A sales manager resigns from a freight forwarder in Bootle; a buyer leaves a wholesaler on one of the estates off Speke Boulevard. Six weeks later a customer list nobody else could have built is being worked by a competitor. The returned laptop usually holds the answer, and holds it right up until somebody signs in and starts writing over it. Everything here is done on a verified copy, and the report claims only what that copy will support.
◇ Scope first, then work. Diagnosis is free and comes at the beginning; the written scope follows, and the forensic fee is paid in full before an examiner opens the image. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. The whole price list sits on the data recovery cost page.
Any single one of these justifies pulling the device out of circulation and leaving it alone until a copy exists, whether the firm trades from the waterfront, from Speke or from the Wirral side of the river.
Restraint decides these cases more often than effort does. Every login writes fresh data across the old. A helpful look round by the IT team alters exactly the dates that later matter. A rebuild for the next starter ends the enquiry outright. The routine is therefore short and unexciting: shut it down, label it, list everyone who has handled it, and leave it alone. Analysis then proceeds against a copy that verifies, and the machine itself stays sealed, so that an expert instructed by the other side can examine the same hardware and reach their own view of it.
An operating system makes a better witness than most people. USBSTOR holds an entry for every stick, card reader and portable drive ever attached, carrying manufacturer, model and serial, while setupapi.dev.log records the day each of them first appeared. LNK files and jump lists connect named documents to the drive letter the removable volume was given. Shellbags preserve the folders somebody browsed while it was mounted. $UsnJrnl timestamps the operations one by one across the weeks at issue. Assembled in order, that material turns a suspicion into something a solicitor can act on.
The browser now carries most of it. On the copy we find webmail sessions with attachments addressed to a private account, mailbox rules quietly pushing selected mail outward, uploads to file-transfer sites, and a sync client mirroring folders into personal storage. Where the business runs Microsoft 365 or Google Workspace, the tenancy audit records are collected too, which allows the service's version of a given hour to be laid against the machine's version of the same hour.
The intended reader is a tribunal panel with a technical assessor beside it. Findings lead, numbered and dated, each tied to its source artefact, and the technical reasoning goes to an appendix. Every image on the exhibit schedule carries its SHA-256 value. If the matter is instead bound for the High Court — an interim injunction, or a search order against a former employee — the same material supports the application, because it was captured early and documented as it was captured. Nothing is asserted beyond what the record carries, which is the reason the record tends to be accepted.
Imaging and custody across the practice are described at the forensic recovery hub. Connection history has its own page at USB device forensics, and preservation at legal hold and chain of custody. Every figure is on the prices page.
Each item below arrives as a numbered finding, dated, with the artefact it rests on named beside it, in a document a tribunal or a judge can work from.
Imaged before it returns to service, a leaver's computer usually surrenders all six.
Every item ever attached, by manufacturer, model and serial, with first and last dates.
Journal entries and destination timestamps placing named files on a device at stated hours.
LNK files and jump lists connecting documents to the letter the removable volume held.
Webmail sends, mailbox rules and personal sync activity still resident on the machine.
Repeat visits, late sessions and messages that speak to intention.
Capture date against leaving date, carried by SHA-256 values that still verify.
Diagnosis is free and takes 2 working days from the morning the parcel is opened. Nothing forensic runs under no fix, no fee. A forensic investigation ending in a written report is £800 + VAT, settled in full before the examination opens. Where no report is wanted, the binary image with deleted-file extraction stands on its own at £400 + VAT. Forensic work is paid for in advance, without exception. The same two figures appear on the prices page, and you are asked for nothing until the written scope has been agreed.
Employee investigations run on hardware the business owns, with HR standing behind them or a solicitor instructing. Only three routes reach an examination and there is no fourth. Hardware the business itself bought. A written instruction from solicitors, from an insurer or from the court. Or a device belonging to the client, which in a family matter extends to a machine the couple own between them. Nothing is broken into on this bench. Live traffic is never intercepted: that power belongs to the agencies named in the Investigatory Powers Act 2016 and nowhere else. If a client may not lawfully look inside a device, the answer here is the same one.
Once a machine is an exhibit it travels on terms agreed in advance. Ring 0800 689 0668 and we will settle packaging and paperwork. Nothing is collected and Liverpool has no counter, so it goes by tracked, insured post to the Manchester laboratory, and the custody record opens at booking-in.
Still screwed inside a laptop, tower, MacBook, iMac, server or a CCTV recorder? Take the drive out and post that on its own. We do not strip machines here, and any computer shop will do it in a few minutes. The one job nobody can take on is flash soldered straight to a logic board, as on Apple Silicon Macs and a handful of very slim laptops: if the storage will not unbolt, there is nothing to send.
↓ Print the shipping & booking-in form (PDF)
Address it to Manchester Data Recovery. It is roughly 35 miles from Liverpool along the M62 if you fancy the run, and next working day by tracked post if you do not. We ring or email the moment it is booked in, and the free diagnostic closes 2 working days after that.
Not sure what belongs in the parcel? Call 0800 689 0668 before you tape it shut, or step through the free online diagnostic first.
Power it down, ring the freephone, and let a verified copy speak for you.