Legal Hold and the Custody File

Preservation answers no questions. It buys the right to ask them later, which is a different product and a much cheaper one. Devices and accounts are identified, copied, verified, sealed and written up, and then everybody gets on with the year — the hardware back in service, the images in storage, and a file of paperwork that can be handed straight across when disclosure eventually arrives.

Preservation buys the right to ask later. £400 + VAT a device: imaged, hashed, sealed, logged, nothing examined — the recorder and encrypted-volume figure. £800 + VAT if a question arrives afterwards, run from the stored image. Diagnosis free. Forensic work sits outside no fix, no fee. Ordinary bands.

The obligation turns up before the claim form

Nobody serves notice that the duty to preserve has started. It begins when litigation becomes a realistic prospect, which in practice means somewhere around the letter before action, the grievance that has plainly gone past internal resolution, or the moment a director says the word solicitor out loud. From then on, allowing relevant material to be destroyed is a problem in its own right, and the eventual argument about it is never technical. It is about what the organisation knew, on what date, and what it did next. A rebuild in January is housekeeping; the same rebuild in September, with February's letter in the file, is a conversation nobody enjoys.

Three ways a hold fails, and none of them are technical

First, a helpdesk clears a machine in perfect good faith because the asset ticket said reimage and nobody told them otherwise. Second, an automatic process runs on schedule — mailbox retention, log rotation, backup expiry, the disposal contractor's quarterly collection — and removes exactly what was wanted. Third, everybody assumes somebody else owns the hold, so no list is written, no custodian is told and nothing is checked a month later. The technical half of a hold is the easy half. What actually protects material is a written scope, those automatic processes suspended in writing, custodians told in terms they will act on, and one named person carrying it.

What the capture involves on the day

Straightforward and quick, once the list exists. A device goes behind a write-blocker and is copied into an E01 container; SHA-256 is taken while the image is written and again when it is verified; the image goes into sealed storage; the exhibit is entered in the log. Accounts are dealt with by putting the mailbox into hold and exporting the audit records before any retention period closes over them. Servers are captured by targeted extract to a scope agreed beforehand rather than by being lifted out of a rack. Then the hardware goes back to work, which is usually the sentence that unlocks the disagreement between IT and the lawyers.

The bundle you can hand across without flinching

Four documents come out of it and each exists from the first day. A schedule of everything caught by the hold, device by device and account by account. An acquisition log giving the time, the examiner and the equipment used for each capture. Notes written while the work was going on. And a storage record showing every movement in and out of the safe, against a date and a name. Those four are what separate evidence from a copy of a disk. Without them, the opening question in cross-examination writes itself: who else had access to this, and when, and how would anybody know?

Two things a hold will not do for you

It produces no findings. There is no timeline, no opinion and nothing to read, because nothing has been asked yet — that is the £800 + VAT instruction and it is bought separately, often months afterwards and frequently never. And it cannot reach backwards. A hold freezes the position as at the day of capture; whatever was already overwritten, expired or deliberately cleared before that day stays gone, and the report describes the state the material was found in rather than pretending otherwise. What you are buying is optionality, at a point where nobody yet knows which questions will matter.

Taking the copy is workstation deep imaging and the standards behind it sit on the forensic practice hub. Where a hold turns into a question, the two instructions that follow it most often are employee data theft and trade secret and IP theft. Retention inside a mailbox or a tenancy is handled at email and cloud exfiltration.

// moments that call for a hold

When preservation stops being optional

Preservation has an awkward timing problem: it is at its cheapest and most useful precisely when arranging it still feels like an overreaction to everybody in the room.

A letter before action in the building, or a request to preserve material
A tribunal claim lodged, or one that everybody can see coming
Machines waiting in the reissue queue with open questions attached to them
A disclosure date in the diary and not one device captured so far
An opponent who has begun querying the integrity of what you are holding
A regulator, an insurer or an auditor asking to see the records underneath
// the arithmetic, such as it is

What a hold costs against what losing the material costs

// preservation, per device£400 + VAT

Read behind a write-blocker, checked on SHA-256, sealed, and written into a custody file that can be handed straight across to whoever asks for it. Nothing examined, nothing concluded, nothing written up — what you get is a copy that will still verify in two years' time and a set of paperwork that explains itself with nobody standing beside it.

Should an examination and a written report be wanted afterwards, that is £800 + VAT and it runs from the image already in storage, so no acquisition is bought twice. The comparison is with month nine of a disclosure exercise, standing in front of a list of devices that were rebuilt, reissued or skipped in the fortnight when nobody was sure any of this would come to anything. That is the awkward shape of the sum: a hold looks premature at the moment it is cheapest, and obvious at the moment it can no longer help.

// the paperwork a hold leaves behind

Six records, all of them disclosable

Every one of these exists from day one, and every one is written expecting a hostile reader to work through it line by line.

Scope schedule

Each device and account inside the hold, listed separately and dated.

Acquisition log

Time, examiner and equipment, entered as each capture was made.

Hash record

The figure at acquisition and at every verification since, each printed in full.

Working notes

What was done and why, written during the work instead of reconstructed after.

Safe movements

Every entry to and removal from sealed storage, against a date and a name.

Exhibit list

Ready for disclosure, binding each image to its source device and its hashes.

// the fee, and who may lawfully ask for it

What it costs, and the authority it stands on

£400 a device, and the other figure only if you want it

Preservation is the cheaper of the two products on this site and the one this page exists to sell. £400 + VAT a device covers the capture behind a write-blocker, an E01 written and verified on SHA-256, the deleted material extracted, the exhibit sealed and every movement logged. No findings come out of it because nothing has been asked yet. That figure is not a preservation surcharge; it is the point a CCTV recorder drive and an encrypted volume already occupy, and the site still lists five bands rather than six.

