Legal Hold and Chain of Custody

A hold is not an examination. It is the step that makes an examination possible later, and it is the step most often skipped because at the moment it needs taking nobody is certain there will be a dispute at all. Devices and accounts are identified, captured, verified, sealed and documented, and the paperwork is written to be handed to the other side rather than filed and forgotten.

Authority first. Bench afterwards. The full examination, written up as a report, comes to £800 + VAT. Stop at a verified image with its deleted material extracted and nothing reported, and it is £400 + VAT — the rung a recorder disk already occupies. Diagnosis is free and the scope is agreed in writing beforehand. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Ordinary recovery bands are on the data recovery cost page.

// moments that call for a hold

When preservation stops being optional

Preservation costs least at precisely the point where arranging it still feels premature, which is the whole difficulty with it.

A letter before action on somebody's desk, or a request to preserve material
A tribunal claim issued, or obviously about to be
Devices queued for reissue while the questions about them remain open
A disclosure deadline approaching with nothing captured yet
An opponent who has started attacking the integrity of what you hold
A regulator, an insurer or an auditor asking for the underlying records

The duty starts earlier than people expect

The obligation to preserve does not wait for proceedings to be issued. Once litigation is reasonably in prospect, destroying or allowing the destruction of relevant material becomes a problem in itself, and in practice the argument about it is rarely technical. It is about what was known, and when, and what was done about it. A routine rebuild that would have been unremarkable in January looks quite different in September if the letter before action arrived in February. The practical remedy is dull and cheap: identify what is relevant, stop the automatic processes that would consume it, and take copies.

Before it is anything else, a hold is paperwork

The technical half is straightforward. The half that fails is administrative. A hold needs a written scope listing the devices, accounts and systems inside it. It needs the automatic processes suspended in writing — reimaging tickets, disposal schedules, mailbox retention, log rotation, backup expiry. It needs the custodians told, in terms they will act on rather than skim. And it needs somebody named as responsible for it. Holds fail because a helpdesk rebuilt a laptop in good faith, or because retention deleted a mailbox on schedule, and both of those are paperwork failures rather than technical ones.

In practice, the job is capturing things before anyone tidies

Once the scope is written the work is mechanical. Each device is imaged behind a write-blocker into an E01 container, SHA-256 is taken during the write and again at verification, the image goes into sealed storage and the exhibit is logged. Accounts are handled by placing the mailbox on hold and exporting the audit data before retention reaches it. Servers are captured by targeted extract under an agreed scope rather than by being carried out of the building. The hardware itself goes back into service afterwards in nearly every case, which is usually the point that unlocks the argument between IT and the lawyers.

Built for disclosure from the first day

The output is written for the moment somebody attacks it. An exhibit list binding each image to its source device and its hash values. A capture log recording the time, the examiner and the equipment for every acquisition. Working notes made at the time rather than assembled afterwards. A storage record showing every movement in and out of sealed storage against a date. That file is what turns an image into evidence: without it a copy is just a copy, and the first question in cross-examination is who else could have touched it and when.

The capture itself is workstation deep imaging, the standards behind it are at the forensic recovery hub, and the two employer instructions that most often follow a hold are employee data theft and trade secret and IP theft. Mailbox and tenancy retention is dealt with at email and cloud exfiltration.

// the cheapest thing on this site

What a hold costs against what losing the material costs

Preservation is £400 + VAT a device: imaged, verified on SHA-256, sealed, and entered in a custody file you can hand to anybody. No examination, no report, no findings — just a copy that will still verify in two years and paperwork that explains itself. Examination and the written report, if you later need them, is £800 + VAT and works from the same image, so nothing is paid twice. Set that against the alternative, which is a device rebuilt in week two because nobody had authority to stop it, and a disclosure exercise in month nine with nothing to disclose. The awkward part of this arithmetic is that a hold always feels premature at exactly the point where it is cheapest.

// six documents a hold produces

What you can hand to the other side

All six exist from day one, and all six are written on the assumption that somebody hostile will read them line by line.

The schedule

Every device and account caught by the hold, itemised and dated one at a time.

Acquisition log

The hour, the examiner and the equipment, recorded as each image was taken.

Hash values

Figures at acquisition and at every check since, with each result printed.

Notes at the time

What was done and why, written as it happened and not assembled afterwards.

Storage movements

Sealed storage, with each entry and removal booked against a date and a name.

Exhibit schedule

Disclosure-ready, tying each image to its source device and its hash values.

// what it costs, and who is entitled to ask

The fee, and the authority behind the instruction

Two figures, published rather than implied

The least popular sentence first. Forensic work does not sit under no fix, no fee. That guarantee belongs to logical recovery, and the exclusions published beside it are electronic and mechanical failures, chip-level work, DVR jobs and forensic jobs. An examination is bench hours spent answering a question you have asked, and the hours are the same whether the answer helps your case or wrecks it. Against that, two figures are printed here rather than quoted on application, which is two more than most laboratories will commit to in public. Where the examination finishes with a full written report the fee is £800 + VAT. Where it finishes at the evidence — a verified binary image with the deleted material lifted out of it, handed to your solicitor or to another examiner to interpret — the fee is £400 + VAT. That lower figure is the same rung as a recorder disk or a BitLocker volume, so nothing on this page invents a sixth band.

£800 + VAT

The examination plus the written report it produces, set out so that an expert paid to disagree with you can follow every step and try to break it.

