Litigation changes what a laptop is. Once proceedings are in prospect, a device or an account stops being an IT asset and becomes potential evidence, and its handling will be examined as closely as its contents. For solicitors in the commercial district and in Chester, and for the clients they act for, preservation is placed on a documented footing built to be picked over.
◇ Scope first, then work. Diagnosis is free and comes at the beginning; the written scope follows, and the forensic fee is paid in full before an examiner opens the image. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. The whole price list sits on the data recovery cost page.
Preservation is cheapest at exactly the stage when it still feels premature.
Before it is anything else, a hold is a document. The devices and accounts within scope are listed individually. Each is captured, and the capture is logged with the hour, the operator and the equipment used. SHA-256 values are taken as every image is written, so a later alteration presents itself as a failed verification rather than as a surprise under cross-examination. Originals are sealed into secure evidence storage and every subsequent movement — bench to safe, safe to court — is entered, with nothing left unaccounted for. Continuity is the first thing an opposing expert tests, and making it tediously complete is the object of the exercise.
Handling follows the digital evidence principles published by ACPO for UK policing and maintained now by the NPCC. No action should change the original. Anyone accessing it must be able to explain what they did and why. The audit trail must let an independent party repeat the work and reach the same result. One named individual carries overall responsibility. Work is prepared to evidential standards whether it is destined for an employment tribunal or for civil or criminal proceedings. Admissibility is for the court to decide, so no honest practice promises it; what can be promised is a method that gives the court nothing to hesitate over.
Most evidence lost in litigation is lost innocently. A laptop goes to a new starter. An account is purged in routine housekeeping. A technician has a well-intentioned look. With proceedings in prospect, reuse is the danger: it overwrites, it shifts dates, and it invites the suggestion that whatever is missing was inconvenient. The advice is dull. Book the capture for the day the hardware comes back, not after three weeks in a drawer. Reissue a machine only once its image has verified. Record every step in between.
Preserved material has to be produced eventually, so the output is built for that from the beginning. Findings come first, in plain English. Method sits in an appendix an opposing expert can follow. The exhibit schedule ties each image to its hash values, its custody history and the device it came from. Claims in the Business and Property Courts, whether in Liverpool or in London, are organised around the disclosure duties in Practice Direction 57AD. Where the appointment is as single joint expert, or the parties have agreed directions, those terms govern the work and CPR 35.3 places the duty with the court.
The bench discipline all of this rests on is described at the forensic recovery hub. Capture itself belongs with workstation deep imaging, and the matter a hold most often protects with employee data theft. The fee itself is on the prices page.
A file the other side is welcome to read line by line, which is the entire point of it.
Every device and account within scope, listed and dated.
Hour, operator and equipment recorded against each image.
SHA-256 at capture and at every verification since.
Exhibits sealed into secure evidence storage, with movements entered.
A signed trail across every handover, with nothing absent.
Disclosure-ready, tying each image to its source and its hash.
Diagnosis is free and takes 2 working days from the morning the parcel is opened. Nothing forensic runs under no fix, no fee. A forensic investigation ending in a written report is £800 + VAT, settled in full before the examination opens. Where no report is wanted, the binary image with deleted-file extraction stands on its own at £400 + VAT. Forensic work is paid for in advance, without exception. The same two figures appear on the prices page, and you are asked for nothing until the written scope has been agreed.
Preservation work is carried out for a company across its own estate, and for solicitors on written instruction. Only three routes reach an examination and there is no fourth. Hardware the business itself bought. A written instruction from solicitors, from an insurer or from the court. Or a device belonging to the client, which in a family matter extends to a machine the couple own between them. Nothing is broken into on this bench. Live traffic is never intercepted: that power belongs to the agencies named in the Investigatory Powers Act 2016 and nowhere else. If a client may not lawfully look inside a device, the answer here is the same one.
A hold is scoped by telephone before anything moves. Ring 0800 689 0668, work through the devices, accounts and dates with us, and exhibits then travel by tracked, insured post to the Manchester laboratory. Nothing is collected anywhere in this network. Each item is signed into secure storage with custody recorded from arrival.
Still screwed inside a laptop, tower, MacBook, iMac, server or a CCTV recorder? Take the drive out and post that on its own. We do not strip machines here, and any computer shop will do it in a few minutes. The one job nobody can take on is flash soldered straight to a logic board, as on Apple Silicon Macs and a handful of very slim laptops: if the storage will not unbolt, there is nothing to send.
↓ Print the shipping & booking-in form (PDF)
Address it to Manchester Data Recovery. It is roughly 35 miles from Liverpool along the M62 if you fancy the run, and next working day by tracked post if you do not. We ring or email the moment it is booked in, and the free diagnostic closes 2 working days after that.
Not sure what belongs in the parcel? Call 0800 689 0668 before you tape it shut, or step through the free online diagnostic first.
A hold arranged this month costs less than one you have to explain next year.