Litigation alters what a laptop represents. From the point when a dispute is in prospect, a computer or account no longer exists simply as an IT resource; instead, it becomes potential evidence. The method by which such items are preserved will be scrutinised just as much as the data contained within them. For York solicitors and their clients, we ensure preservation has a documented basis that opposing parties can test but cannot shake.
◇ Speed after method. The free assessment and a written scope of works come first. Forensic fees are paid upfront in full once you accept the fixed quote, before we start examining anything. On other work, in most cases you only pay if we recover your data, and electronic, mechanical and chip-level work is 50% upfront, with the balance only if we recover your data. All of our prices are shown on our data recovery cost page.
The most cost-effective time for preservation is during those exact moments it appears too early.
A hold is simply a record before it is anything else. Every device and account in scope will be listed; each will be imaged, and the acquisition logged by date, time, operator and equipment; each image is assigned a SHA-256 value when acquired, so if anyone attempts to alter the images after they were created, the change will become apparent because the hash will fail to verify. The originals are sealed in secure evidence storage, and every move thereafter (examiner to safe, safe to court) is recorded in a custody log with no unexplained gap. It is this continuous chain of custody that opposing experts typically probe first, and that this service exists to make unremarkable.
The handling follows the established guidelines for digital evidence developed for UK policing by ACPO and maintained by the National Police Chiefs' Council (NPCC): no action should alter the original data; all people who access the evidence must be competent to explain their actions; there must be an audit trail allowing an independent party to recreate the process; and one individual carries overall responsibility. All work is prepared to the standards needed for evidence in employment tribunals and civil and criminal proceedings. Admissibility is always decided by the court, so no honest practice promises it. What we promise is a method that gives the court no reason to hesitate.
Most of the evidence that gets lost in litigation is lost innocently, e.g. when a laptop is reissued to a new starter, an account is deleted during routine housekeeping, or an IT person takes a well-meant look. The moment you know a dispute is likely, reuse becomes the risk, because reuse can overwrite and re-date data, and also allows the opposing party to argue that the missing data was conveniently gone. The practical guidance is simple: arrange imaging before the departing employee hands the hardware back, so capture happens on hand-back day rather than after three weeks in a drawer; reissue only from a verified image; and write down every handling step in between.
Evidence that has been preserved must ultimately be disclosed. Thus, the report is constructed for disclosure from inception; findings will first be presented in plain language, then the methodology used will be documented in an appendix (which allows a counter-expert to replicate the process) and finally an exhibit list will include all images along with their hash values, custody chain and source devices. The reporting is structured with the disclosure duties outlined within Practice Direction 57AD in view when dealing with matters within the Business and Property Courts. In addition, any joint instructions or directions agreed between the solicitors involved will be adhered to in full detail.
The bench process this rests on is set out at the forensic recovery hub. The capture itself is covered by workstation deep imaging, and the most common matter it protects by employee data theft. Costs can be found on our prices page.
A file the other party may review one line at a time, which is the purpose.
List of every device/account in scope including date(s)/time(s).
Date, time, operator & equipment for each image captured.
SHA-256 values at capture and for all subsequent verifications.
Sealed exhibits are kept in secure evidence storage, and their movements are documented and tracked.
A continuous, signed chain (or trail) for each transfer of custody.
The list is ready for disclosure and links images to source devices and SHA-256 hash codes.
The free diagnostic that opens every case is completed within two working days of arrival; forensic casework itself is paid upfront once you accept the fixed quote. Our standard fee for a full forensic investigation including report is £800 plus VAT, payable 100% upfront. The cheaper forensic binary image and deleted-file extraction service, without the report, is £400 plus VAT. Both figures are itemised on our prices page, and the written scope is agreed before payment is taken.
Hold and preservation work is carried out for companies on their own estate and for solicitors on instruction. We accept instructions on three footings only: equipment the organisation itself owns; the instruction of a solicitor, insurer or court; or devices that genuinely belong to the client, including jointly held machines in matrimonial disputes. We do not hack, we do not intercept live communications, and we do not examine a device the instructing client has no right to examine.
Holds are scoped on the telephone before anything moves; ring 0800 689 0668 and list all the devices, accounts and deadlines with us. The exhibits are then signed into secure storage at our Leeds location, with the custody record starting from that signature.
Is the hard drive or SSD still inside a machine, such as a laptop, MacBook, iMac, CCTV/DVR system or server? Please remove the hard drive or SSD from the machine first and then post just the bare drive by itself; we do not provide a service for removing drives from devices. For a server or RAID, send every disk, each clearly marked with its bay. For a NAS, send its disks labelled by bay if you can remove them, otherwise send the NAS itself. We cannot work on storage soldered to the motherboard (e.g. Apple Silicon Macs, T2 Macs and certain slim laptops): if it doesn't come out, it can't come in. If you are unsure whether your storage is removable, call us before sending.
↓ Print the booking-in & shipping form (PDF)
Once you have your quote, send your package addressed to Leeds Data Recovery (about a 40 minute drive from York on the A64 & A1(M) or next working day if you want to send it using trackable post). We will contact you as soon as we have taken delivery of your package and put it in line to be worked upon.
Can't figure out what to pack? Ring 0800 689 0668 first, or try our free online diagnostic tool.
A hold placed today will cost less than one explained away next year.