Litigation alters what a laptop actually is. With proceedings in prospect, a device or an account is no longer an IT asset. It is potential evidence, and the handling of it will get gone over every bit as hard as what it holds. We put preservation on a documented footing that stands up to exactly that, for solicitors along Union Street and the clients sitting behind them.
◇ Footing first. Bench time after. The free diagnostic opens the job, a written scope follows it, and forensic fees clear ahead of any examination. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Full pricing is on the data recovery cost page.
Preserving evidence is at its cheapest during the stage when doing it still feels unnecessary.
Before it is anything else, a hold is a piece of record-keeping. Everything inside scope, device or account, gets listed on its own line. Each one is captured, and each capture carries an hour, an operator and the kit used against it. Hash values are worked out on SHA-256 while the image is still being written, so a later change turns up as verification failing rather than as an ambush during evidence. Originals are sealed away into secure storage. Each subsequent move, bench to safe and safe to court, takes an entry of its own, and nothing sits unexplained between two of them. Continuity is the first thing an opposing examiner will go for, and turning it into something tedious is the whole point of the exercise.
The handling answers to a set of digital evidence principles, published by ACPO for policing across the UK and kept up by the NPCC since. Scotland is no different: they apply here as they apply everywhere else in the UK. An original ought not to be altered by anything done to it. Anyone who does touch an original has to be able to explain what they did and for what reason. An audit trail must be good enough that an independent examiner can run the whole exercise again and land on the same answer. Responsibility overall sits with one named individual. Everything leaving this bench is prepared to evidential standards suitable for Scottish civil or criminal proceedings, and for an employment tribunal sitting in Scotland. Admission belongs to the court, so no honest practice promises it. What can be promised is method that leaves a court nothing to hesitate over.
Evidence lost to litigation is nearly always lost innocently. A laptop goes out to the next starter. Somebody purges an account during routine housekeeping. A technician has a well-meant poke about. Once proceedings are in prospect, reuse is the enemy. It overwrites, it shifts dates, and it hands the other side the suggestion that whatever went missing happened to be the useful part. Our advice is thoroughly unglamorous. Book the capture for the day hardware comes back, not after a month in a drawer. Only reissue a machine once its image verifies. Record every step in between. Replacement kit keeps the business trading while the evidence stays still.
Preserved material has to be produced eventually, so the output is built for that from the outset. Findings first, in plain English. Method in an appendix another skilled witness can follow back. The exhibit schedule carries hash values, custody history and source device against each image. Documents in Scotland are recovered by specification and, where the court grants it, by commission and diligence, so the schedule is drafted to let the items sought be identified without an argument about it. Commercial actions in the Court of Session and ordinary actions in the sheriff court are worked to a single standard. Where instruction is joint, or directions have been agreed, we hold to their terms.
Bench discipline beneath the lot of it belongs to the forensic recovery hub. For capture itself, see workstation deep imaging. The dispute a hold most often protects against is employee data theft. Numbers sit on the prices page.
A file the other side may read line by line if they care to. That is rather the point.
Devices and accounts held inside scope, listed out and dated.
Hour, operator and equipment entered against each image taken.
SHA-256 at capture, and again at every verification afterwards.
Exhibits sealed into secure evidence storage, with movements entered.
A signed trail over every handover, with nothing left out.
Drafted to sit against a specification, each image tied to source and hash.
Each instruction opens on the free diagnostic. Allow 2 working days from the date a device reaches this bench. Forensic casework sits outside no fix, no fee. The full forensic investigation with report is £800 + VAT, payable 100% upfront. The less expensive Forensic binary image and deleted-file extraction service, without the report, is £400 + VAT. Any Forensic work required will be payable upfront. You will find both figures repeated on the prices page, and we take nothing until a scope is agreed in writing.
Hold and preservation work is carried out for a company over its own estate, and for solicitors instructing in writing. Three doors in, and we have never found a fourth. Kit the business itself owns. A written instruction out of a solicitor, an insurer or from the court. Or else a device that genuinely belongs to the client, which in a matrimonial matter takes in one held between the two of them. Nothing gets hacked at this bench. Live traffic is never intercepted. Where the instructing client holds no right to look inside a device, we hold none either.
Holds get scoped on the phone before anything moves. Ring 0800 689 0668, go through the devices, the accounts and the dates with us, and exhibits follow. Collection is not something we offer, so they come tracked and insured or across the counter. Each one is sealed into secure storage at Edinburgh, and the custody log runs from that point.
Still bolted into a laptop, desktop, MacBook, iMac, server or CCTV / DVR box? Get the hard drive or SSD out first. The bare drive travels on its own. Stripping machines down is not a job this lab takes on. Flash soldered to a motherboard, as on Apple Silicon Macs and a couple of very thin laptops, is our one flat no: if it will not unbolt, it cannot be worked on.
↓ Print the shipping & booking-in form (PDF)
Address it for the attention of Edinburgh Data Recovery. From Aberdeen that is roughly 130 miles and two and a half hours down the A90, or next working day by tracked post if you would rather not make the run. You get a call the moment it is booked onto the bench.
Not sure what belongs in the box? Ring 0800 689 0668 before you tape it shut, or work through the free online diagnostic.
A hold arranged this month costs less than one you end up having to explain next year.