is a finding on its own.
For information about how we handle custody and verification please see our forensic recovery hub. What deletion evidence looks like on a copy is covered by deleted-file forensics, and the duty to preserve by legal hold and chain of custody. Costs are on the prices page.
Taken once, verified, and then kept available for whatever the dispute requires.
An image of the entire disk, in a format other examiners can open and check.
A SHA-256 hash proving no changes were made to the image, or to copies taken from it.
History, cache and cookies rebuilding research and uploads.
Pagefile and hibernation contents: documents, chats, credentials.
Local Slack and Teams stores, restoring deleted conversations.
VPN and network traces of the machine on networks at set hours.
All instructions begin with the free diagnostic, which takes 2 working days after the device arrives at our bench. Forensic casework is paid upfront once we have given you your fixed quote and you have accepted it. The full forensic investigation, including report, costs £800 + VAT and is 100% payable upfront. The less expensive forensic binary image and deleted-file extraction service, without the report, costs £400 + VAT. Any forensic work requested will need to be paid upfront. In addition, all BitLocker and other encrypted volume work is classed as forensic, and is therefore paid upfront on the same terms. Both prices can also be seen on the prices page, and no money is taken until a written scope has been agreed.
Imaging can be done on a computer owned by the company, on hardware you own yourself, or at the direction of your solicitor. There are three footings that open the door and there is no fourth: kit the company itself owns; a written instruction from solicitors, insurers or the court; or a device that genuinely belongs to the client, which in a family matter means either their own machine or one they own jointly. We do not hack. Live communications are not intercepted. If a client has no right to look inside a device, then neither do we.
When calling 0800 689 0668, tell us how many machines there are and whether they use encryption, so we can scope the capture in writing. We do not offer collection: send the drives, not the machines, by tracked, insured post or over the counter at our Cambridge location, and custody is logged at the signature.
Is the drive still bolted inside a laptop, desktop, MacBook, iMac, server or CCTV / DVR recorder? Before sending, remove the hard disk drive (HDD) or solid state drive (SSD), as we do not accept whole units. From a DVR or recorder, send just the disk. From a server or RAID, take out the disks and clearly label each disk by bay number. A network attached storage (NAS) device may be sent as its disks if they can be removed; otherwise please send the NAS itself. There is only one type of drive we are unable to accept: storage soldered onto a motherboard (e.g. Apple Silicon Macs, extremely thin laptops). In such cases, if the storage cannot be taken out it cannot be accepted. If you are unsure whether you have a removable drive or not, call us before sending anything.
↓ Print the shipping & booking-in form (PDF)
Please mark the parcel for the attention of Cambridge Data Recovery. It takes about an hour and twenty minutes to travel from Norwich along the A11, then two minutes off the A14 at Junction 32. Otherwise you can post it using a tracked service and we will receive it the following working day. We will contact you as soon as we have your drive and it is booked onto our bench.
If you're unsure of what to include in the box, please call us on 0800 689 0668 before sealing it. Or, for a first view on what we can do, you can use our free online diagnostic.
One capture will hold every answer the machine has left in it; call our freephone.