When a small company comes apart, the systems are usually the only party with no interest in the outcome. Ledgers, mailboxes, shared drives and the accounting package hold a dated record of what was invoiced, what was deleted, where enquiries went and who was signed in at the time. The work is to capture that before it thins out, and to present it in a form both sides can read.
◇ Authority first. Bench afterwards. The full examination, written up as a report, comes to £800 + VAT. Stop at a verified image with its deleted material extracted and nothing reported, and it is £400 + VAT — the rung a recorder disk already occupies. Diagnosis is free and the scope is agreed in writing beforehand. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Ordinary recovery bands are on the data recovery cost page.
In a two-director company, or a family business anywhere in the county, any one of these is the moment to capture rather than to carry on and see.
These disputes have a shape. Both sides had legitimate access to everything, both used it daily for years, and the argument is not about who could reach the records but about what was done to them and when. That makes dating the changes the entire exercise. An accounting package keeps its own audit trail, and an invoice deleted or amended after the event usually leaves a mark in it even where the visible ledger looks tidy. Shared drives keep a change journal. Mail servers keep transport logs the mailbox owner cannot reach. The record that matters is rarely the one either party is pointing at.
Recovering the accounts is generally the first instruction and it comes from more directions than people expect. Deleted invoices and statements out of unallocated space. The accounting package's own backup sets, which are often several generations deep and forgotten. Exports e-mailed to an accountant months ago. Shadow copies of the file server. Where those sources disagree the disagreement is itself the finding, and the report sets the versions side by side with their dates rather than choosing one. A ledger reconstructed from four independent sources is very hard to argue with; one reconstructed from a single backup is an invitation to argue.
Diversion leaves a trail across several systems at once and rarely on any single one. Mailbox rules that forwarded enquiries onward, with the date each was created. Web form notifications redirected to a new address. Quotations produced on company hardware for a company that is not yours, still sitting in a temporary folder. Contact databases exported in bulk in a fortnight when nothing else was exported. Domain and hosting changes made from a known account. Put in date order and read alongside the drop in the ledger, that sequence is normally the substance of the claim.
Both sides in these matters distrust everything, frequently with reason, and an examiner who looks like one side's instrument is worth nothing to either. So the arrangements are structural. A joint instruction can be taken where both solicitors agree the scope and the questions, and findings then go to both sides together and simultaneously, whatever they say. Where the instruction is from one side only, the report says so on its face, states the questions it was asked, and sets out the range of opinion where the evidence supports more than one reading — which is what CPR Part 35 requires of an expert in any event.
Custody and method are at the forensic recovery hub, mailbox and tenancy work at email and cloud exfiltration, access and credentials at insider threat forensics, and dating removals at deleted-file forensics. Where a server or an array has failed rather than been tampered with, that is ordinary recovery work at the bands on the prices page.
Everything is dated, attributed to a login, and traced to the system it was taken from, so both sides can check it.
Deleted invoices and statements, alongside package backups and old exports.
Sent, deleted and redirected mail, every entry with the date it belongs to.
The route enquiries and quotations took instead, and the login behind it.
Moves and removals across the file server, ordered into one dated sequence.
Removable media and personal cloud accounts receiving the company's files.
Amendments, deletions and transfers in a sequence either side can check.
The least popular sentence first. Forensic work does not sit under no fix, no fee. That guarantee belongs to logical recovery, and the exclusions published beside it are electronic and mechanical failures, chip-level work, DVR jobs and forensic jobs. An examination is bench hours spent answering a question you have asked, and the hours are the same whether the answer helps your case or wrecks it. Against that, two figures are printed here rather than quoted on application, which is two more than most laboratories will commit to in public. Where the examination finishes with a full written report the fee is £800 + VAT. Where it finishes at the evidence — a verified binary image with the deleted material lifted out of it, handed to your solicitor or to another examiner to interpret — the fee is £400 + VAT. That lower figure is the same rung as a recorder disk or a BitLocker volume, so nothing on this page invents a sixth band.
The examination plus the written report it produces, set out so that an expert paid to disagree with you can follow every step and try to break it.
The verified binary image with its deleted material extracted, and no report written. The rung a recorder disk or an encrypted volume already occupies, not an extra band.
Both assume a single machine and a single question asked of it. Eleven laptops, a file server and a tenancy export is a larger exercise altogether, so anything spanning several devices is measured during the free diagnostic and written down before you are asked to agree to it. Working out what is there costs nothing and still closes 2 working days after the device is booked in at Cambridge, and the fee is settled before an examiner opens the image rather than after the findings are known. Where both sides' solicitors agree a joint instruction, the scope and the questions are settled between them first and the findings are released to everybody at once. Anything that is not forensic keeps the band it has always had on the prices page.
Instructions are taken from the company, from a director with the company's authority, or jointly from both sides' solicitors. Three routes reach this bench and there has never been a fourth. Kit the business bought and issued to somebody. A written instruction from a solicitor, an insurer or the court. Or a device that genuinely belongs to the person asking, which in a family matter means owned outright or owned jointly. Nothing is broken into here. Somebody else's password is not worked out, monitoring software is not installed on a device the client does not own, and live traffic is never intercepted — interception belongs to the bodies named in the Investigatory Powers Act 2016 and to no private laboratory. Where a client has no lawful right to look inside a device, instructing us does not manufacture one. Handsets and tablets are outside the practice altogether.
A server estate wants planning rather than a parcel, so ring 0800 689 0668 before anything is unplugged and we will agree what is captured on site and what travels. Where drives do come in, send the members only, labelled with the bay order, and photograph the front of the chassis first. Nothing is collected anywhere in this network and Leicester has no counter: tracked, insured post to Cambridge, or across the counter there in office hours.
The general rule is the drive travels and the machine stays behind — out of the laptop, out of the tower, out of the iMac, out of the recorder under the counter. This bench does not dismantle equipment, and a repair shop will do it while you wait. Three things are the other way round, and getting them wrong costs you the recovery: an external drive stays sealed in its own case, a NAS comes as a complete unit, and a WD My Passport or My Book travels whole with its cable, because on those the encryption key is held on the bridge board rather than on the disk — separate the two and the data becomes unreadable even to us. A Fusion Mac needs both of its drives, each labelled. The one thing nobody can work round is flash soldered onto the mainboard, as on Apple Silicon machines: if it will not come off, there is nothing to post.
↓ Print the shipping & booking-in form (PDF)
Address it to Cambridge Data Recovery. It is about seventy miles from Leicester if you fancy driving it — M1 south to Junction 19, then the A14 east — and the lab is two minutes off Junction 32 with parking at the door. Posting costs you a stamp and a day instead. Whichever you choose, you hear from us the moment it is booked in, and the free diagnostic closes two working days after that.
Not certain what belongs in the box? Ring 0800 689 0668 before you tape it up, or let the free online diagnostic ask the questions for you.
Backups roll, logs expire and shared drives get tidied. Ring the freephone and we will scope it with you, jointly if both sides prefer.