Recovery work is finished when the files open. This work is not finished until somebody who would very much like the conclusion to be wrong has read the report, retraced the method and found nothing loose to pull at — and they may be doing that eighteen months after the invoice was settled. Everything on these pages follows from that one difference. The exhibit is read once, behind a write-blocker. It is hashed while it is copied. Conclusions are written for a tribunal panel, not for another engineer. The instructions come from HR teams on the engineering and distribution estates, from solicitors in Warwick, Leamington and Rugby, and from firms in the motor supply chain who have just watched a project engineer leave for a competitor.
◇ Authority first, bench second. Examined and written up: £800 + VAT. A verified image with its deleted material extracted and nothing reported: £400 + VAT, the figure a recorder disk already carries. Diagnosis is free, scope goes in writing. No fix, no fee covers logical recovery; electronic and mechanical failure, chip-level work, DVR jobs and forensic jobs sit outside it. Ordinary bands: data recovery cost.
Starting at the other end, because it saves people money. A drive that has failed with the accounts on it is a recovery job on the published bands and nothing more. A server the criminals have encrypted is also a recovery job, on those same bands — ransomware is media work here and is never dressed up as an investigation, so a quote that puts an examination fee on it is charging for a report nobody asked for. Wanting last summer's photographs back is deleted file recovery at £300 + VAT. What is on the rest of this page is bought on purpose, by somebody who has to answer a question in a form that a person who dislikes the answer will nonetheless have to deal with. If that is not your position, ring anyway and you will be told which page you actually want.
The tooling is unremarkable and so is everybody else's. What separates an exhibit from a copy of a disk is that the order was fixed in advance and departed from nowhere. Blocker in line before anything spins up. Capture to E01. SHA-256 computed on the way in and matched afterwards. Exhibit sealed, labelled, written into the custody file. Notes made as each of those happens rather than reconstructed on the Friday. Only then do the questions start, and they are put to the copy. Findings come out numbered, dated and pinned to the specific artefact carrying them. Remove any single link in that and what remains is a recovery with a larger invoice attached, sold under a more impressive name — which is a fair description of a good deal of what is advertised as forensics.
An engineer left alone will describe the method for nine pages and reach a conclusion in the tenth. Nobody reading it in a hearing has the patience for that. So the findings sit at the front, in plain English, numbered so a witness statement can cite them one at a time. The reasoning goes into an appendix where an opponent can take as long as they like dismantling it. Where a single artefact honestly supports two readings, both are printed, including the one that does not help the client. None of that is a house style. CPR Part 35 and its practice direction require an expert in civil proceedings to give the range of opinion where one exists, to record the substance of the instructions received, and to sign a statement of truth. Employment tribunals run their own procedure rather than the CPR, and expect precisely the same independence.
They divide three ways. Four of them settle a fact: what was removed and when, what a stick carried, what went out through a mailbox, what one capture of an endpoint is still holding. Two are about the material rather than the answer — preserving it and documenting the handling — which is unglamorous and is where cases get lost most cheaply. The remaining four are the instructions as people describe them on the telephone: a leaver's laptop, a marriage in front of the Family Court, a company splitting into two, and a set of drawings that has turned up at a competitor. Most callers arrive on one of the last four and end up buying one of the first six.
This is an engineering economy and the instructions read like one. Process and design data walking out with somebody who has resigned into the supply chain. A manufacturer and a supplier arguing about who owns a set of tooling drawings and which revision was issued when. Research and collaboration agreements around the two universities, where the fight is over whose version existed on a given date rather than over who holds the file. A studio in Leamington whose build tree has surfaced outside its licence. Beneath all of that runs a steady traffic in employment and family matters that belong to no industry at all. What the economy changes is the mix of questions. It changes nothing about the method, which is identical for a two-van firm in Bedworth and for a tier-one supplier off the Ansty estate.
Four examinations, each pointed at one question that has an answer. In which hour did the records leave the volume? What crossed onto a stick or a card, and when? What went out through a mailbox or a sync client? And what is a single capture of the endpoint still carrying that a rebuild would have thrown away?
A finding is worth exactly what the handling behind it can be shown to be worth, and the duty to look after material starts when proceedings become a realistic prospect — not when a claim form lands. That makes capture, hashing, sealed storage and a legible paper trail a discipline in their own right rather than a preliminary to the interesting part. Locked machines, and machines somebody has had a go at erasing, are handled under workstation deep imaging: the encrypted volume gets taken while a recovery key can still be produced, and a wiping run is named, dated and put against an account.
From here the subject is a person and not a volume. Access used for something it was not granted for, the records a server writes whether or not anybody ever reads them, and the four situations that account for most of the calls that come in.
