Home / Blog / What Moves a Quote
Guides · blog post

Four parcels followed from the doormat to the invoice, and the two decisions that set every figure

Two decisions set every figure quoted on this bench, and neither is the one callers expect. The kind of storage picks the band. The kind of fault picks how you pay and what happens if the work comes to nothing. Capacity, brand, age and how badly you need the files do not enter the arithmetic at any stage. Four parcels out of one unremarkable fortnight show how that works in practice.

The rule, stated before the examples

What is it? That question decides the number. Cards, sticks and pen drives sit at £250 + VAT. One hard drive or one SSD, with NVMe blades on the same rung, is £300 + VAT. A disk out of a CCTV or DVR recorder is £400 + VAT, and a BitLocker or otherwise encrypted drive shares that rung. RAID, NAS, SAN and server work opens at £500 + VAT and climbs with the member count. Forensic work carries two figures instead of one: an investigation written up in full is £800 + VAT, while a verified image with the deleted material pulled out and no report attached is £400 + VAT. Nothing else exists, and the same bands appear with VAT itemised on the data recovery cost page.

What went wrong with it? That question decides the terms. Logical faults — a deletion, an accidental format, a damaged file table, a partition that stopped appearing, firmware that came unstuck — run under no fix, no fee. Nothing worth handing over means no invoice. Four categories sit outside that guarantee: electronic and mechanical failures, chip level work, DVR jobs and forensic jobs. Those take half the quoted figure in advance, because donor parts get bought for one named drive rather than kept on a shelf.

Notice what is not among those four. Ransomware is not on the list, and neither is BitLocker, whatever anybody else has told you. An encrypted drive with a working key is ordinary logical work; a drive full of criminally encrypted files is priced as the hardware it happens to be. Keep those two questions apart while reading the parcels below and every figure in them follows.

Parcel one: a dashcam card after a shunt on the M6, £250 + VAT

A haulage firm needs the twenty minutes before an incident on the northbound carriageway. The camera has been recording over itself continuously for months and the card now shows nothing playable. It arrives in a jiffy bag on a Tuesday, weighing almost nothing.

£250 + VAT, because it is a memory card. That band takes SD, microSD, CompactFlash, CFexpress, pen drives and memory sticks alike, and none of the tempting variables move it: not the 256GB capacity, not the brand on the label, not the fact that an insurance claim rests on it. The band follows what the storage is and stops there.

The fault decided the rest. This one was logical — a file system chewed up by months of continuous overwriting — so it ran under no fix, no fee with nothing payable in advance. Had the same card been cracked, or been one of the monolithic microSD types where the memory has to be read from test pads on the outside, that would have been chip level work, one of the four exclusions, and half the £250 + VAT would have been payable before anybody started. Same device, same band, a different agreement.

Parcel two: a portable drive off a desk in Leamington, £300 + VAT

A games studio in Leamington loses a 4TB portable drive off the edge of a desk while it is spinning. It comes back up making a noise it has never made before, mounts for ninety seconds and then disappears. Somebody sensibly switches it off and leaves it off. It travels sealed in its own case, because an external drive in its enclosure goes as it is rather than being opened up first.

£300 + VAT, the single-drive band. It makes no difference that the disk lives in a plastic shell rather than inside a laptop, and no difference that it holds four terabytes rather than five hundred gigabytes. What did matter is that the fault is mechanical, so it falls into the four exclusions: no fix, no fee does not apply and half the figure was payable before the work began.

Externals fail in two quite different ways and it is worth knowing which you have. Sometimes the drive itself is hurt, as here. Sometimes the drive is perfectly healthy and the small board that converts USB to SATA inside the case has died, which is a hardware fault of the enclosure rather than the disk. Either way the unit travels whole, the diagnosis is made at the bench, and the band does not move. An external drive that has stopped working and external hard drive repair take those symptoms apart properly.

Parcel three: a BitLocker laptop disk from a Warwick office, £400 + VAT

A professional services firm in Warwick has a laptop that will not boot and a partner who needs the files on it. The disk comes out and travels on its own; the laptop stays on the desk. The volume is BitLocker protected, which is entirely normal on a managed machine and moves it up one rung.

