Where a deletion is disputed, the document is rarely the point. The point is the removal: which records went, in which hour, by which of the three quite different acts that all get called deleting, and under whose session. A Windows volume keeps four separate accounts of the same afternoon, written by parts of the system that were not designed to agree with one another, and reading them against each other is what turns an assertion into a timeline.
◇ Dating a removal costs the same whichever way it goes. £800 + VAT examined and reported, £400 + VAT for the verified image and its extracted material alone — the recorder-disk price point, not a sixth band. Free diagnostic, scope agreed in writing. Forensic work is one of the four exclusions from no fix, no fee. Ordinary prices.
Sorting out which kind of deletion happened is usually the first finding, and it often says something about intention before anyone has opened the document. Dragging a file to the bin moves it and writes a small companion record beside it holding the original path, the size and the minute of the move — and that companion record habitually outlives the bin being emptied. Holding shift skips the bin, but all that is surrendered is the directory entry; the contents sit where they were until something else claims the space. Saving over a file in place is a third thing entirely, and it is the one that ends badly. A person who empties a bin on their last afternoon and a person who installs a shredder have not done the same thing, and the volume can tell them apart.
A sequence is only worth putting in a report where more than one source stands behind it, and Windows obligingly keeps four that were designed by different people for different purposes. The master file table carries several times against every record it holds, live or removed. The change journal writes one line per operation in the order the volume saw it — created, renamed, extended, deleted. The transaction log adds finer grain across the same handful of minutes. The security log supplies the profile that was signed in and the kind of logon behind it, though auditing of the deletion itself is switched off on most machines unless somebody deliberately enabled it, and it is better to say so than to let a client expect it. Where those four agree, the hour goes in without hedging. Where they do not, the disagreement is itself the finding, and the report explains which record it prefers and on what basis.
Windows quietly retains earlier states of its own volume. Snapshots are written for restore points and by backup software, and each freezes the disk as it stood on a particular day: files removed afterwards, drafts from before an edit, a directory listing from three weeks ago. Comparing one against the volume as it is now drops out everything that vanished in between, in a single operation, with dates at both ends. There on the Monday, gone by Thursday, with the journal fixing the removal to Wednesday morning is about as clean an exhibit as this work produces. Backup generations, the Previous Versions tab and a bin configured on a network share all serve the same purpose wherever a business happens to have them.
Erasure software is not a quiet operation. What gets examined first is not the gap it left but the noise it made getting there: install and uninstall entries, prefetch records naming the executable and holding several of the hours it ran at, the unnaturally even pattern an overwrite leaves across a surface, and the absence of the ordinary junk that any machine in daily use ought to be carrying. That is the awkward property of a wipe — it removes material and creates evidence in one movement, because the name of the tool, the hour, the account that started it and everything it never reached all outlive the run. Half-finished runs and runs aimed at the wrong volume are common, and whatever survived one is recovered in the ordinary way and described as what it is.
Flash is where this work runs out of road, and it is better said early. On a solid-state drive with TRIM active and no encryption sitting in the way, the controller can clear the contents of a removed file within minutes, and nothing on any bench reads back what the silicon has already let go. Metadata generally outlasts contents, which means the fact of a removal and the hour it happened can still be evidenced when the document itself cannot be produced — and in a contested matter that is often the half that counts. Spinning disks are more forgiving, though a machine left in service works steadily through its own free space. Anything genuinely written over has gone, whatever anyone else is prepared to promise. Which of those situations you are in is established during the free diagnostic.
The two jobs read many of the same records and are not the same product. On the recovery bench nobody is arguing: a client wants files back, the output is a file list and a copy on fresh media, and the price is the ordinary band — £300 + VAT for a drive, £250 + VAT for a card or a stick. Here the existence of the files is not in doubt and the removal itself is the subject. That changes the handling from beginning to end: a write-blocked acquisition, a hash that is checked again later, contemporaneous notes, a custody record, and a report which sets out how each conclusion was reached so it can be attacked properly. If nobody is in dispute, deleted file recovery is the cheaper and correct answer and this page is not for you.
