Preservation answers no questions. It buys the right to ask them later, which is a different product and a much cheaper one. Devices and accounts are identified, copied, verified, sealed and written up, and then everybody gets on with the year — the hardware back in service, the images in storage, and a file of paperwork that can be handed straight across when disclosure eventually arrives.
◇ Preservation buys the right to ask later. £400 + VAT a device: imaged, hashed, sealed, logged, nothing examined — the recorder and encrypted-volume figure. £800 + VAT if a question arrives afterwards, run from the stored image. Diagnosis free. Forensic work sits outside no fix, no fee. Ordinary bands.
Nobody serves notice that the duty to preserve has started. It begins when litigation becomes a realistic prospect, which in practice means somewhere around the letter before action, the grievance that has plainly gone past internal resolution, or the moment a director says the word solicitor out loud. From then on, allowing relevant material to be destroyed is a problem in its own right, and the eventual argument about it is never technical. It is about what the organisation knew, on what date, and what it did next. A rebuild in January is housekeeping; the same rebuild in September, with February's letter in the file, is a conversation nobody enjoys.
First, a helpdesk clears a machine in perfect good faith because the asset ticket said reimage and nobody told them otherwise. Second, an automatic process runs on schedule — mailbox retention, log rotation, backup expiry, the disposal contractor's quarterly collection — and removes exactly what was wanted. Third, everybody assumes somebody else owns the hold, so no list is written, no custodian is told and nothing is checked a month later. The technical half of a hold is the easy half. What actually protects material is a written scope, those automatic processes suspended in writing, custodians told in terms they will act on, and one named person carrying it.
Straightforward and quick, once the list exists. A device goes behind a write-blocker and is copied into an E01 container; SHA-256 is taken while the image is written and again when it is verified; the image goes into sealed storage; the exhibit is entered in the log. Accounts are dealt with by putting the mailbox into hold and exporting the audit records before any retention period closes over them. Servers are captured by targeted extract to a scope agreed beforehand rather than by being lifted out of a rack. Then the hardware goes back to work, which is usually the sentence that unlocks the disagreement between IT and the lawyers.
Four documents come out of it and each exists from the first day. A schedule of everything caught by the hold, device by device and account by account. An acquisition log giving the time, the examiner and the equipment used for each capture. Notes written while the work was going on. And a storage record showing every movement in and out of the safe, against a date and a name. Those four are what separate evidence from a copy of a disk. Without them, the opening question in cross-examination writes itself: who else had access to this, and when, and how would anybody know?
It produces no findings. There is no timeline, no opinion and nothing to read, because nothing has been asked yet — that is the £800 + VAT instruction and it is bought separately, often months afterwards and frequently never. And it cannot reach backwards. A hold freezes the position as at the day of capture; whatever was already overwritten, expired or deliberately cleared before that day stays gone, and the report describes the state the material was found in rather than pretending otherwise. What you are buying is optionality, at a point where nobody yet knows which questions will matter.
Taking the copy is workstation deep imaging and the standards behind it sit on the forensic practice hub. Where a hold turns into a question, the two instructions that follow it most often are employee data theft and trade secret and IP theft. Retention inside a mailbox or a tenancy is handled at email and cloud exfiltration.
Preservation has an awkward timing problem: it is at its cheapest and most useful precisely when arranging it still feels like an overreaction to everybody in the room.
Read behind a write-blocker, checked on SHA-256, sealed, and written into a custody file that can be handed straight across to whoever asks for it. Nothing examined, nothing concluded, nothing written up — what you get is a copy that will still verify in two years' time and a set of paperwork that explains itself with nobody standing beside it.
Should an examination and a written report be wanted afterwards, that is £800 + VAT and it runs from the image already in storage, so no acquisition is bought twice. The comparison is with month nine of a disclosure exercise, standing in front of a list of devices that were rebuilt, reissued or skipped in the fortnight when nobody was sure any of this would come to anything. That is the awkward shape of the sum: a hold looks premature at the moment it is cheapest, and obvious at the moment it can no longer help.
Every one of these exists from day one, and every one is written expecting a hostile reader to work through it line by line.
Each device and account inside the hold, listed separately and dated.
Time, examiner and equipment, entered as each capture was made.
The figure at acquisition and at every verification since, each printed in full.
What was done and why, written during the work instead of reconstructed after.
Every entry to and removal from sealed storage, against a date and a name.
Ready for disclosure, binding each image to its source device and its hashes.
Preservation is the cheaper of the two products on this site and the one this page exists to sell. £400 + VAT a device covers the capture behind a write-blocker, an E01 written and verified on SHA-256, the deleted material extracted, the exhibit sealed and every movement logged. No findings come out of it because nothing has been asked yet. That figure is not a preservation surcharge; it is the point a CCTV recorder drive and an encrypted volume already occupy, and the site still lists five bands rather than six.
Neither figure is covered by no fix, no fee, which applies to logical recovery and publishes four exclusions — electronic and mechanical failure, chip-level work, DVR jobs and forensic jobs. A hold has no result to be contingent on in any case; you are buying the option to ask questions later. Both prices assume one device and one question, so a schedule of fourteen machines is measured during the free diagnostic and quoted in writing before anything is captured. The diagnostic costs nothing and closes two working days after booking in at Oxford, where the custody file opens at the same moment.
Holds are arranged by whoever owns the material or by their solicitors, and where the parties have already agreed a protocol it is worked to as it stands. That is the same three-route rule the rest of the practice runs on: company equipment the business issued, a written instruction from a solicitor, insurer or court, or hardware genuinely belonging to the person asking. Preservation does not widen any of it. A custodian's own laptop is not captured because it appears on a list; it needs their agreement, a protocol or a direction. Passwords belonging to other people are not defeated, monitoring software is not supplied, fitted or advised on, and live traffic is not intercepted, interception being reserved by the Investigatory Powers Act 2016 to bodies no private laboratory is one of. Phones and tablets fall outside the practice entirely and cannot be held here either.
Suspend the reissue and disposal tickets in writing before anything else, then call 0800 689 0668 so the schedule and the order of capture can be agreed. Drives travel rather than whole computers wherever the disk comes out, and array members want their bay order written on them. There is no collection service anywhere in this network and no Coventry counter: tracked and insured post to Oxford, or across the counter there in office hours, with the custody file opening at booking-in.
As a rule the storage comes out and the machine stays where it is. That applies to a laptop, a tower, an iMac and to the recorder sitting under a counter. Taking equipment apart is not something this bench does, and a repair shop will free a drive in a few minutes. Two things go the other way: an external drive stays sealed inside its own case, and a NAS travels as a complete unit with its disks still in their bays. A Fusion Mac is a third case — both of its drives come out and travel together, each one labelled. The single situation nobody can work around is memory soldered flat onto a mainboard, which is how Apple Silicon Macs and a good many slim laptops are built: if the storage will not unbolt, there is no parcel to send.
↓ Print the shipping & booking-in form (PDF)
Put Oxford Data Recovery on the label. From Coventry it is roughly fifty-five miles straight down the M40, about an hour if you would rather drive it in than post it. Either way you are told the moment it is logged, and the free diagnostic finishes two working days later.
Unsure what ought to go in the box? Ring 0800 689 0668 before you seal it, or work through the free online diagnostic and let it do the asking.
£400 + VAT a device buys an image, a hash, a seal and a paper trail, with the hardware back at work afterwards. Ring before the next reissue ticket closes.