An engineer resigns from a service company at Altens. The laptop comes back. Six weeks on, a client list that took years to build is being worked by a rival. That machine usually settles matters, provided nobody signs into it beforehand. We work from the copy, and report only what the copy will carry. Nothing further.
◇ Footing first. Bench time after. The free diagnostic opens the job, a written scope follows it, and forensic fees clear ahead of any examination. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Full pricing is on the data recovery cost page.
Any single one of these justifies taking the device out of service and leaving it alone until an image exists. City-centre office or Aberdeenshire yard, same rule.
Restraint wins these cases, not effort. Sign in and fresh data lands on top of the old. Let IT have a quick look and the dates move on precisely the folders in dispute. Send it to the rebuild queue for the next starter and the matter is finished. So the drill is short and boring. Power down. Label it. Write who has had it. Put it away. Everything afterwards runs against a copy that verifies, and the laptop stays sealed for the other side's examiner if they want their own look at it.
An operating system has a better memory than most witnesses. USBSTOR keeps maker, model and serial number for each stick, card reader or portable drive the machine has met, while setupapi.dev.log pins the first appearance of each to the second. LNK records and jump lists connect named documents to whichever letter the removable volume was handed. Shellbags retain the folder tree somebody walked through while it sat mounted. $UsnJrnl puts each operation on a clock across the weeks in question. Taken together, that is the difference between a suspicion and an instruction a solicitor can act on.
Much of it goes through the browser instead. Off the copy we pull webmail sessions with attachments addressed to a private account, rules dropped into a mailbox so chosen mail forwards itself with nobody watching, uploads via file transfer sites, and sync clients quietly mirroring folders into somebody's personal storage. Where the firm runs Microsoft 365 or Google Workspace, tenancy audit records come in alongside. Then there are two accounts of the same fortnight, the machine's and the service's, and either they agree or they do not.
The audience is a tribunal panel with a specialist at its elbow. Findings go first: numbered, dated, each pointing at the artefact underneath it. Technical explanation goes to an appendix. The exhibit schedule carries a SHA-256 value against every image. Where solicitors have agreed directions, the examination stays inside them and nowhere else. Nothing is stated that the record will not carry. That is usually why the record gets believed.
How imaging and custody run right across the practice is set out on the forensic recovery hub. For connection history, see USB device forensics. Preservation is legal hold and chain of custody. Figures are on the prices page.
Every item below comes back as a numbered, dated finding, with the artefact supporting it named alongside. A sheriff or a tribunal panel can work straight from that.
Lifted before the device is reissued, a leaver's computer generally gives up all of it.
Every item attached, by maker, model and serial, with first and last dates.
Journal operations and destination stamps that place files on a device at a stated hour.
LNK records and jump lists connecting named documents to the letter in use.
Webmail traffic, mailbox rules and personal sync activity left on the disk.
Repeat visits, out-of-hours sessions, and messages that speak to planning.
Capture stamp against leaving date, carried by SHA-256 values.
Each instruction opens on the free diagnostic. Allow 2 working days from the date a device reaches this bench. Forensic casework sits outside no fix, no fee. The full forensic investigation with report is £800 + VAT, payable 100% upfront. The less expensive Forensic binary image and deleted-file extraction service, without the report, is £400 + VAT. Any Forensic work required will be payable upfront. You will find both figures repeated on the prices page, and we take nothing until a scope is agreed in writing.
Employee instructions run on equipment the business owns, backed by HR or by a solicitor. Three doors in, and we have never found a fourth. Kit the business itself owns. A written instruction out of a solicitor, an insurer or from the court. Or else a device that genuinely belongs to the client, which in a matrimonial matter takes in one held between the two of them. Nothing gets hacked at this bench. Live traffic is never intercepted. Where the instructing client holds no right to look inside a device, we hold none either.
Once a machine becomes an exhibit it travels on terms agreed in advance. Ring 0800 689 0668 and we will sort wrapping and paperwork. No collection service is offered, so it arrives tracked and insured or over the counter, and the custody log opens the moment it is signed for in Edinburgh.
Still bolted into a laptop, desktop, MacBook, iMac, server or CCTV / DVR box? Get the hard drive or SSD out first. The bare drive travels on its own. Stripping machines down is not a job this lab takes on. Flash soldered to a motherboard, as on Apple Silicon Macs and a couple of very thin laptops, is our one flat no: if it will not unbolt, it cannot be worked on.
↓ Print the shipping & booking-in form (PDF)
Address it for the attention of Edinburgh Data Recovery. From Aberdeen that is roughly 130 miles and two and a half hours down the A90, or next working day by tracked post if you would rather not make the run. You get a call the moment it is booked onto the bench.
Not sure what belongs in the box? Ring 0800 689 0668 before you tape it shut, or work through the free online diagnostic.
Power it down, ring the freephone, and a verified copy can do the answering.