Litigation changes what a laptop is. From the moment a dispute is in prospect, devices and accounts stop being IT assets and become potential evidence — and the way they are preserved will be examined as closely as what they contain. For York solicitors and their clients, we put preservation on a documented footing the other side can test and not shake.
◇ Method before speed. The free assessment and a written scope come first; forensic fees are settled in full before any examination starts. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Full pricing is on the data recovery cost page.
Preservation is cheapest at exactly the moments it feels premature.
A hold is a record before it is anything else. Each device and account within scope is listed; each is imaged, and the acquisition is logged with its date, time, operator and equipment; each image carries SHA-256 values computed at capture, so any later change to the evidence would announce itself in a failed verification. Originals are sealed into secure evidence storage, and every subsequent movement — examiner to safe, safe to court — is entered in a custody record with no unexplained interval in it. That continuity is what opposing experts probe first, and what this service exists to make unremarkable.
The handling follows the long-established digital-evidence principles published for UK policing by ACPO and maintained by the NPCC: no action taken should change the original data; anyone accessing it must be competent to explain their actions; an audit trail must allow an independent party to reproduce the process; and one identified person carries overall responsibility. Work is prepared to evidential standards for employment tribunals and for civil and criminal proceedings — and because admissibility is always the court's decision, no honest practice promises it. What we promise is a method that gives the court no reason to hesitate.
Most evidence lost to litigation is lost innocently — a laptop reissued to a new starter, an account purged in routine housekeeping, an IT technician having a well-meant look. Once a dispute is in prospect, reuse is the risk: it overwrites, re-dates and invites the argument that the gap was convenient. The practical guidance is unglamorous and decisive — arrange imaging before the departing employee hands the hardware back, so capture happens on hand-back day rather than after three weeks in a drawer; reissue only from a verified image; and write down every handling step in between.
Preserved evidence must eventually be produced, so the output is built for disclosure from the start: findings first in plain English, the technical method in an appendix an opposing expert can retrace, and an exhibit schedule listing every image with its hashes, custody history and source device. For matters in the Business and Property Courts the reporting is structured with the disclosure duties of Practice Direction 57AD in view, and joint instructions or directions agreed between solicitors are followed to their exact terms.
The bench discipline this rests on is set down at the forensic recovery hub. Capture itself is covered by workstation deep imaging, and the commonest matter it protects by employee data theft. Fees are on our prices page.
A file the other side can inspect line by line — which is the point.
Every device and account in scope, listed and dated.
Date, time, operator and equipment for each image taken.
SHA-256 values at capture and at every later verification.
Sealed exhibits in secure evidence storage, movements logged.
An unbroken, signed trail for each handover.
Disclosure-ready listing tying images to sources and hashes.
The free diagnostic that opens every case is completed within 2 working days of arrival; forensic casework itself is not a no fix, no fee service. The full forensic investigation with report is £800 + VAT, payable 100% upfront. The less expensive Forensic binary image and deleted-file extraction service, without the report, is £400 + VAT. Any Forensic work required will be payable upfront. Both figures are itemised on our prices page, and the written scope is agreed before payment is taken.
Hold and preservation work proceeds for companies on their own estate and for solicitors on instruction. Instructions are accepted on three footings only: equipment the company itself owns; the instruction of a solicitor, insurer or court; or devices that are genuinely the client's own — including jointly owned machines in matrimonial matters. We do not hack, we do not intercept live communications, and we do not examine a device the instructing client has no right to examine.
Holds are scoped on the telephone ahead of any movement: call 0800 689 0668, list the devices, accounts and deadlines with us, and exhibits are then signed into secure storage at our Leeds location with custody recorded from the signature.
Is the drive still inside a computer, laptop, MacBook, iMac, CCTV / DVR or server? Take the hard drive or SSD out first and post the bare drive on its own — removing drives from machines isn't a service we offer. Storage that's soldered to a motherboard (Apple Silicon Macs, certain slim laptops) is the one thing we can't work on: if it doesn't come out, it can't come in.
↓ Print the booking-in & shipping form (PDF)
Address the parcel for the attention of Leeds Data Recovery — about 40 minutes from York via the A64 and A1(M), or next working day by tracked post. You'll hear from us the moment it's booked onto the bench.
Not certain what to pack? Ring 0800 689 0668 first, or run the free online diagnostic.
A hold put in place this week costs less than one explained away next year.