Of everything on this site, an image is the least expensive item and the one most often bought a month too late. Once a machine has been cleared down and handed to whoever needed a laptop, every question anybody thinks of afterwards simply has no answer, and no budget approved in September retrieves what was overwritten in June. A capture takes the volume as it stands, verifies it, seals it, logs it, and lets the hardware go back to work. £400 + VAT preserves and extracts. £800 + VAT adds the examination and the report.
◇ Capture is cheap. Losing the volume is not. £400 + VAT images, verifies, extracts and seals; £800 + VAT adds the examination and the report, run later from the same image. That £400 is the recorder and encrypted-drive figure. Diagnosis free. Investigations are outside no fix, no fee, with electronic and mechanical failure, chip-level work and DVR jobs. Bands.
The disagreement is operational rather than legal. IT needs the asset back in circulation and has a ticket saying so; the solicitors need it untouched and have a letter saying so; and the two positions stay irreconcilable exactly until somebody takes a copy. After that the physical machine has no evidential job left to do and reverts to being a laptop. Typically that means a day or two out of service rather than the month everybody was braced for, and the copy stays good for as long as anyone keeps the file. The way this goes wrong is always the same and always preventable: the device gets rebuilt in week two because nobody had the standing to stop the ticket, and in week nine a solicitor asks what the downloads folder was holding.
That distinction is where most of the value hides, because an image includes every part of the disk the operating system politely declines to show anybody. Removed material still lying in free space. Browser history, cache and cookies, out of which research, uploads and sign-ins can be reassembled in some detail. Paging and hibernation files, which regularly carry fragments of documents that were open and conversations that were on screen at the time. The local stores Teams and Slack maintain, which can outlast a deletion performed on the server. Registry hives holding the removable-device register and the software history. Connection records placing the machine on a particular network at a particular hour. A reimage removes all of that in an afternoon, and no other source anywhere reproduces it.
Full-disk encryption is the single commonest reason one of these captures ends badly, and the cause is administrative almost every time rather than technical. A locked volume copies perfectly well; the copy is simply inert until somebody produces a key, and keys have a habit of walking out of the building on the last Friday along with the person. BitLocker keys are normally escrowed to Active Directory, to Entra ID, or to whichever Microsoft account the machine was enrolled against. FileVault keys go to a management platform or to the user's Apple account. So the sequence runs: go and find the key, take the image, and record where the key was found. If nothing survives anywhere, the volume stays shut — for this bench and for everybody else's — and you are told that on the telephone rather than discovering it a fortnight into the engagement. The everyday, non-evidential version of the same problem is BitLocker recovery at £400 + VAT.
Now and again it is more useful than one handed back untouched. A quick reinstall sits on top of the old volume and leaves the bulk of it readable in free space underneath, and it also leaves something of its own: a date. Where the installation timestamp falls between the resignation and the handover, that single fact is worth establishing whatever else the disk turns out to hold. Erasure utilities leave install records, prefetch entries and a suspiciously even pattern across the surface. A genuine multi-pass overwrite of a spinning disk does destroy the contents, and in that case the finding becomes the wipe itself — which tool, at what hour, launched by which account — and in an employment matter that is frequently worth more than the files would have been.
Both are worth knowing before a parcel is made up. The first is any computer whose storage is soldered to the mainboard, which covers Apple Silicon Macs and a fair number of slim Windows laptops: if the storage will not unbolt there is nothing to send, and no amount of money changes that. A Fusion Mac is the workable Apple case — both drives come out, travel together and are labelled. The second is phones and tablets, which are not examined here in any form. Neither limit is a matter of willingness. Where a case genuinely turns on handset evidence, that part needs a different laboratory, and it is better to hear so at the first call than after the custody file has been opened.
The standards behind every acquisition are on the forensic practice hub, the duty that makes a capture necessary is at legal hold and chain of custody, and the questions an image is then asked are at deleted-file forensics and USB device forensics. Where a drive has simply failed and nobody is in dispute, that is ordinary hard drive recovery at the published bands.
Any one of these on its own justifies taking an image before the machine is touched again.
Every one of these comes out of a single acquisition, not one of them survives a reimage, and no other system anywhere holds a copy to fall back on.
One E01 carrying the entire volume, which any competent examiner can mount and verify.
The SHA-256 taken at acquisition, matched again at each verification since.
History, cache and cookies — research, uploads and the pages somebody signed in on.
Paging and hibernation data: documents left open, chat on screen, the odd credential.
Whatever Teams and Slack wrote to the disk, deletions on the server notwithstanding.
Remote-access sessions and connection records placing the machine somewhere at an hour.
Most machines that come through this door are bought at £400 + VAT and never go any further, which is the correct outcome. That figure covers the acquisition itself: the volume read behind a hardware write-blocker, an E01 written and verified on SHA-256, the deleted material extracted, the exhibit sealed and logged. No analysis, no opinion, nothing to read. It is deliberately pitched at the same point as a CCTV recorder drive and an encrypted volume rather than being given a band of its own, so the price list on this site still has five entries on it.
£800 + VAT is the examination and the written report, and it can be commissioned months after the capture without anything being re-imaged. Investigations sit outside no fix, no fee alongside the other three published exclusions — electronic and mechanical failure, chip-level work and DVR jobs — so the money is settled before an examiner starts rather than after the answer is known. One machine and one question is what each figure assumes; a fleet is scoped during the free diagnostic, which costs nothing and closes two working days after booking in at Oxford, and written down first. A disk that has simply failed is not investigation work and takes its ordinary band.
Acquisitions run on equipment the business owns and issued, or on the written instruction of a solicitor, an insurer or the court, or on hardware the person asking genuinely owns — jointly owned counts, in a family matter. Nothing else opens a machine here. Where a capture is refused it is refused on the telephone rather than after a custody file has been opened: no password belonging to somebody else is defeated or guessed at, no monitoring software is supplied, fitted or advised on, and live traffic is not intercepted, that being reserved by the Investigatory Powers Act 2016 to bodies a private laboratory is not one of. A client who has no right to look inside a device does not gain one by instructing us. Phones and tablets are outside this practice completely, in every kind of case.
The drive travels and the computer stays with you wherever the disk comes out, so ring 0800 689 0668 first and the packaging and paperwork get agreed before anything is sealed. Nothing is collected anywhere in this network and Coventry has no counter: it reaches Oxford by tracked, insured post, or over the counter there in office hours. Storage soldered to a mainboard, as on Apple Silicon machines, will not come out and cannot be posted.
As a rule the storage comes out and the machine stays where it is. That applies to a laptop, a tower, an iMac and to the recorder sitting under a counter. Taking equipment apart is not something this bench does, and a repair shop will free a drive in a few minutes. Two things go the other way: an external drive stays sealed inside its own case, and a NAS travels as a complete unit with its disks still in their bays. A Fusion Mac is a third case — both of its drives come out and travel together, each one labelled. The single situation nobody can work around is memory soldered flat onto a mainboard, which is how Apple Silicon Macs and a good many slim laptops are built: if the storage will not unbolt, there is no parcel to send.
↓ Print the shipping & booking-in form (PDF)
Put Oxford Data Recovery on the label. From Coventry it is roughly fifty-five miles straight down the M40, about an hour if you would rather drive it in than post it. Either way you are told the moment it is logged, and the free diagnostic finishes two working days later.
Unsure what ought to go in the box? Ring 0800 689 0668 before you seal it, or work through the free online diagnostic and let it do the asking.
A couple of days out of circulation buys a copy that keeps for years. One afternoon at the front of the reimage queue closes every question anybody asks afterwards.