The laptop that comes back on somebody's last Friday is, without anybody intending it, a written account of how they left. It knows what hardware was attached to it and at what hour. It knows which files were opened and off which volume. It knows which private accounts were signed in on company equipment. And it knows what happened to all of that across the final fortnight. That account is at its fullest on the day the machine is handed over and it starts wearing away from that morning onwards, which is why every other instruction on this page comes after one: stop using it.
◇ The fee is agreed before the answer is known. £800 + VAT examined and written up, £400 + VAT for the verified image with its deleted material lifted out — a recorder disk carries the same figure. Diagnosis costs nothing and the scope is written down first. Forensic work is one of four published exclusions from no fix, no fee. Prices.
These cases are lost in the fortnight after the handover far more often than they are lost on the facts. The pattern is familiar to anybody who has watched one go wrong: the machine comes back, a helpful colleague has a look through it, the asset ticket already says reimage, and a month later somebody's solicitor is asking what the downloads folder held. Ordinary use eats free space, and free space is where an examination does most of its reading. So the machine goes out of service, the rebuild is cancelled in writing, the handling since the handover is written down, and an image is taken. The rest of this page assumes those four things have happened.
What an employer buys is a sequence rather than a heap of artefacts. Windows records more than anybody configures it to record — the devices it has met, the documents opened and the volumes they came off, the folders browsed on media that has since gone, the programs that ran and how often, the file operations in the order they occurred, and the account signed in around each of them. Individually those are fragments and each has an innocent reading available. Sorted by time and cross-checked against one another, they describe a fortnight: what was looked at, what moved, at which hours, under whose login. The technical detail of the device records sits on the USB page rather than being repeated here.
Sticks remain a route and they are not the majority route, which matters because an examination aimed only at them will miss most of what a current case turns on. A personal cloud client authenticated beside the corporate one, mirroring a folder away in the background. Webmail open in a browser tab with attachments going out through it. Large-file transfer services. Company mail pushed onward by a rule that also removes the evidence of itself from sent items. An entire document library pulled down across one evening. And printing, which nearly everybody forgets about, and which leaves a spool record and a job history sitting there waiting to be read.
The line is ownership and it is not always where people assume. Company hardware, company accounts and company systems can be examined on the company's own authority, and no separate permission is needed to look inside your own equipment. An employee's personal drive, private mailbox or home computer cannot, whatever was plugged into what. Between those two sits personal material on a work device, which still attracts obligations under data protection law: the examination is scoped to the question being asked, the reason for that scope is recorded, and private correspondence that is plainly irrelevant is not trawled through because it happens to be within reach.
The first is your own board, which will make a decision on it long before any tribunal sees it and which does not want a tool's output. The second is a panel and an opponent, who will look for the seam. Both are served by the same document: numbered findings in plain English, each fastened to a dated artefact; both readings given wherever an artefact allows two; method in an appendix so the other side can rerun it; and a clear statement whenever the evidence shows what an account did rather than what a person did. That last distinction is where these reports usually fail, because it is tempting to close the gap and it is the panel's job to close it, not an examiner's.
The imaging and custody discipline is on the forensic practice hub. The removable-media half of this work is USB device forensics, the mailbox and cloud half is email and cloud exfiltration, and preserving the hardware properly is legal hold and chain of custody. Where what is at stake is drawings, source code or formulations rather than a customer list, trade secret and IP theft is the version written for that.
Any single one of these justifies pulling the device out of circulation and leaving it alone until a copy exists — the same answer for a two-van firm in Bedworth as for a supplier on the Ansty estates.
None of this costs money and all of it is worth more than the examination that follows. Roughly in order of importance:
Every thread carries a date, belongs to a named profile, and is traced back to the specific artefact it was read out of.
An inventory of the removable devices, their serials, and the hours of contact.
Journal lines and destination clocks putting named files onto a named volume.
The records fastening a document to the particular device it was read off.
Browser sends, mailbox rules and sync-client logs still sitting on the disk.
Bulk folder reads, print runs, late sessions, messages about the next job.
The gap between departure and capture, with hash figures that still match.
Employers ask about this order of things more than anyone else does, so it is worth being blunt. The fee is agreed and paid before an examiner opens the image, which means you are buying the examination and not the finding. An investigation that clears the leaver took exactly the same bench hours as one that does not, and a laboratory paid on results would have an interest in the outcome, which is the last thing anybody wants in front of a tribunal. That is also why forensic work is one of the four exclusions published against no fix, no fee, beside electronic and mechanical failure, chip-level work and DVR jobs.
Two machines and three questions is a different job from one and one, so anything beyond a single device is measured during the free diagnostic and quoted in writing before you commit. The diagnostic costs nothing and finishes two working days after the exhibit reaches Oxford and is booked in, which is the same moment the custody file opens. If the laptop has simply died and nobody is in dispute, that is ordinary recovery at the published band and this page is the wrong one.
An employer instructs over its own hardware and its own accounts, and no separate consent is needed for that. A solicitor's written instruction is welcome and is not a precondition. Those are two of the three routes onto this bench; the third is a private client with hardware that is genuinely theirs. An employee's own laptop, personal mailbox or home computer is none of the three, whatever was once plugged into what, and remains theirs. The standing refusals apply to every instruction: nobody else's password is defeated or guessed, monitoring software is not supplied, fitted or advised on, and live traffic is not intercepted — interception belongs to the bodies named in the Investigatory Powers Act 2016 and a private laboratory is not one. Buying an examination does not create a right to look that the buyer did not already have. Phones and tablets are not examined here in any case.
Kill the rebuild and disposal tickets in writing, then call 0800 689 0668 so we can settle what actually needs to travel. Wherever the disk comes out, the disk travels and the computer stays with you. No collection service operates anywhere in this network and there is no Coventry counter: it goes to Oxford tracked and insured, or over the counter there during office hours, entering the custody file as it is booked in.
As a rule the storage comes out and the machine stays where it is. That applies to a laptop, a tower, an iMac and to the recorder sitting under a counter. Taking equipment apart is not something this bench does, and a repair shop will free a drive in a few minutes. Two things go the other way: an external drive stays sealed inside its own case, and a NAS travels as a complete unit with its disks still in their bays. A Fusion Mac is a third case — both of its drives come out and travel together, each one labelled. The single situation nobody can work around is memory soldered flat onto a mainboard, which is how Apple Silicon Macs and a good many slim laptops are built: if the storage will not unbolt, there is no parcel to send.
↓ Print the shipping & booking-in form (PDF)
Put Oxford Data Recovery on the label. From Coventry it is roughly fifty-five miles straight down the M40, about an hour if you would rather drive it in than post it. Either way you are told the moment it is logged, and the free diagnostic finishes two working days later.
Unsure what ought to go in the box? Ring 0800 689 0668 before you seal it, or work through the free online diagnostic and let it do the asking.
Cancel the reimage ticket in writing, leave the machine switched off in a drawer, and ring before anybody in the office decides to have a helpful look through it.