FDR / Services / Insurance claims: damaged devices and data loss

Insurance claim · damaged laptop · data loss · condition documented · recovery recorded

Insurance claims: damaged devices and data loss. A claim for a damaged laptop or lost data is stronger with a factual record of the condition, the recovery and what was there.

An insurance claim that turns on a damaged device or lost data is far stronger when it rests on a factual, independent record rather than an assertion. Where a laptop has been dropped, flooded or burnt, we document its condition on receipt with photographs, recover the data where the physical state allows, and report what data existed, its date range, and whether it was intact, keeping the integrity record throughout. Because a damaged drive sometimes has to be physically worked on before it can be read, we record that intervention openly: it alters the device's physical state, not the user data, and the report explains the effect. For a disputed data-loss claim, the report sets out what was, and was not, present and recoverable. It is examined for the policyholder, whose device it is, or for the insurer directly, and it gives a loss adjuster or a court a factual basis to work from.

Owner-only, authority requiredFree first conversationStandard report £800 + VATWe say what it cannot prove

Rather talk it through? An engineer answers the bench line
0800 6890668

Before anything else: stop using the device, and do not let anyone have a look at it. Every time a computer is switched on and used, the very artefacts an examination relies on, the timeline, the recently-opened lists, the deleted-file space, are overwritten a little more. Do not reinstall, do not run recovery software, do not let IT open it to check, and keep it powered off. Preserve it as it is, record who has held it, and send it with the authority documents we ask for. If proceedings are contemplated, the duty to preserve evidence has already begun.

Who instructs us, and the authority we need.

The instructing party is the policyholder, whose device it is, usually with the insurer's claim reference, or the insurer directly. We ask for the owner's declaration of ownership and, where the policyholder instructs, the insurer's claim reference and, ideally, the insurer's agreement to the examination.

Where the device is physically damaged, we document its condition on receipt with photographs before anything else. If the drive has to be worked on to be read, a corroded connector cleaned, a repair made, we record that intervention openly: it is a departure from leaving the exhibit untouched, it alters the physical device rather than the user data, and the examiner is competent to carry it out and to explain its effect. This candour is what keeps the report credible if the claim is disputed.

The report then sets out, factually, what data existed, its date range, and whether it was intact or partly unrecoverable. It does not value the data or verify the records' contents; it gives the adjuster or the court a factual basis.

What the standard report typically contains.

The device's condition, documentedThe report records the device's condition on receipt with photographs, the nature of the damage, and the state of the drive, so the claim rests on a factual record rather than an assertion.

The recovery, recorded openlyWhere the drive is worked on to be read, the intervention is described: what was done, that it altered the physical device and not the user data, and how much of the drive could be read, with a map of any unreadable areas.

What data existed, and whenThe report sets out the user data recovered, its categories and date ranges, and the most recent activity, which matters where a claim concerns business records lost to damage.

Whether it was intactIt records how much of the relevant data opened and verified, and lists what was unrecoverable, giving an honest measure of the loss.

The questions it can answer, and what it cannot.

Describe your situation →

What you want to know	What the examination shows	What it cannot prove on its own
What was on the drive, and its dates	The recovered file system, categories and date ranges	The value of the data, or the truth of the records
Whether the data was intact or lost	What opened and verified, and what was unreadable	The cause of the damage, beyond the device's condition
The device's condition when received	Photographs and a condition note	What happened to it before it reached us
That the recovery was done properly	The intervention recorded, the integrity hashes kept	Anything the drive did not retain

From the exhibit arriving to the report.

Work we have closed →

The first conversation, and the authority check Free

Tell us the situation, who owns the device, and what you need to know. We tell you whether it is a job we can take on, what authority we will need, and whether the standard report answers your questions or an expert report is called for. That conversation is free, and some enquiries end there, because we will not take work we cannot lawfully or honestly do.

FreeOwner-only; authority established firstThe honest answer about what is possible

Imaging behind a write blocker, and the hashes

When the exhibit arrives, your authority is checked, the device is logged and photographed, and the drive is connected through a hardware write blocker and imaged bit for bit. MD5 and SHA-256 hashes of the source and the image are computed and verified, so the copy is provably identical. Nothing is examined on the original; every later step is done on the verified image.

