The order it goes in
How your case runs. Authority first, the original untouched, and every step written down.
Every examination runs through the same stages in the same order, and you decide at two of them: whether to send the exhibit, and whether to accept the fee. Authority is checked before the exhibit is touched, the original is never examined directly, and every step is written into the case log and the chain of custody, which come with the report. The standard forensic report for a one-disk system is £800 + VAT, usually delivered within 5–10 working days of the exhibit arriving.
Rather talk it through? An engineer answers the bench line
0800 6890668
The order it goes in, end to end.
The fees in full →The first conversation Free
You tell us the situation, who owns the device and what you need to know. We tell you whether we can take it on, the authority we need, and which report fits. Free.
The fee and scope, in writing
The scope, the questions and the period, and the fee, £800 + VAT for a one-disk standard report, are agreed in writing before anything chargeable begins.
Posting details, by email
The posting address, the nearest of ten drop-off points and a booking sheet arrive by email. The address is not published on this site.
Arrival, authority and logging Free
The parcel is logged and given a case number, your authority and ID are checked, and the exhibit is photographed with its seals, serials and condition recorded in the chain of custody.
Imaging and hashing
The drive is imaged bit for bit behind a hardware write blocker, and MD5 and SHA-256 hashes of the source and the image are computed and verified.
Examination, on the image
The verified image is examined, scoped to your questions, with key findings confirmed in a second tool and personal material outside the scope filtered out.
The report
A self-contained HTML or PDF report with its chain-of-custody and case-log reports, the image hash re-verified before issue, and recovered files in scope on encrypted media.
The exhibit, home or under seal
The exhibit is resealed and returned by tracked post, or retained under seal if you prefer; the image is kept encrypted for an agreed period, then securely destroyed.
How long each stage takes.
| Stage | Usually | What stretches it |
|---|---|---|
| The form to a reply | The same working day | A form sent late on a Friday |
| Arrival to imaging | Within 48 hours | A damaged drive needing physical recovery |
| Imaging to report | 5–10 working days in all | A wide scope, a large drive, or a second disk |
| Urgent preservation imaging | Discussed at instruction | Arranged for injunction or leaver matters |
| An expert report | set by the court timetable | Agreed with the solicitor at instruction |
The questions that come up first.
Can the examination be expedited?
Preservation imaging can often be arranged quickly where an injunction or a departing employee makes time critical; tell us at the first conversation. The report follows on the agreed timetable.
Do I get the forensic image?
The image is retained by us, encrypted, for an agreed period, and can be provided to another examiner on your instruction, with its hash, so that they can verify it is the same.
What happens to the exhibit after the report?
It is resealed and returned by tracked post, with the seal number recorded in the report, or retained under seal if you prefer, for example pending proceedings.
Who sees the report?
You, and anyone you choose to share it with. We do not disclose it to anyone else save where the law requires.
It begins with the first conversation.
Tell us the situation and who owns the device, and you will hear back within a working day.