A leaver's laptop is a record of the leaving. Which devices were attached and when, which documents were opened from where, which private accounts were signed in on company hardware, and what happened to all of it in the last fortnight. That record is complete on the day the machine comes back and it degrades from then on, which is why the first instruction on this page is to stop using it.
◇ Authority first. Bench afterwards. The full examination, written up as a report, comes to £800 + VAT. Stop at a verified image with its deleted material extracted and nothing reported, and it is £400 + VAT — the rung a recorder disk already occupies. Diagnosis is free and the scope is agreed in writing beforehand. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Ordinary recovery bands are on the data recovery cost page.
One of these on its own is reason enough to take the device out of circulation and leave it alone until a copy exists — the same answer whether the firm trades from Leicester, Loughborough, Hinckley or Market Harborough.
The commonest way these cases are lost has nothing to do with the evidence. A laptop comes back, somebody in IT has a look through it, the asset ticket says reimage, and three weeks later a solicitor asks what was in the downloads folder. Every day the machine stays in normal use consumes unallocated space and overwrites the very material an examination reads. Take it out of service, cancel the rebuild in writing, note who has handled it since the handover, and get an image taken. Everything else on this page assumes that step has been done.
A Windows machine records a great deal that nobody configured it to record. Every removable device it has ever mounted, by maker, product and serial, with first and last connection times. Shortcut and jump-list entries binding named documents to the volume they were opened from. Shellbags describing folders browsed on a drive that is no longer present. Prefetch entries naming programs that ran and how often. The change journal, ordering file operations minute by minute. Security event logs supplying the account and the session. Individually these are fragments; assembled and cross-checked they are a narrative with dates on it.
Removable media gets the attention, and in this practice it is no longer the majority route. Personal cloud clients signed in beside the corporate one, mirroring folders quietly in the background. Webmail sessions in the browser with attachments going out. Large-file transfer sites. Company mail forwarded onward by a rule that also deletes its own evidence from sent items. Whole SharePoint libraries downloaded in an evening. Printing, which people forget entirely and which leaves a spool record and a job history. An examination that only looks at USB will miss most of what modern cases turn on.
An employment tribunal or a civil court will not read a tool's output, and neither will your own board. The report opens with numbered findings in plain English, each tied to the artefact that supports it and the date it carries. Where a finding could be read two ways, both readings go in. Where the evidence establishes that an account did something rather than that a person did, the report says so in terms and leaves the inference to the tribunal. Method sits in an appendix so an expert on the other side can test each step. Reports written to please the instructing party are the ones that come apart in cross-examination, and they take the case with them.
The imaging and custody discipline is at the forensic recovery hub. The removable-media half of this work is at USB device forensics, the mailbox and cloud half at email and cloud exfiltration, and preserving the hardware properly at legal hold and chain of custody. Where the material at stake is drawings, source code or formulations, trade secret and IP theft is the version written for that.
Nothing on this list costs money and every item on it is worth more than the examination that follows. In rough order of importance: stop using the device and do not let anybody else use it either; leave it switched off rather than leaving it on a desk logged in. Cancel any rebuild, reimage or disposal ticket, in writing, so nobody clears it in good faith. Write down who has touched it since the person left and what they opened. Preserve the mailbox and the tenancy audit log now, because those expire on a timer and the timer is short. Keep any pen drive, portable disk or card that came back with the hardware, unopened and unformatted. And decide who inside the business is allowed to know, because a confrontation before the evidence exists is how machines get wiped.
Each thread is dated, attributed to a profile, and traced back to the artefact it came from.
A full inventory of removable hardware, each entry with its serial and dates.
Journal lines and destination timestamps placing named documents on a device.
Link and jump-list records tying documents to the volume they were read from.
Browser sends, mailbox rules and sync-client logs still present on the disk.
Wholesale folder access, print jobs, late sessions, messages about the new job.
The gap between leaving date and capture date, with hashes that still match.
The least popular sentence first. Forensic work does not sit under no fix, no fee. That guarantee belongs to logical recovery, and the exclusions published beside it are electronic and mechanical failures, chip-level work, DVR jobs and forensic jobs. An examination is bench hours spent answering a question you have asked, and the hours are the same whether the answer helps your case or wrecks it. Against that, two figures are printed here rather than quoted on application, which is two more than most laboratories will commit to in public. Where the examination finishes with a full written report the fee is £800 + VAT. Where it finishes at the evidence — a verified binary image with the deleted material lifted out of it, handed to your solicitor or to another examiner to interpret — the fee is £400 + VAT. That lower figure is the same rung as a recorder disk or a BitLocker volume, so nothing on this page invents a sixth band.
The examination plus the written report it produces, set out so that an expert paid to disagree with you can follow every step and try to break it.
The verified binary image with its deleted material extracted, and no report written. The rung a recorder disk or an encrypted volume already occupies, not an extra band.
Both assume a single machine and a single question asked of it. Eleven laptops, a file server and a tenancy export is a larger exercise altogether, so anything spanning several devices is measured during the free diagnostic and written down before you are asked to agree to it. Working out what is there costs nothing and still closes 2 working days after the device is booked in at Cambridge, and the fee is settled before an examiner opens the image rather than after the findings are known. Anything that is not forensic keeps the band it has always had on the prices page.
Employer instructions are taken on hardware and accounts the business owns and issued, and a solicitor's written instruction is welcome but not required for that. Three routes reach this bench and there has never been a fourth. Kit the business bought and issued to somebody. A written instruction from a solicitor, an insurer or the court. Or a device that genuinely belongs to the person asking, which in a family matter means owned outright or owned jointly. Nothing is broken into here. Somebody else's password is not worked out, monitoring software is not installed on a device the client does not own, and live traffic is never intercepted — interception belongs to the bodies named in the Investigatory Powers Act 2016 and to no private laboratory. Where a client has no lawful right to look inside a device, instructing us does not manufacture one. Handsets and tablets are outside the practice altogether.
Cancel any rebuild or disposal ticket in writing first, then ring 0800 689 0668 and we will agree what travels. Send the drive rather than the whole computer where it comes out. Nothing is collected anywhere in this network and Leicester has no counter: it reaches Cambridge by tracked, insured post, or across the counter there in office hours, and custody opens the moment it is booked in.
The general rule is the drive travels and the machine stays behind — out of the laptop, out of the tower, out of the iMac, out of the recorder under the counter. This bench does not dismantle equipment, and a repair shop will do it while you wait. Three things are the other way round, and getting them wrong costs you the recovery: an external drive stays sealed in its own case, a NAS comes as a complete unit, and a WD My Passport or My Book travels whole with its cable, because on those the encryption key is held on the bridge board rather than on the disk — separate the two and the data becomes unreadable even to us. A Fusion Mac needs both of its drives, each labelled. The one thing nobody can work round is flash soldered onto the mainboard, as on Apple Silicon machines: if it will not come off, there is nothing to post.
↓ Print the shipping & booking-in form (PDF)
Address it to Cambridge Data Recovery. It is about seventy miles from Leicester if you fancy driving it — M1 south to Junction 19, then the A14 east — and the lab is two minutes off Junction 32 with parking at the door. Posting costs you a stamp and a day instead. Whichever you choose, you hear from us the moment it is booked in, and the free diagnostic closes two working days after that.
Not certain what belongs in the box? Ring 0800 689 0668 before you tape it up, or let the free online diagnostic ask the questions for you.
Cancel the rebuild in writing, leave the machine switched off, and ring the freephone before anybody has a look through it.