Bit-for-bit, behind a write blockerMD5 and SHA-256, verifiedThe original never altered

The examination, on the image

The image is examined for the artefacts your questions turn on: USB device history, files opened from removable media, cloud and webmail activity, deleted files and the Recycle Bin, the USN journal, program execution, email, document metadata, shadow copies, and a timeline. Findings that matter are confirmed in a second tool. The work is scoped to what you asked; material outside the scope is not reproduced.

Scoped to your questionsConfirmed in a second toolPrivate material filtered out

The report

The standard forensic report sets out the exhibit and its condition, the integrity record, the tools and method, and the findings by category, with a timeline, the limitations, and factual conclusions, as a self-contained report with its chain-of-custody and case-log reports. It is written in plain terms, keeps fact separate from any comment, and is suitable for internal decisions, HR processes, negotiations and solicitors. Where you need opinion evidence for court, an expert report is quoted.

Factual, tool-generated, self-containedChain-of-custody and case-log reports5–10 working days

Before you send the exhibit

Do not power a liquid- or fire-damaged device on, and do not open the drive; both can turn a recoverable loss into a total one.
Send it as it is, with the claim reference; we document the condition before any work.
Tell us what the claim concerns, business records, specific files, so the report addresses what the adjuster needs.

A physical recovery intervention alters the device's physical state, not the user data; recording it openly is what keeps a damaged-device report credible.

One examination, in outline.

UK · FDR-2026-0447JOB LOGGED ✓

A liquid-damaged laptop examined for a policyholder, with the insurer's claim reference, for a claim covering lost business records

The laptop's condition was documented with photographs on receipt; it would not power on. The drive's corroded connector was cleaned, the intervention recorded, and the drive imaged with 99.98 per cent of sectors read. The report set out 612 GB of recovered user data, including a business folder substantially intact to the date of the incident, with 118 files unrecoverable. It gave the adjuster a factual account of what existed and what was lost.

A factual record of condition, recovery and dataIllustrative synthetic example

Illustrative example — replace with a genuine case

What helps, and what harms.

Do this much first

Stop using the device and keep it powered off
Preserve it as it is; record who has held it
Gather your proof of ownership or authority
Tell us the questions you need answered

What sets us back

Letting IT or anyone open it to have a look
Reinstalling, wiping or running recovery software
Carrying on using the device
Assuming artefacts prove who was at the keyboard

We examine devices only for the people and organisations with lawful authority over them. Before any work begins we ask for proof that the device is yours, or documented authority to have it examined: proof of ownership, a director's or HR letter for a company device with the lawful basis, a solicitor's instruction, a court order, or an executor's grant. It is a condition of the work, not a formality, and it is what keeps the examination on the right side of the Computer Misuse Act 1990. We will not access another adult's device or accounts without their consent or a court order, we will not install monitoring software or bypass anyone's security, and we do not undertake covert surveillance. A device with no proof of authority is returned unexamined.

Questions answered before you instruct.

Can you recover the data from my damaged laptop for my claim?

Usually, where the physical state allows. We document the condition, recover the data with the intervention recorded, and report what existed, its dates and whether it was intact. Where some data is beyond recovery, the report says so, which is itself useful evidence of the loss.

Will the recovery affect the evidence?

We keep the integrity record throughout, and where the drive must be physically worked on to be read, we record that openly: it alters the physical device, not the user data, and the report explains the effect. That candour is what keeps the report credible if the claim is disputed.

Can the insurer instruct you directly?

Yes. We act for the policyholder with the insurer's reference, or for the insurer directly. Either way the report is a factual, independent account of the condition, the recovery and the data.

Do I need an expert report?

For most claims the standard report, a factual account of the condition, the recovery and the data, is what the adjuster needs. Where a claim is disputed in litigation and the court needs opinion evidence, an expert report is quoted separately.

What does it cost?

The standard report for the device is £800 + VAT; where significant physical recovery is involved, that is reflected in the quote, and the first conversation is free.

Related services and evidence.

Deleted CCTV and DVR footage →Failed and damaged media →Document metadata →How a forensic examination works →SSD data recovery, on the SSD site →

The device holds the answer; preserve it first.

The first conversation is free, and it starts with who owns the device and what you need to know. Tell us the situation and we will tell you whether we can take it on, what authority we need, and whether the standard report or an expert report fits. Until then, stop using the device and preserve it as it is.

0800 6890668

Price my job Packing and posting

Services, by situation

What we examine

What the evidence can show

What it costs, and what follows