More enquiries are turned away from this page than from any other on the site, and the reason is always the same one. Whose device is it. Answer that first and the rest of the conversation is short: a machine that is yours, or that the two of you bought between you, or that a solicitor or a judge has named, can be examined properly and often to good effect. A machine that belongs to your husband or wife alone cannot, at any price.
◇ Whose device is it? That question comes first. £800 + VAT examined and written up, £400 + VAT for the verified image with its deleted material extracted — the same figure an encrypted drive carries. Diagnosis is free and the scope is written down. Forensic work is one of the four exclusions from no fix, no fee. No phones, no tablets. Prices.
The first is ownership. Yours, jointly yours, or named in a written instruction or a direction — and if none of those apply the conversation ends there rather than at the invoice. The second is whether proceedings are on foot and whether the court's permission for expert evidence has been dealt with, because in family cases that permission is not a formality. The third is what is actually in issue: a date, a document, a figure behind a figure. All three get asked on the telephone, before anything is packed, and answering them takes about ten minutes. It is a good deal cheaper than discovering the problem after a custody file has been opened.
The temptation in a bitter case is obvious, and it is a trap. Using a password you happen to know, or working one out, to open somebody else's machine is unauthorised access under the Computer Misuse Act 1990. Beyond that exposure, the courts have been firm that self-help is not a route to disclosure: material taken that way can end up having to be handed back, sometimes unread, and the taking becomes a separate argument running alongside the one you came in with. The practical effect is worse than the legal one. A judge who has spent an afternoon on how you obtained a document has spent no time at all on what the document says.
The first is handsets. Phones and tablets are not examined at this laboratory, for anybody, in any kind of matter — and since asking about a mobile is one of the commonest reasons anyone rings a forensic practice at all, it is stated on the page rather than discovered on the telephone. Where a case genuinely turns on what is inside a handset, that work belongs to a different laboratory and probably behind a disclosure application first. The second refusal is monitoring software: not sold here, not installed here, not recommended here, in any circumstances anybody has yet put forward. What this page offers looks backwards at material that already exists, on hardware you are entitled to have examined — which is the only sort of evidence a family court has ever thanked anybody for producing.
Rather a lot, and it is worth knowing before deciding whether the exercise is proportionate. Correspondence, statements and spreadsheets that were removed can often be brought back out of unallocated space or out of shadow copies. Each recovered item carries file clocks that fix it to a day. The working material sitting behind a disclosed figure is frequently still there: the earlier version of the spreadsheet, the export it was built from, the message it arrived attached to. Sign-in and browsing activity can be confined to the weeks that matter. And where a cleaning tool has been run, that generally shows, with the hour and the account behind it.
Nobody benefits from an unrestricted read of a household computer, least of all the person paying for it. So the scope is settled at the outset — one device, one date range, defined categories, agreed search terms — and that keeps both the cost and the report pointed at what the court has to decide. It also keeps out material that belongs to other people, including children, and material that is privileged, which is isolated and sent back to the solicitors rather than read here. Under a joint instruction the same scope is shown to both sides before any work begins and the findings reach both of them at the same time.
The method and the custody standards sit on the forensic practice hub. A device that has to be copied before somebody sells it or resets it is legal hold and chain of custody; the capture itself is workstation deep imaging; and putting an hour on a removal is deleted-file forensics.
Six situations where the ownership question has an answer. If yours is not among them, ring anyway and we will say so before you have spent anything.
Every item below comes off an image of a device the ownership question has an answer for. Nothing below is produced from any other sort of device, whatever anybody is prepared to pay.
Letters, statements and spreadsheets returned wherever enough of them survived.
File clocks used to place every recovered item on a particular date.
The earlier draft, the export it came from, the message that carried it.
Sign-in and browsing activity limited to the period actually in dispute.
Device, dates, categories and search terms, written down before work starts.
Hashes, seals and signatures, so the argument stays about the evidence.
A written report on one machine and one question is £800 + VAT. The image on its own, verified, with the deleted material extracted and nothing interpreted, is £400 + VAT — which many solicitors prefer, because it lets them read the material themselves and decide whether a report is worth commissioning. That £400 is the same figure an encrypted drive or a CCTV recorder disk attracts on the ordinary list rather than a special rate for family work, and this site has five bands and no sixth.
Both are settled before any work begins, because forensic instructions are one of the four published exclusions from no fix, no fee, alongside electronic and mechanical failure, chip-level work and DVR jobs. In a family matter that cuts both ways and is meant to: an examination that finds nothing cost the same afternoon as one that finds a great deal. Anything covering more than a single device is measured during the free diagnostic and priced in writing beforehand. The diagnostic costs nothing and closes two working days after the device is booked in at Oxford, which is the moment the custody file opens on it.
Family instructions turn on two things and both are dealt with before a device is booked in. Ownership first: the machine is yours outright, or the two of you own it between you, or a solicitor or a judge has named it in writing. Those are the same three routes every instruction on this site has to arrive by — issued company equipment, a written instruction, or the client's own property. Permission second, since expert evidence in family proceedings is not admitted as a matter of course. A device belonging to your husband or wife alone fits none of that and no fee changes it: working out or guessing somebody else's password is unauthorised access under the Computer Misuse Act 1990. Monitoring software is not sold, fitted or recommended here for anybody. Live traffic is not intercepted, that power belonging under the Investigatory Powers Act 2016 to bodies a laboratory is not among. And phones and tablets are not examined at all, which on this page is the refusal that disappoints the most callers.
Nothing gets packed until the ownership question has been answered, so make the call to 0800 689 0668 first, or ask your solicitor to make it. There is no collection service anywhere in this network and no counter in Coventry. The drive travels to Oxford tracked and insured, or across the counter there during office hours, and it enters the custody file as it is booked in.
As a rule the storage comes out and the machine stays where it is. That applies to a laptop, a tower, an iMac and to the recorder sitting under a counter. Taking equipment apart is not something this bench does, and a repair shop will free a drive in a few minutes. Two things go the other way: an external drive stays sealed inside its own case, and a NAS travels as a complete unit with its disks still in their bays. A Fusion Mac is a third case — both of its drives come out and travel together, each one labelled. The single situation nobody can work around is memory soldered flat onto a mainboard, which is how Apple Silicon Macs and a good many slim laptops are built: if the storage will not unbolt, there is no parcel to send.
↓ Print the shipping & booking-in form (PDF)
Put Oxford Data Recovery on the label. From Coventry it is roughly fifty-five miles straight down the M40, about an hour if you would rather drive it in than post it. Either way you are told the moment it is logged, and the free diagnostic finishes two working days later.
Unsure what ought to go in the box? Ring 0800 689 0668 before you seal it, or work through the free online diagnostic and let it do the asking.
Put that to us on the telephone, or have your solicitor do it, and you will know inside ten minutes whether there is a job here at all.