£400 + VAT

The verified binary image with its deleted material extracted, and no report written. The rung a recorder disk or an encrypted volume already occupies, not an extra band.

Both assume a single machine and a single question asked of it. Eleven laptops, a file server and a tenancy export is a larger exercise altogether, so anything spanning several devices is measured during the free diagnostic and written down before you are asked to agree to it. Working out what is there costs nothing and still closes 2 working days after the device is booked in at Cambridge, and the fee is settled before an examiner opens the image rather than after the findings are known. Preservation on its own is £400 + VAT a device. Where an examination and its written report are needed later, that is £800 + VAT and it works from the image already taken. Anything that is not forensic keeps the band it has always had on the prices page.

The footing an examination has to stand on

A hold is arranged by the party that owns the material, or by its solicitors, and joint protocols agreed between both sides are accepted as they stand. Three routes reach this bench and there has never been a fourth. Kit the business bought and issued to somebody. A written instruction from a solicitor, an insurer or the court. Or a device that genuinely belongs to the person asking, which in a family matter means owned outright or owned jointly. Nothing is broken into here. Somebody else's password is not worked out, monitoring software is not installed on a device the client does not own, and live traffic is never intercepted — interception belongs to the bodies named in the Investigatory Powers Act 2016 and to no private laboratory. Where a client has no lawful right to look inside a device, instructing us does not manufacture one. Handsets and tablets are outside the practice altogether.

// how the media reaches Cambridge

Sending a device — and the three exceptions

Stop the rebuild and disposal tickets in writing first, then ring 0800 689 0668 and we will agree the schedule and the order of capture. Send drives rather than whole machines where the disk comes out, and label RAID members with their bay order. Nothing is collected anywhere in this network and Leicester has no counter: tracked, insured post to Cambridge, or over the counter there in office hours. The custody file opens at booking-in.

The general rule is the drive travels and the machine stays behind — out of the laptop, out of the tower, out of the iMac, out of the recorder under the counter. This bench does not dismantle equipment, and a repair shop will do it while you wait. Three things are the other way round, and getting them wrong costs you the recovery: an external drive stays sealed in its own case, a NAS comes as a complete unit, and a WD My Passport or My Book travels whole with its cable, because on those the encryption key is held on the bridge board rather than on the disk — separate the two and the data becomes unreadable even to us. A Fusion Mac needs both of its drives, each labelled. The one thing nobody can work round is flash soldered onto the mainboard, as on Apple Silicon machines: if it will not come off, there is nothing to post.

  • A stiff box or a well-padded mailer, with enough packing that nothing moves when you shake it. Power supplies, docks and cables can stay at home unless the drive is one of the WD units above.
  • Running a RAID or a server? Send the member disks on their own, not the chassis or the controller, and write the bay order on each one — 1, 2, 3 and so on. Photograph the front of the unit before you pull anything, because that photograph occasionally saves a day of work.
  • Fill in the shipping and booking-in form (PDF) — a name, a number you actually answer, and a line on how the trouble started — and put it in the box.
  • Special Delivery is tracked and insured and is what most people use; your own courier is equally fine. Handing it over in person also works: reception at the Cambridge address takes devices across the counter, Mon–Fri 9:00am–5:30pm. What does not exist is a Leicester counter or anyone who comes to collect.
// write this on the label

Cambridge Data Recovery

Compass House
Vision Park, Chivers Way
Cambridge, CB24 9AD

↓ Print the shipping & booking-in form (PDF)

Address it to Cambridge Data Recovery. It is about seventy miles from Leicester if you fancy driving it — M1 south to Junction 19, then the A14 east — and the lab is two minutes off Junction 32 with parking at the door. Posting costs you a stamp and a day instead. Whichever you choose, you hear from us the moment it is booked in, and the free diagnostic closes two working days after that.

Not certain what belongs in the box? Ring 0800 689 0668 before you tape it up, or let the free online diagnostic ask the questions for you.

// legal hold — before you decide

What solicitors and IT both ask

Four things, and only one of them is technical. Decide and write down what is in scope. Suspend the automatic processes that would destroy it — rebuild tickets, disposal, retention policies, log rotation. Tell the custodians in writing. Then capture: image the devices, verify the hashes, seal them and log the exhibits. The first three are usually done inside your own organisation in a morning, and they matter at least as much as the fourth.
No, and anybody who does is selling something. Admissibility is decided by the judge or the panel on the day. What is within anybody's control is making the handling impossible to argue with: write-blocked acquisition, E01 images verified on SHA-256, contemporaneous notes, sealed storage and a custody file with no gaps in it. The object is that the evidence gets argued about rather than the way it was collected.
Rarely fatal and always worth knowing about early. A rebuilt disk usually retains a great deal of the previous volume in unallocated space, and the rebuild itself is dated, which is occasionally the more useful fact. Stop using the machine now, record who did what and when, and have it imaged. The report will describe the state it was found in, which is a far better position than discovering the gap during disclosure.
Yes, and it is the easier way to run these. Where solicitors have settled a protocol — the devices, the date ranges, the search terms, the format of the output, who receives what and when — the work is done to it and the report says so on its face. Where no protocol exists, we will set out what was done and why, in enough detail that the other side can test each step for themselves.

Preserve now. Argue from firmer ground later.

£400 + VAT a device, imaged, verified and sealed, with the hardware back in service afterwards. Ring the freephone before the next rebuild ticket closes.