£400 + VAT, since encrypted volumes share a rung with recorder disks. What the extra pays for is careful handling of key material and decryption performed against an image, so nothing is ever written to the disk you sent. A single condition decides the job and there is no way round it: a working key has to exist somewhere. Produce the 48-digit recovery key, or fetch it from the Microsoft account it was escrowed to or the directory the laptop was joined to, and what follows is an unremarkable recovery. Produce nothing, and the volume stays closed to every laboratory there is. BitLocker recovery lists the places those keys usually turn out to be, and most people who think theirs is gone have simply not looked in all of them yet.

Now put a recorder disk beside it at the same £400 + VAT and the difference in terms shows up clearly. That band applies to a DVR disk because recorder manufacturers rarely use a normal file system: footage goes into proprietary containers, often written as a continuous loop with the index held separately, so the disk presents as unformatted to ordinary tools and the work is rebuilding the container and the timeline. DVR jobs are named in the four exclusions, so half is payable upfront. The encrypted laptop disk beside it is logical work and runs under no fix, no fee. One price, two agreements. CCTV and DVR recovery covers the recorder side.

Parcel four: six disks out of a rack at a Nuneaton distributor, from £500 + VAT

A distribution business off the A444 comes in on a Monday to find every file renamed and a text document setting out the terms. The rack server holds the live data and, as is usual, the copy of itself. Both are encrypted. Six member disks arrive on the Wednesday, each labelled with its bay, with a photograph of the front of the chassis in the box.

That is array work: from £500 + VAT, rising with the member count, because each disk is imaged individually before any reconstruction is attempted. Six members means six imaging jobs and then the array analysis on top. The figure is settled after the free diagnostic rather than guessed over the telephone, for the straightforward reason that nobody knows how cooperative six disks will be until they are on the bench.

It is priced exactly as it would have been if those same six disks had failed, because the physical work is identical: image every member, reconstruct the volume, then find what the attack did not reach — files the malware unlinked rather than overwrote, older versions in shadow copies, whatever sat in regions it never got to, and anything on media that happened to be disconnected. What it is not is forensic work, and quoting it that way is a means of charging more for the same bench hours. Ransomware recovery covers what survives an encryption run.

The two forensic figures, and when they are the right thing to buy

Forensic work is a different product rather than a more expensive recovery, which is why it has its own figures. £800 + VAT buys an investigation with a full written report: a defensible image, an examination of what was done and when, and a document that stands up in front of an insurer, a regulator, a solicitor or a tribunal. £400 + VAT buys a verified binary image with deleted material extracted and no report written — the same evidential handling, without the writing up.

You want the first when the question is what happened. You want the second when you need the contents preserved properly and somebody else will interpret them. Neither is what you want when the question is simply how do we get our files back, and being sold a report you did not ask for is a recognised way of turning a recovery into an investigation. Forensic recovery sets out where the line falls.

What never changes the figure, and five questions worth asking anybody

Some variables people expect to matter do not touch the arithmetic at all. Capacity does not — half a terabyte and sixteen terabytes are both £300 + VAT. Nor does the manufacturer, the age of the drive, how full it was, or which machine it was bolted inside. Nor does distance: everything runs on one bench at Oxford Science Park whatever postcode it arrived from, so there is no regional loading, no travel charge, no collection fee and no Coventry counter — collection is not offered to anybody at all.

The trade's reputation for numbers that grow once your drive is on somebody else's shelf was earned rather than invented. Three mechanisms account for most of it, and all three are obvious once named. An inviting headline price with the word from bolted to the front, which swells after an assessment. An assessment fee payable whether or not anything comes back. And a definition of success elastic enough that a single readable file in ten thousand justifies the whole invoice.

So ask five things, and ask them by email rather than over the telephone. If I decline your figure, is the assessment still free and does my device come home? If the recovery fails on a logical fault, is there anything to pay? Can the number I have been given change once you are holding my drive? What counts as a successful recovery here, and do I see a list of what was found before I pay? And does the work happen on your own bench, or go out to a third party I will never speak to? Answers to those five tell you more about a laboratory than any headline figure it advertises.

