Recovery asks a single question: are the files back. Forensic work asks a harder one, and asks it a year later in front of somebody paid to pull the answer apart. The device is therefore copied a single time, each hash written into the file as it is taken, and the conclusions phrased so that a tribunal panel can follow them without an interpreter. Freight forwarders behind the north docks instruct us. So do accountants and brokers in the commercial district, and the studios and software houses of the Baltic Triangle.
◇ Scope first, then work. Diagnosis is free and comes at the beginning; the written scope follows, and the forensic fee is paid in full before an examiner opens the image. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. The whole price list sits on the data recovery cost page.
Lifting files off a dying disk is engineering, and a good many people can do it. Forensics is the paperwork that survives cross-examination: an account, written while the work happens, of exactly how those files were obtained. None of the order is improvised. A hardware write-blocker goes between the drive and the bench. The disk is copied into E01 evidence files. SHA-256 confirms the copy against the original. The device is sealed, labelled and entered in the custody file, and every question after that is put to the copy. Findings are numbered, dated and anchored to the artefact they came from. Strip that away and what remains is a recovery, not an examination.
Three headings organise the pages beneath. Detection and evidence recovery answers what happened, whether on a machine, on a card, or inside a cloud tenancy. Legal work and chain of custody answers how it was kept: preserved, hashed, stored, and documented well enough for the other side to read every line without finding a gap. Insider investigation is those two disciplines pointed at one named dispute and one fixed run of dates.
Four services that answer what took place: which material went and at what hour, what moved onto sticks and cards, what left through a mailbox or a cloud account, and what a single whole-machine capture preserves.
Evidence is worth precisely what its handling can be shown to be worth, which makes preservation, hashing, storage and the custody file a discipline of its own. Machines that are locked or wiped belong with workstation deep imaging: BitLocker and FileVault taken while the keys can still be produced, erase runs identified and given dates.
Here the subject is a person rather than a box: credentials used where they should not be, the records a server writes without being told to, and the four instructions that arrive most often.
The page you arrived on changes the subject matter. It does not change any of this.
The exhibit is seen only through a hardware write-blocker, which makes it impossible for anything done at this bench to reach the original drive.
Every disk becomes an E01 evidence container, a format the expert on the other side can open, verify and re-examine without our help.
A hash is taken as the copy is written and taken again later; an image altered in between fails the comparison and says so.
Indexing, artefact extraction, deleted-file recovery and timeline construction are performed against the image, never the exhibit.
Protected documents, sealed archives and encrypted volumes are opened with Passware where the client owns the right to their contents. Where that right is absent, so is the work.
Seals, signatures and movements are recorded from the moment the parcel is booked in at the Manchester laboratory until the exhibit is returned.
Diagnosis is free and takes 2 working days from the morning the parcel is opened. Nothing forensic runs under no fix, no fee. A forensic investigation ending in a written report is £800 + VAT, settled in full before the examination opens. Where no report is wanted, the binary image with deleted-file extraction stands on its own at £400 + VAT. Forensic work is paid for in advance, without exception. Recorder and DVR jobs, BitLocker volumes and ransomware cases count as forensic for this purpose and are paid for in advance in the same way. The same two figures appear on the prices page, and you are asked for nothing until the written scope has been agreed.
Most instructions arrive from employers, HR departments and solicitors; a private client stands in the same queue on the same terms. Only three routes reach an examination and there is no fourth. Hardware the business itself bought. A written instruction from solicitors, from an insurer or from the court. Or a device belonging to the client, which in a family matter extends to a machine the couple own between them. Nothing is broken into on this bench. Live traffic is never intercepted: that power belongs to the agencies named in the Investigatory Powers Act 2016 and nowhere else. If a client may not lawfully look inside a device, the answer here is the same one.
An exhibit does not travel like an ordinary parcel. Ring 0800 689 0668 first and we will fix the packaging, the paperwork and the timing between us. There is no collection anywhere in this network and no counter in Liverpool, so it goes by tracked, insured post to the Manchester laboratory, and custody opens the moment it is booked in.
Still screwed inside a laptop, tower, MacBook, iMac, server or a CCTV recorder? Take the drive out and post that on its own. We do not strip machines here, and any computer shop will do it in a few minutes. The one job nobody can take on is flash soldered straight to a logic board, as on Apple Silicon Macs and a handful of very slim laptops: if the storage will not unbolt, there is nothing to send.
↓ Print the shipping & booking-in form (PDF)
Address it to Manchester Data Recovery. It is roughly 35 miles from Liverpool along the M62 if you fancy the run, and next working day by tracked post if you do not. We ring or email the moment it is booked in, and the free diagnostic closes 2 working days after that.
Not sure what belongs in the parcel? Call 0800 689 0668 before you tape it shut, or step through the free online diagnostic first.
Free diagnosis, a written scope, images that verify. Ring the freephone and we will tell you what a machine can settle and what it cannot.