£400 + VATPer device: image, hash, extraction, seal and a custody record. Hardware back in service the same week.
£800 + VATOnly if a question turns up later. The examination and the report run from the image in storage, so the capture is bought once.

Neither figure is covered by no fix, no fee, which applies to logical recovery and publishes four exclusions — electronic and mechanical failure, chip-level work, DVR jobs and forensic jobs. A hold has no result to be contingent on in any case; you are buying the option to ask questions later. Both prices assume one device and one question, so a schedule of fourteen machines is measured during the free diagnostic and quoted in writing before anything is captured. The diagnostic costs nothing and closes two working days after booking in at Oxford, where the custody file opens at the same moment.

Who arranges a hold, and what stays out of it

Holds are arranged by whoever owns the material or by their solicitors, and where the parties have already agreed a protocol it is worked to as it stands. That is the same three-route rule the rest of the practice runs on: company equipment the business issued, a written instruction from a solicitor, insurer or court, or hardware genuinely belonging to the person asking. Preservation does not widen any of it. A custodian's own laptop is not captured because it appears on a list; it needs their agreement, a protocol or a direction. Passwords belonging to other people are not defeated, monitoring software is not supplied, fitted or advised on, and live traffic is not intercepted, interception being reserved by the Investigatory Powers Act 2016 to bodies no private laboratory is one of. Phones and tablets fall outside the practice entirely and cannot be held here either.

// preservation — settled at the outset

The questions solicitors and IT both raise

Four steps, and three of them belong to you rather than to us and generally take a morning. Set out in writing what falls inside the scope. Suspend every automatic process that would otherwise consume it — reimage tickets, disposal rounds, retention policies, log rotation. Notify the custodians in terms they will actually act on rather than file. Only the fourth step is ours: capture the devices, verify the figures, seal them, log the exhibits. The first three carry every bit as much weight as the fourth in an argument about handling, and they cost nothing at all.
Nobody can, and a firm that says otherwise is selling reassurance. Whether evidence goes in is for the judge or the panel on the day. What can be engineered is a handling record that is not worth attacking: acquisition behind a blocker, E01 images that verify on SHA-256, notes made during the work, sealed storage, and a custody file with nothing missing from it. The aim is modest and important — that the hearing is spent on what the evidence shows rather than on how it was collected.
It happens constantly and it is seldom fatal. A rebuilt disk normally holds a great deal of the old volume underneath the new installation, and the rebuild carries a date of its own, which now and again turns out to be the more useful fact. Take the machine out of use today, write down who did what and when, and have it imaged. Describing the state a device was found in is a considerably better position than meeting the gap for the first time at disclosure.
Yes, and those instructions are the easiest ones to run. Where the devices, the date ranges, the search terms, the output format and the distribution have all been settled between the parties, the work follows that document and the report records that it did. Where nothing has been agreed yet, we will set out what was done and why in enough detail for the other side to repeat it.
For however long you want, decided in writing at the beginning rather than left to drift. Storage is booked in and out against a date and a name, so the record accounts for where an image has been throughout. At the end of a matter the images are returned or destroyed on your written instruction, and the destruction is logged like everything else. Nothing is quietly disposed of because a file went quiet.
// getting your media to Oxford

Posting a device in — what goes in the box

Suspend the reissue and disposal tickets in writing before anything else, then call 0800 689 0668 so the schedule and the order of capture can be agreed. Drives travel rather than whole computers wherever the disk comes out, and array members want their bay order written on them. There is no collection service anywhere in this network and no Coventry counter: tracked and insured post to Oxford, or across the counter there in office hours, with the custody file opening at booking-in.

As a rule the storage comes out and the machine stays where it is. That applies to a laptop, a tower, an iMac and to the recorder sitting under a counter. Taking equipment apart is not something this bench does, and a repair shop will free a drive in a few minutes. Two things go the other way: an external drive stays sealed inside its own case, and a NAS travels as a complete unit with its disks still in their bays. A Fusion Mac is a third case — both of its drives come out and travel together, each one labelled. The single situation nobody can work around is memory soldered flat onto a mainboard, which is how Apple Silicon Macs and a good many slim laptops are built: if the storage will not unbolt, there is no parcel to send.

  • Use a box or padded mailer with some rigidity to it, and pack around the drive until nothing shifts when the parcel is tilted. Mains adaptors, docks and leads are not wanted at this end.
  • Sending a RAID or a server? Only the member disks travel — not the chassis, not the controller — and each one wants its bay number written on it. Take a photograph of the front of the unit before anything is pulled; it costs nothing and now and again it saves a day.
  • Print the shipping and booking-in form (PDF), add a name, a number you will answer and a sentence on how the trouble began, and drop it in beside the media.
  • Most people use Special Delivery, which is tracked and covered; a courier of your own does the same job. You can also bring it: the Oxford reception takes devices over the counter, Mon–Fri 9:00am–5:30pm. Neither a Coventry counter nor a collection round exists.
// write this on the label

Oxford Data Recovery

John Eccles House
Oxford Science Park
Robert Robinson Avenue
Littlemore, Oxford, OX4 4GP

↓ Print the shipping & booking-in form (PDF)

Put Oxford Data Recovery on the label. From Coventry it is roughly fifty-five miles straight down the M40, about an hour if you would rather drive it in than post it. Either way you are told the moment it is logged, and the free diagnostic finishes two working days later.

Unsure what ought to go in the box? Ring 0800 689 0668 before you seal it, or work through the free online diagnostic and let it do the asking.

Copy it now. Decide what to ask later.

£400 + VAT a device buys an image, a hash, a seal and a paper trail, with the hardware back at work afterwards. Ring before the next reissue ticket closes.