Sessions dated after a leaving date, read back out of your own authentication logs.
A leaver's final fortnight, rebuilt out of the laptop that came back on the Friday.
Where a parts library, a repository or a client database went, and whose version came first.
Whichever of the ten pages brought you here settles what gets asked. It settles none of the six below, which are the same for a family laptop and for a tier-one supplier's file server.
A write-blocker sits in the line for the whole acquisition, so the disk that came out of the parcel cannot be altered by anything done to it at this bench, deliberately or by accident.
What comes off the exhibit is an evidence container carrying its own metadata, in a format any competent examiner elsewhere can mount, verify and pull apart without needing us to explain it.
SHA-256 is computed while the image is being written and again at each later verification. Alter one byte of that image and the two figures separate, and the log records that they did.
Equipment, examiner, hour and action, entered as each step happens. A file written up the following Friday is the first weakness an opposing expert goes hunting for, and they find it.
Indexing, carving, artefact extraction and timeline work all run against the copy, in OSForensics. Passware opens a protected file only where the client holds the rights to what is inside it.
Seal, signature and movement, from booking-in at Oxford to the exhibit going home, written on the assumption that a hostile reader will go through it line by line looking for a gap.
The unwelcome sentence belongs at the top rather than in a footnote. An investigation is not covered by no fix, no fee. That guarantee attaches to logical recovery, and the exclusions printed beside it run to exactly four: electronic and mechanical failure, chip-level work, DVR jobs, forensic jobs. The reason is arithmetic rather than salesmanship. Bench hours are identical whether an examiner ends up handing you your case or taking it away, so the fee is agreed and settled before the image is opened and not once somebody knows what is sitting in it.
Both assume one machine and one question put to it. Nine laptops, a file server and a tenancy export is a different exercise, so anything spanning more than one device is measured during the free diagnostic and written down before you are asked to agree to it. Looking costs nothing and finishes two working days after the exhibit is booked in at Oxford, which is also the hour the custody file opens. Work that is not an investigation keeps whatever band it has always had on the prices page. One thing regularly sold under this heading does not belong under it. Recovering from a ransomware attack is media work and takes the media bands — £300 + VAT a drive, from £500 + VAT an array or a server — whatever the strain was called and however alarming the note on the screen was. Finding out how the intruder got in and what left the building on the way is a different question, bought separately, at £800 + VAT with its own scope and its own invoice.
Most instructions here come from employers, from HR teams and from solicitors, and a private client is asked the same questions and given the same terms. There are three routes onto this bench and there is no fourth. Equipment a business bought and issued to somebody. A written instruction from a solicitor, an insurer or a court. Hardware that genuinely belongs to the person asking, which in a family matter means owned outright or owned between the two of you. Against that sits a short list of refusals that no fee alters. Other people's passwords are not worked out or defeated. Monitoring software is not supplied, fitted or advised on for anybody. Live traffic is never intercepted, because interception is reserved to the bodies named in the Investigatory Powers Act 2016 and no private laboratory is among them. Somebody with no right to look inside a device does not acquire one by paying a laboratory to look for them. And phones and tablets are not examined here at all.
An exhibit is not packed the way an ordinary drive is packed, so the telephone call comes before the parcel tape. Ring 0800 689 0668 and the packaging, the paperwork and the timing get settled while everything is still where it was found. Coventry has no counter of its own and nothing is collected anywhere in this network: it travels to Oxford tracked and insured, or you hand it in there yourself, which is fifty-five miles of M40 and about an hour when the junctions behave. The custody file is opened as it is booked in.
As a rule the storage comes out and the machine stays where it is. That applies to a laptop, a tower, an iMac and to the recorder sitting under a counter. Taking equipment apart is not something this bench does, and a repair shop will free a drive in a few minutes. Two things go the other way: an external drive stays sealed inside its own case, and a NAS travels as a complete unit with its disks still in their bays. A Fusion Mac is a third case — both of its drives come out and travel together, each one labelled. The single situation nobody can work around is memory soldered flat onto a mainboard, which is how Apple Silicon Macs and a good many slim laptops are built: if the storage will not unbolt, there is no parcel to send.
↓ Print the shipping & booking-in form (PDF)
Put Oxford Data Recovery on the label. From Coventry it is roughly fifty-five miles straight down the M40, about an hour if you would rather drive it in than post it. Either way you are told the moment it is logged, and the free diagnostic finishes two working days later.
Unsure what ought to go in the box? Ring 0800 689 0668 before you seal it, or work through the free online diagnostic and let it do the asking.
Diagnosis costs nothing, the scope goes in writing, every image verifies. Ten minutes on the telephone will separate the questions a disk can answer from the ones it was never going to.