A leaver's laptop has one forensic window: the time between it being handed back and being issued again. Image it then, write-blocked into E01 evidence files and verified by SHA-256 hash, and it can answer questions for years. Reuse it, and it answers fewer every day. For York employers the rule is simple: the questions can wait, the image cannot.
◇ Speed after method. The free assessment and a written scope of works come first. Forensic fees are paid upfront in full once you accept the fixed quote, before we start examining anything. On other work, in most cases you only pay if we recover your data, and electronic, mechanical and chip-level work is 50% upfront, with the balance only if we recover your data. All of our prices are shown on our data recovery cost page.
If any of these apply, the machine goes on the imaging list before it gets anywhere near the rebuild queue.
The economic advantages are skewed. Creating an evidentiary image at this time (the complete hard drive copied into E01 format using a write blocker, then verified with SHA-256) will cost a small portion of what that same evidence will be worth when it becomes part of a live dispute, and the machine can be returned to use the day after, since the image creates the evidentiary record independent from the computer. Don't create the image, reissue the laptop, and each working day by the new user will overwrite the previous user's traces. Companies that routinely image departing employees' computers will never need to account for a lapse.
Far more than documents. Browser histories, browser caches and cookies recreate past research and uploads; temporary files store unsaved drafts and copies that exist nowhere else; the page file and hibernation file store pieces of whatever was loaded into memory, including open documents, chat windows and even credentials; Slack and Teams maintain local caches that allow conversations to be recovered after they have been deleted from within the apps; VPN and connection logs place the computer on networks at the specific times that matter. None of this is preserved with a rebuild, but all of it is preserved with an image.
Encryption rewards early capture. A computer that has been encrypted using BitLocker or FileVault should be copied (imaged) while the keys remain escrowed and the password remains known, before the user's account is closed, the directory tidied up, or the TPM cleared during a rebuild. Work with encrypted volumes is classed as forensic and, like everything on this page, is payable upfront once you accept your fixed price quote.
Assertions of wiped information will be tested, rather than assumed. Secure-erase and boot disk tools such as DBAN create their own evidence, including boot records, tool signatures, characteristic overwrite patterns, and timing that can be correlated to surrounding events. Incomplete and interrupted wipes are common, leaving whole segments of data intact and recoverable; hardware secure-erase commands will also be cross-checked against the drive's own records. Where a wipe was genuinely completed, the report will say so plainly and give the date, since an intentional wipe performed on the eve of proceedings is itself considered evidence.
The custody and verification discipline is covered at the forensic recovery hub. What a deletion looks like in an image is covered by deleted file forensic analysis; preservation duties by legal hold & chain of custody; and fees can be found under data recovery costs.
Collected once, verified, and available to answer every question the dispute generates afterwards.
The complete hard disk in the format accepted by the forensic community.
SHA-256 hash values to prove that all copies of the image are unaltered from one another and from the original.
History, cache and cookies, recreating past research and uploads.
Documents, chat logs, credentials etc. that were stored within pagefiles and hibernation files.
Local Slack and Teams files; deleted conversations restored as well.
Traces left behind by VPNs and networks, allowing us to place the machine at specific times and locations.
The free diagnostic that opens every case is completed within the first two working days from receipt. All forensic services are quoted on a fixed price basis in advance, and all forensic costs are to be paid upfront upon acceptance of the quotation. Forensic examination including written report will cost £800 plus VAT, payable 100% upfront. A forensic binary image and deleted file service, which includes no report, will cost £400 plus VAT. All forensic services will require payment prior to commencement. Work involving encryption (such as BitLocker) is also classed as forensic and will require payment upfront on the same terms. Both figures can be seen on our prices page, and the written scope is agreed prior to taking payment.
The process of obtaining an image can take place from company owned equipment, your own hardware, or through the instructions of a solicitor. The only acceptable bases are: equipment that belongs to the company itself; instructions given by a solicitor, insurer or court; or devices genuinely belonging to the client themselves, including those that are jointly owned in divorce proceedings. We do not hack, we do not intercept live communications, and we do not examine a device that the instructing client has no right to examine.
When you ring 0800 689 0668, provide details of how many machines there are and their encryption status, and we shall scope the work in writing the same day. Once you have the quote, the drives (and not the machines) are posted to our Leeds lab by tracked next-working-day delivery, or delivered personally to our Leeds lab's reception, Monday to Friday, 9am to 5:30pm, without prior appointment, and we record custody at the time of signature.
Is the hard drive or SSD still inside a machine, such as a laptop, MacBook, iMac, CCTV/DVR system or server? Please remove the hard drive or SSD from the machine first and then post just the bare drive by itself; we do not provide a service for removing drives from devices. For a server or RAID, send every disk, each clearly marked with its bay. For a NAS, send its disks labelled by bay if you can remove them, otherwise send the NAS itself. We cannot work on storage soldered to the motherboard (e.g. Apple Silicon Macs, T2 Macs and certain slim laptops): if it doesn't come out, it can't come in. If you are unsure whether your storage is removable, call us before sending.
↓ Print the booking-in & shipping form (PDF)
Once you have your quote, send your package addressed to Leeds Data Recovery (about a 40 minute drive from York on the A64 & A1(M) or next working day if you want to send it using trackable post). We will contact you as soon as we have taken delivery of your package and put it in line to be worked upon.
Can't figure out what to pack? Ring 0800 689 0668 first, or try our free online diagnostic tool.
A single capture keeps every answer the machine will ever give. Ring our freephone.