The habits that save more than any negotiation, and the run down the M40

What happens in the first hour moves a bill further than any conversation about price. Pull the plug the moment a drive makes a sound it has never made before. Switched off early, that job is as cheap as it will ever be; a fortnight of hopeful restarts later it is slower, harder and gives back less. Leave the software in its box. An all-night scan on tired hardware spends the very reads a paid recovery is relying on, and several free tools cheerfully drop their own working files onto the volume they are examining. Turn down every offer to repair the volume. Repair utilities aim at a file system that is consistent rather than one that is complete, and they get there by throwing away whatever refuses to reconcile, which what CHKDSK does to a damaged volume covers at length.

One local pattern, since these parcels arrive in waves. University terms at Coventry and Warwick throw up the same job over and over: an entire degree held in one place only, on a portable drive of a certain age that has been off a desk at least once. Keeping a second copy somewhere else costs less than the postage on a recovery, and it is the one precaution in this business that has never let anybody down.

The journey is the same whichever band applies. Send the storage and keep the computer, with three exceptions: an external drive travels sealed in its own case, a NAS goes as a complete unit, and a Fusion Mac needs both of its drives, each labelled. Immobilise whatever is going so nothing can shift in transit, put the printed shipping form in beside it, and send it tracked and insured to Oxford Data Recovery, John Eccles House, Oxford Science Park, Robert Robinson Avenue, Littlemore, Oxford OX4 4GP. That is about fifty-five miles from Coventry down the M40, roughly an hour if you drive it; the desk signs devices in Mon–Fri 9:00am–5:30pm. Nobody collects, there is no Coventry counter, and no phones or tablets are taken. The freephone is 0800 689 0668.

Two decisions, in this order: what the storage is, then what went wrong with it. The first picks the band, and nothing else moves it — not capacity, not brand, not age, not urgency. The second decides whether the job runs under no fix, no fee or takes half the figure in advance. Anybody quoting before seeing the device has guessed with your money.

// what people ask about this one

Common questions

The figure quoted after the diagnostic is the figure invoiced. That is the whole purpose of doing the assessment before quoting rather than after: the device has been examined, the fault is understood, and the number is written down. What you should be wary of anywhere is a price given over the telephone before anybody has seen the storage, because that one has nothing behind it but optimism.
Return postage, and not a penny more. Looking at it costs nothing whichever way you decide, and the hardware goes back to you. Where the fault is logical and the attempt yields nothing worth handing over, that is free as well. Written down plainly rather than waved at, no fix, no fee amounts to exactly that.
No. Each of them is £300 + VAT. All the capacity decides is how many hours the imaging stage runs; nothing else about the job moves, because the band follows the kind of storage rather than the amount of it. The maker, the age of the drive and the machine it came out of are equally irrelevant.
Because there is usually no ordinary file system on it. Recorder makers write footage into proprietary containers, frequently as a continuous loop with the index kept separately, so the disk looks unformatted to standard tools and the work is rebuilding the container and the timeline before any of it plays. DVR jobs are also one of the four exclusions from no fix, no fee, so half the figure is payable in advance.
It is not what happens here. Encrypted media is charged on the ordinary hardware bands — £300 + VAT for a drive, from £500 + VAT for a server or array — because the bench does exactly the work it would do if those disks had failed. The £800 + VAT figure is for a forensic investigation with a written report, which is something you commission deliberately when you need to establish how an intrusion happened.
On a logical fault, nothing. The diagnostic is free, the quote follows in writing, and you decide. On the four excluded categories — electronic and mechanical failures, chip level work, DVR jobs and forensic jobs — half the quoted figure is payable in advance, because parts get bought for one named device and the bench time is committed whatever the outcome.
No. One bench at Oxford Science Park handles all of it, whatever postcode the parcel left from, so no regional loading and no travel charge exist to be applied. Nor does collection, for anyone, at any distance. A device posted from Coventry or from anywhere in Warwickshire gets the same free assessment 2 working days after booking in, and the same written figure, as one carried through the door.

Rather put it in front of an engineer?

Oxford charges nothing to examine it, and that closes 2 working days from the moment it is booked in. Whatever figure comes out of it is written down and stays there: £250 + VAT a card or stick, £300 + VAT one drive or SSD.