How the copy is taken and looked after sits on the forensic practice hub. Where a stick or a card is involved in the removal, USB device forensics takes it on; where the whole endpoint has to be preserved, that is workstation deep imaging. Where the deletion sits inside an employer's wider question about a leaver, the instruction is usually employee data theft.
This is the page for a matter where the hour of a disappearance carries as much weight as whatever was inside the file.
No single record carries a finding by itself. An hour goes into the report where the sources back each other up, and where they pull apart it is the pulling apart that gets written down.
Where the file lived, how big it was, and the minute it was dragged in — surviving the emptying.
Several stamps against each record, kept for live and removed entries without distinction.
One line per operation, in the order the volume actually saw them happen.
Which profile was holding the machine around each event, and how it had signed in.
Snapshots still carrying what the live volume gave up somewhere along the way.
Tool name, run times, the account that launched it, and everything the run never reached.
On this page the difference between them is unusually easy to describe. £400 + VAT stops at the evidence: the volume copied behind a blocker, the copy verified, the removed material carved out of it and handed over for your solicitor or another examiner to interpret. £800 + VAT is that same acquisition with the questions actually put to it — which records went, in which hour, under which session — and the answers written up in a form a tribunal can be taken through. The £400 is not a band invented for forensic work. It is where a CCTV recorder disk and an encrypted volume already sit, which is why this site still lists five prices and not six.
Neither figure is covered by no fix, no fee — investigations are one of the four published exclusions, along with electronic and mechanical failure, chip-level work and DVR jobs — because a deletion dated to Wednesday teatime costs the same hours whether that date rescues you or ruins you. Each covers one machine and one question. A second device or a second question is measured during the free diagnostic, which costs nothing and closes two working days after booking in at Oxford, and quoted in writing before anything starts. Ordinary recovery keeps its published bands.
This runs on machines a business issued, on hardware that is yours outright, or on a solicitor's written instruction — those three and nothing else. A court or an insurer instructing in writing counts as the second of them. In a family matter, hardware that is yours means owned by you or owned jointly. What sits outside all of that stays outside it: a password belonging to somebody else is not worked around, monitoring software is not sold, fitted or recommended, and live traffic is not intercepted by anybody here, that power being reserved to the bodies listed in the Investigatory Powers Act 2016. Paying a laboratory does not create a right of access that the client did not already hold. Handsets and tablets are refused whatever the instruction says, because Oxford's shipping form excludes them and an evidential dispute does not change that.
A deletion case loses something every day the machine stays in service, so take it out of circulation and then ring 0800 689 0668, in that order. Coventry has no counter and nothing is collected anywhere in this network: the drive goes to Oxford by tracked, insured post, or across the counter there during office hours, and the custody file opens as it is booked in.
As a rule the storage comes out and the machine stays where it is. That applies to a laptop, a tower, an iMac and to the recorder sitting under a counter. Taking equipment apart is not something this bench does, and a repair shop will free a drive in a few minutes. Two things go the other way: an external drive stays sealed inside its own case, and a NAS travels as a complete unit with its disks still in their bays. A Fusion Mac is a third case — both of its drives come out and travel together, each one labelled. The single situation nobody can work around is memory soldered flat onto a mainboard, which is how Apple Silicon Macs and a good many slim laptops are built: if the storage will not unbolt, there is no parcel to send.
↓ Print the shipping & booking-in form (PDF)
Put Oxford Data Recovery on the label. From Coventry it is roughly fifty-five miles straight down the M40, about an hour if you would rather drive it in than post it. Either way you are told the moment it is logged, and the free diagnostic finishes two working days later.
Unsure what ought to go in the box? Ring 0800 689 0668 before you seal it, or work through the free online diagnostic and let it do the asking.
Pull the machine out of circulation, ring the freephone, and let four records that were never meant to agree settle the hour between them.