Three questions decide a copying case. What was plugged in? At what hour? And did anything go across? A Windows machine answers the first two by itself, having never been configured to do any such thing, and hands over most of the third to anybody who knows where it keeps its notes. All of it is read from a verified copy and set out as a dated sequence — and none of it depends on the device ever coming back, which is the part clients rarely believe until it is shown to them.
◇ A serial number is evidence. It is not a person. £800 + VAT for the examination and its report, £400 + VAT for verified images with deleted contents extracted and nothing written. Same price point as a recorder drive. Free diagnostic, written scope. Forensic jobs sit outside no fix, no fee. A dead stick is £250 + VAT.
Removable hardware announces itself to Windows and Windows writes it down. In the system hive one key carries a maker, a product and an instance identifier for every stick, card reader and portable disk that has ever been mounted, and where the device reports one, that identifier is the serial printed on the casing. From Windows 8 onwards the properties held against each of those entries have also carried three times: first seen, last present, last removed. Driver installation is timed separately, to the second, in a log of its own. Further keys tie a serial to the drive letter the device took and to the volume label it advertised. Extracted from an image, all of that becomes an inventory covering the working life of the computer, and it regularly names equipment nobody in the business had thought to mention.
Attachment is the easy half and on its own it settles nothing. The case needs documents shown to have travelled. Shortcut records in the recent items folder get written when a file is opened, and each holds a target path, a size, and the serial of the volume the file came off — which is the detail that ties one named document to one particular stick rather than to removable media as a category. Jump lists hold the same information application by application and outlive the shortcuts being cleared away. Shellbags retain the shape of directories somebody browsed on a device that vanished months ago. The change journal then puts the lot into minute-by-minute order, which is what turns a pile of individually deniable fragments into a sequence.
Reading that signature is a fair proportion of the craft. Duplicate a file onto another volume and the copy is created at the destination in that instant, so its creation time is really a record of the transfer. Modification time behaves quite differently, belonging to the contents and crossing over untouched. What that produces is a document created at a quarter to eleven on a Sunday evening and last edited fourteen months earlier — a combination that is not describing when anything was written but when it was taken. Put beside the device register and the journal, each transfer acquires an hour, and a run of them late at night across a final fortnight is seldom the coincidence it gets offered as.
Where the device does come back, imaging it completes the account: what it holds today, when each item arrived on it, and what has been taken off since. A hurried clear-out on somebody's last morning is a finding in its own right and comes with a time attached. Producing the device also permits hash comparison against your originals, which is the step that moves the evidence from these two files look similar to these two files are identical, byte for byte. Where the stick belongs to somebody else it is examined only with their agreement, under a protocol the solicitors have settled, or on a direction of the court — although everything your own computer recorded about that stick belongs to you regardless, and in practice supplies most of the account.
A pen drive is simply the most frequent visitor rather than the only one. Camera, dashcam and survey cards, CompactFlash out of older equipment and portable solid-state drives all take the same acquisition and the same analysis. Card work runs in both directions, too: as often to recover footage or photographs somebody deleted as to show that company material reached the card in the first place. Then two limits, better heard now than found out later. A serial identifies equipment, never a person. And a device that has been reformatted and filled up again yields a fraction of what an untouched one does, which is an argument for asking for it early instead of waiting for disclosure to produce it.
The handling standards behind all of this are on the forensic practice hub. Putting an hour on the removal itself belongs to deleted-file forensics, and the employer instruction this usually forms part of is employee data theft. Where a stick has simply stopped working and nobody is arguing about anything, none of this applies and USB stick recovery at £250 + VAT is the job you want.
No single object generates more of this work than a memory stick somebody bought at a service station.
Each line arrives with a date, the profile it belongs to and the record it came out of, so any one of them can be gone back to and checked on its own.
Each stick, reader and portable disk the computer has ever mounted, serials included.
First seen, last present and last removed, taken from the properties of each entry.
Shortcut and jump-list entries fastening a named document to one particular volume.
Shellbags holding the shape of directories browsed on media that has since gone.
The clock pattern a copy leaves behind, used to put an hour on each transfer.
Where the stick or card is produced: imaged in its own right, deletions recovered.
A stick and the computer it was plugged into are normally one instruction rather than two, and the figure covers the pair of them. £800 + VAT is the whole thing written up: the device register, the hours of contact, the documents bound to a named volume, the copy clocks, set out in a report an opponent can pick apart. £400 + VAT stops one step earlier, at verified images with their deleted contents extracted, for somebody else to read. That second figure matches what a CCTV recorder disk or an encrypted volume costs, so nothing sixth has been added to the band list to accommodate this work.
No fix, no fee does not reach this work. It covers logical recovery, and forensic jobs are one of the four exclusions published beside it, with electronic and mechanical failure, chip-level work and DVR jobs. That is why the fee is agreed before an examiner opens anything — a serial number that turns out to be the office printer took the same hours to find as one that turns out to be a stick bought on the M6. Both figures cover one machine and one question; extra devices are counted during the free diagnostic and quoted in writing. That diagnostic is free and closes two working days after booking in at Oxford. A dead stick nobody is arguing about is £250 + VAT and none of this applies.
Removable-media work runs on computers and media a business owns and issued, on a solicitor's, insurer's or court's written instruction, or on hardware that genuinely belongs to the person asking — which in a family matter includes something owned between the two of you. A stick that belongs to somebody else is examined only with their agreement, under a protocol the solicitors have settled, or on a direction of the court; everything your own computer recorded about that stick is yours regardless. The refusals are fixed. No working out or defeating of anybody else's password. No monitoring software supplied, fitted or advised on. No interception of live traffic, which the Investigatory Powers Act 2016 reserves to bodies no private laboratory belongs to. No phones and no tablets, in any case at all.
A device and the computer that wrote to it are worth examining as a pair, so call 0800 689 0668 and the set can be agreed before the box is taped up. No collection service exists anywhere in this network and there is no counter in Coventry: parcels reach Oxford tracked and insured, or come across the counter there in office hours, and each item joins the custody record on arrival.
As a rule the storage comes out and the machine stays where it is. That applies to a laptop, a tower, an iMac and to the recorder sitting under a counter. Taking equipment apart is not something this bench does, and a repair shop will free a drive in a few minutes. Two things go the other way: an external drive stays sealed inside its own case, and a NAS travels as a complete unit with its disks still in their bays. A Fusion Mac is a third case — both of its drives come out and travel together, each one labelled. The single situation nobody can work around is memory soldered flat onto a mainboard, which is how Apple Silicon Macs and a good many slim laptops are built: if the storage will not unbolt, there is no parcel to send.
↓ Print the shipping & booking-in form (PDF)
Put Oxford Data Recovery on the label. From Coventry it is roughly fifty-five miles straight down the M40, about an hour if you would rather drive it in than post it. Either way you are told the moment it is logged, and the free diagnostic finishes two working days later.
Unsure what ought to go in the box? Ring 0800 689 0668 before you seal it, or work through the free online diagnostic and let it do the asking.
Leave the computer switched off, keep hold of whatever came back in the desk drawer with it, and ring before somebody in IT decides to reformat a stick and reuse it.