A returned laptop gets one forensic moment and it sits between hand-back and rebuild. Taken in that window, read behind a write-blocker into E01 containers and checked on SHA-256, it answers questions for years afterwards. Put back into service, it answers fewer every week. For employers running crew rotas out of Dyce and the heliport the rule is short enough: questions keep, images do not.
◇ Footing first. Bench time after. The free diagnostic opens the job, a written scope follows it, and forensic fees clear ahead of any examination. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Full pricing is on the data recovery cost page.
Any one of these puts a machine on the list, a long way in front of the rebuild queue.
The sums here are lopsided. Image it today, disk taken behind a write-blocker into E01 containers and checked on SHA-256, and the cost is a small share of what that same material fetches once a dispute exists to spend it against. Hardware goes straight back on the floor afterwards, since the evidence has stopped living on it. Leave the image untaken, pass the laptop along, and every day of the next person's work settles over the previous user's traces. Companies that make leaver captures routine are never the ones explaining a gap.
A great deal more than the documents. Cache, cookies and browsing history put research and uploads back together. Temporary folders keep drafts and copies that nobody ever chose to save. Whatever sat in memory leaves fragments behind, an open document, a chat window, now and then a credential, and those survive inside the pagefile and hibernation file. Local caches under Teams and Slack return conversations long since deleted out of the applications. VPN and connection logs record which networks the machine joined and when. A rebuild removes every bit of that. A capture keeps it.
Encryption rewards moving early. A device under BitLocker or FileVault wants imaging while keys remain in escrow and passwords are still known, which means before the leaver's account is closed, before directory tidying, and before a rebuild clears the TPM. Where a Windows volume is live and already unlocked there is a second road in: Volume Shadow Copies taken off the running system, which get round the encryption problem because the volume is already open in front of you. Work on encrypted volumes is Forensic-classed and, as with the rest of this page, payable upfront as soon as the scope is settled.
Any claim of wiping gets tested, not taken on trust. Boot tools and erase utilities, DBAN among them, drop traces behind them. Boot records. Signatures particular to the tool. Whatever pattern an overwrite lays down across the platters. Timing that can be measured against the rest of that week. Runs that stopped halfway are common enough and leave entire regions still recoverable, while a hardware erase instruction can be checked off against the drive's internal logs. Where the wipe really did complete, we say so and supply the date, since erasing a disk deliberately with proceedings coming is itself a finding.
Verification and custody belong to the forensic recovery hub. For what deletion evidence looks like on a copy, see deleted-file forensics. The duty to preserve is legal hold and chain of custody. Figures are on the prices page.
Taken once, verified once, and sitting there for whatever the dispute asks later.
The entire disk, in a format other examiners can open and check.
SHA-256 proving the image, and each copy off it, has not been altered.
History, cache and cookies, which rebuild research and uploads.
Pagefile and hibernation contents: documents, chats, credentials.
Local Slack and Teams stores, with removed conversations returned.
VPN and network traces placing the machine on a given network at a given hour.
Each instruction opens on the free diagnostic. Allow 2 working days from the date a device reaches this bench. Forensic casework sits outside no fix, no fee. The full forensic investigation with report is £800 + VAT, payable 100% upfront. The less expensive Forensic binary image and deleted-file extraction service, without the report, is £400 + VAT. Any Forensic work required will be payable upfront. Encrypted volumes, BitLocker among them, are Forensic-classed work and payable upfront on the same footing. You will find both figures repeated on the prices page, and we take nothing until a scope is agreed in writing.
Imaging runs on machines the company owns, on hardware of your own, or under an instruction from a solicitor. Three doors in, and we have never found a fourth. Kit the business itself owns. A written instruction out of a solicitor, an insurer or from the court. Or else a device that genuinely belongs to the client, which in a matrimonial matter takes in one held between the two of them. Nothing gets hacked at this bench. Live traffic is never intercepted. Where the instructing client holds no right to look inside a device, we hold none either.
Give us the machine count, and your position on encryption, when you ring 0800 689 0668, and the capture gets scoped in writing. No collection service is offered. Drives travel tracked and insured, or come across the counter in Edinburgh, and custody runs from the signature.
Still bolted into a laptop, desktop, MacBook, iMac, server or CCTV / DVR box? Get the hard drive or SSD out first. The bare drive travels on its own. Stripping machines down is not a job this lab takes on. Flash soldered to a motherboard, as on Apple Silicon Macs and a couple of very thin laptops, is our one flat no: if it will not unbolt, it cannot be worked on.
↓ Print the shipping & booking-in form (PDF)
Address it for the attention of Edinburgh Data Recovery. From Aberdeen that is roughly 130 miles and two and a half hours down the A90, or next working day by tracked post if you would rather not make the run. You get a call the moment it is booked onto the bench.
Not sure what belongs in the box? Ring 0800 689 0668 before you tape it shut, or work through the free online diagnostic.
A single capture holds every answer left in that machine. Ring the freephone.