This is the page where the answer is most often no, and saying so early saves everybody money. Family work is done on a machine you own, on one genuinely owned between you, or on a device named in a solicitor's instruction or a court direction. Inside those limits a great deal can be established. Outside them nothing can, and no fee changes that.
◇ Authority first. Bench afterwards. The full examination, written up as a report, comes to £800 + VAT. Stop at a verified image with its deleted material extracted and nothing reported, and it is £400 + VAT — the rung a recorder disk already occupies. Diagnosis is free and the scope is agreed in writing beforehand. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Ordinary recovery bands are on the data recovery cost page.
Your own machine, one genuinely owned between the two of you, or a device named in a solicitor's instruction or a court direction. There is no fourth category and there never has been.
Ownership decides it. A laptop that is yours, a desktop bought jointly and used by the household, a drive in both names — those can be examined on your instruction. A machine belonging to your husband or wife alone cannot, and neither can their phone, their tablet or their private accounts, whatever the state of the marriage. Guessing a password, or using one you happen to know, to reach somebody else's device is unauthorised access under the Computer Misuse Act 1990. Evidence gathered that way is worse than useless: it is inadmissible in practice, it invites a cross-application, and it hands the other side a better story than the one you started with.
It is not a rule and it is a strong preference. A solicitor's instruction sets the scope in writing, keeps the examination proportionate to what is actually in issue, and produces a report the other side's advisers can engage with rather than dismiss. In Family Court proceedings the court controls expert evidence and permission is generally needed before it is relied on, so an examination commissioned without advice may end up as an expensive document nobody is allowed to read. Where both sides agree, a single joint expert instruction is usually cheaper, faster and considerably harder to attack.
On a machine you may lawfully examine, a good deal survives. Deleted correspondence, statements and spreadsheets recovered from unallocated space and from shadow copies. Created, modified and deleted timestamps fixing each item to a date. Working material behind figures that have already been disclosed — earlier versions of a spreadsheet, the accounting export it came from, the attachments that carried it. Sign-in and browsing activity across the period in dispute. Whether a wiping tool was run and when. All of it is read off an image while your original device is written to by nobody.
An unrestricted trawl through a family computer is neither necessary nor wise. Scope is agreed first: which device, which date range, which categories, which search terms. That keeps the cost down, keeps the report focused on what the court actually has to decide, and avoids sweeping up material that is privileged or simply nobody's business. Anything plainly privileged is isolated and referred back to the solicitors rather than read. Where a joint instruction is in place, the same scope goes to both sides before the work starts and the findings go to both sides together, whatever they happen to say.
The method and custody standards are at the forensic recovery hub. Where a device needs preserving before it is sold or wiped, that is legal hold and chain of custody, and the capture itself is workstation deep imaging. Dating deletions is covered at deleted-file forensics.
Everything below is produced from an image of a device you are entitled to have examined, and nothing is produced from any other kind.
Letters, statements and spreadsheets brought back where enough survives.
The three file clocks, used to fix each recovered document to a day.
Earlier versions and source exports underlying what has already been disclosed.
Sign-in and browsing activity confined to the dates that actually matter.
The device, the date range, the categories and the search terms, settled first.
Hash values, seals and signatures, so the handling itself cannot be attacked.
The least popular sentence first. Forensic work does not sit under no fix, no fee. That guarantee belongs to logical recovery, and the exclusions published beside it are electronic and mechanical failures, chip-level work, DVR jobs and forensic jobs. An examination is bench hours spent answering a question you have asked, and the hours are the same whether the answer helps your case or wrecks it. Against that, two figures are printed here rather than quoted on application, which is two more than most laboratories will commit to in public. Where the examination finishes with a full written report the fee is £800 + VAT. Where it finishes at the evidence — a verified binary image with the deleted material lifted out of it, handed to your solicitor or to another examiner to interpret — the fee is £400 + VAT. That lower figure is the same rung as a recorder disk or a BitLocker volume, so nothing on this page invents a sixth band.
The examination plus the written report it produces, set out so that an expert paid to disagree with you can follow every step and try to break it.
The verified binary image with its deleted material extracted, and no report written. The rung a recorder disk or an encrypted volume already occupies, not an extra band.
Both assume a single machine and a single question asked of it. Eleven laptops, a file server and a tenancy export is a larger exercise altogether, so anything spanning several devices is measured during the free diagnostic and written down before you are asked to agree to it. Working out what is there costs nothing and still closes 2 working days after the device is booked in at Cambridge, and the fee is settled before an examiner opens the image rather than after the findings are known. A family instruction is £800 + VAT where you need the written report, and £400 + VAT where your solicitor wants the verified image and the extracted material to review themselves. Anything that is not forensic keeps the band it has always had on the prices page.
Family work runs on ownership and on authority, and the question is asked before the device is booked in rather than after. Three routes reach this bench and there has never been a fourth. Kit the business bought and issued to somebody. A written instruction from a solicitor, an insurer or the court. Or a device that genuinely belongs to the person asking, which in a family matter means owned outright or owned jointly. Nothing is broken into here. Somebody else's password is not worked out, monitoring software is not installed on a device the client does not own, and live traffic is never intercepted — interception belongs to the bodies named in the Investigatory Powers Act 2016 and to no private laboratory. Where a client has no lawful right to look inside a device, instructing us does not manufacture one. Handsets and tablets are outside the practice altogether.
Authority is settled on the telephone before any parcel is made up, so ring 0800 689 0668 or ask your solicitor to. Nothing is collected anywhere in this network and there is no Leicester counter: the machine or its drive goes to Cambridge by tracked, insured post, or over the counter there in office hours, and the custody file opens at booking-in.
The general rule is the drive travels and the machine stays behind — out of the laptop, out of the tower, out of the iMac, out of the recorder under the counter. This bench does not dismantle equipment, and a repair shop will do it while you wait. Three things are the other way round, and getting them wrong costs you the recovery: an external drive stays sealed in its own case, a NAS comes as a complete unit, and a WD My Passport or My Book travels whole with its cable, because on those the encryption key is held on the bridge board rather than on the disk — separate the two and the data becomes unreadable even to us. A Fusion Mac needs both of its drives, each labelled. The one thing nobody can work round is flash soldered onto the mainboard, as on Apple Silicon machines: if it will not come off, there is nothing to post.
↓ Print the shipping & booking-in form (PDF)
Address it to Cambridge Data Recovery. It is about seventy miles from Leicester if you fancy driving it — M1 south to Junction 19, then the A14 east — and the lab is two minutes off Junction 32 with parking at the door. Posting costs you a stamp and a day instead. Whichever you choose, you hear from us the moment it is booked in, and the free diagnostic closes two working days after that.
Not certain what belongs in the box? Ring 0800 689 0668 before you tape it up, or let the free online diagnostic ask the questions for you.
Ring the freephone, or have your solicitor do it, and we will tell you in one call whether the device can lawfully be examined at all.