Litigation changes what a laptop actually is. A device or account may be an IT asset, but with litigation looming it becomes potential evidence, and the way it is handled is subject to the same level of scrutiny as its content. Therefore, we have developed documented procedures for preserving evidence which can stand up to that scrutiny, for solicitors along Union Street and their clients alike.
◇ Footing first, then the bench time. It all begins with the free diagnostic, which is then followed by a written scope, and forensic fees must be paid before any actual examination can take place. Generally speaking, in most cases you only pay if we recover your data; the exceptions are electronic and mechanical failures, chip-level work, DVR jobs and forensic jobs. Full pricing can be found on the data recovery cost page.
The least expensive time to preserve evidence is at the earliest stage, even though at that time preserving such evidence appears unnecessary.
A hold is most fundamentally a documentation tool. Everything that falls within scope, whether a device or an account, gets listed individually on its own line. Each one is captured, and every capture has an associated time stamp with an assigned operator along with the kit used to make it; the hash values are worked out using SHA-256 while the image is still being written, therefore any change made later will be detected as a failed verification rather than as an ambush when presented at trial. All originals are sealed away in secure storage. Every move from one location to another (bench to safe and safe to court) creates another entry. Nothing can exist between entries without explanation. An opposing examiner's first target is continuity, and making it tedious is the whole point of the exercise.
The handling follows a set of digital evidence principles, published by ACPO for police forces across the UK and kept up by the NPCC since. These apply in Scotland just as they apply throughout the rest of the UK. No person should alter an original piece of evidence. Any individual involved in the examination of an original must provide sufficient detail about their actions and why they took those actions. The audit trail must be complete enough to allow an independent examiner to replicate the entire process from beginning to end and reach the same conclusions. Ultimately, overall responsibility rests upon a single named individual. All materials leaving this bench are prepared to evidential standards which would meet the requirements of Scottish civil or criminal proceedings, or an employment tribunal sitting in Scotland. Admission is a matter for the court, and no honest practice can guarantee it. What can be promised is a method that leaves a court nothing to hesitate over.
Evidence lost in litigation is nearly always lost innocently. The first thing to happen is usually that a laptop gets handed on to the next new starter. Another common event would be when someone purges an account during a routine clean-up. And another is that a technician has a well-meant poke around. As soon as there's a possibility of court proceedings, reuse becomes the worst enemy. Reuse can overwrite, can move dates, and suggests to the opposing party that what was lost was actually the most important piece of evidence. Our recommendations are completely unglamorous. Schedule the capture for the day the hardware comes back, not after a month in a drawer. Do not reissue a computer until its image verifies. Document every step in between. Use replacement kit so that the business continues to operate while the evidence stays still.
Preserved material will ultimately need to be produced, and therefore the final product is designed with this end goal in mind from the outset. Findings come first, in plain English. The method goes in an appendix that another skilled witness can follow back. The exhibit schedule includes hash values, custody history and source device information for each image. In Scotland, documents are recovered by specification and, where the court grants it, by commission and diligence; therefore, the exhibit schedule is written so that the items sought can be easily identified and there is no dispute over what is being sought. Commercial actions in the Court of Session and ordinary actions in the sheriff court are worked to one uniform standard. When instruction is joint, or when directions have been agreed, we adhere to their terms.
The bench discipline behind all of this falls under the forensic recovery hub. For more about capturing workstation images for forensic analysis see workstation deep imaging. The dispute a hold most typically protects against is employee data theft. Prices are located on the prices page.
The other party can read through the file line by line (if that's what they want to do). That is pretty much the point.
Devices and accounts held inside scope, listed out and dated.
Hour, operator and equipment entered against each image taken.
SHA-256 at capture, and again at every verification afterwards.
Exhibits sealed into secure evidence storage, with movements entered.
A signed trail over every handover, with nothing left out.
Drafted to meet a set specification; each image captured with documentation of its source and hash.
Every instruction starts with the free diagnostic, and you should allow 2 working days from the date a device reaches this bench. Forensic work is not covered by our usual payment terms, where in most cases you only pay if we recover your data. The full forensic investigation with report costs £800 + VAT and must be paid 100% upfront. The less expensive Forensic binary image and deleted-file extraction service (which does not include a report) will cost £400 + VAT. All Forensic services are required to be prepaid. Both figures are repeated on our prices page and we do not take anything until we have agreed upon a scope of works in writing.
Hold and preservation work is performed by the firm for companies on their own equipment, as well as for solicitors instructing us in writing. There are three doors in, and we still haven't found a fourth. The first is equipment owned directly by the business. An instruction received in writing from a solicitor, insurance company or from the court. Alternatively, it may be a piece of equipment that actually belongs to the client, which in a matrimonial case includes one held jointly between both parties. Nothing is hacked at this bench. Live traffic is never tapped here. If the instructing party has no entitlement to view what is stored in an item, then neither does our firm.
Ring us first on 0800 689 0668 and we'll discuss what devices, accounts and dates you need to cover, with a view to getting you a quote. Once you have your quote, you can send the exhibits over (the hard drives only, not the machines); collection is not something we offer, so they will arrive tracked and insured, or alternatively they can be handed in across the counter (Monday to Friday, 9am to 5:30pm, no appointment needed). All items are then sealed into secure storage at our Edinburgh facility, and the custody log runs from that point.
Still attached to a laptop, desktop, MacBook, iMac, server or CCTV/DVR unit? Remove the hard drive or SSD first. The bare drive travels on its own; when removing disks from a server remove all the disks and label each disk by its bay. This lab does not take machines apart. Any storage that has been soldered onto a motherboard (as in T2 and Apple Silicon Macs and a couple of thin laptops) will not be worked on: if it will not unbolt, we cannot work on it. If you're not sure what type of machine you have, ring us first. Phones and tablets are also not taken on.
↓ Print the shipping & booking-in form (PDF)
Your parcel should be addressed to Edinburgh Data Recovery, approximately two and a half hours (and 130 miles) from Aberdeen via the A90; alternatively it can reach us the next working day by tracked post if this journey time / distance is prohibitive to travel. As soon as your drive has been scheduled in we will contact you.
Still unsure about what should be placed inside of the packaging? Please call us first on 0800 689 0668, or use our free online diagnostic tool to assist you in deciding which items belong inside of the packaging before sealing.
A hold established this month is likely going to cost you less money than explaining why you had to establish a hold next year.