Solicitors, HR departments and loss adjusters · London evidence work
There is no charge for scoping, and the figure is written down before a cable reaches your exhibit: forensic instructions start at £800 + VAT. The price quoted will include an image taken sector by sector using a write blocker fitted ahead of any power source. MD5 and SHA-256 hashes will be created and then verified a second time. The continuity log detailing every action performed at the bench will be written contemporaneously whilst the examination continues. Finally, the report will be produced in the format required by the relevant forum. Then comes the part that no competitor prints. There is currently no accreditation of any type awarded to this laboratory (no ISO/IEC 17025, no UKAS schedule, no police or Home Office approval, no trade association), and this statement forms the opening paragraph of every report, because an expert has a duty to declare it. As such, it also defines our boundaries. The Forensic Science Regulator's Code has been statutory since October 2023, and in its second version since 2 October 2025, and it requires ISO/IEC 17025 for digital evidence used in criminal proceedings in England and Wales, specifically under DIG 100 for data from storage devices and DIG 300 for CCTV footage. Therefore, work within this scope cannot be undertaken by us, and what you receive is a name rather than a quote. However, civil claims, family proceedings, employment disputes and insurance cases fall outside it, and those make up nearly all the cases arriving here.
Talk it over with an engineer, in confidence
0203 0868633
| What is going on | What an examination shows | What is handed over |
|---|---|---|
| One laptop, and a case resting upon it | Write blocked, imaged, then read only upon the duplicate: documents, system traces, and the order they fall into | A documented answer provided in ordinary English |
| Someone who left, and files that also left | Each USB device inserted, by serial number, hour of connection and length of connection; uploads into personal cloud accounts; webmail attachments; deletions; wiper runs, all dated. | One timeline with dates, which the solicitor and HR can use together. |
| Deleted files the matter cannot be advanced without | Evidence that the files existed, when they were removed and what followed, recovered back out with continuity intact. | The files themselves, dated, alongside the method used to extract them. |
| Locked volume which cannot be accessed | Passware is turned on the image where authority exists to access it, and where a key is genuinely within reach. | What was inside, or a simple sentence stating that the volume held. |
| Claim already scheduled for hearing. | Depending on if it is an issue that is civil (CPR Part 35) or a crime related matter (the Code, which would be discussed with you first), the same bench work as before, but now formatted so it meets the requirements of the forum. | A report prepared for submission as a court document, in whatever format is required by the court. |
| Video recording evidence, still stored in a recorder. | Continuity maintained during extraction off the disk; the section on CCTV explains how. | Functional video, and the paperwork supporting it. |
Our forensic charges start at £800 + VAT. The amount charged depends upon the size of the task at hand, and that is determined in the course of our first telephone conversation: dates and events in dispute; machines and accounts involved; what needs to be demonstrated. There is no charge made for the initial telephone call. Furthermore, nothing that you would be billed for commences until a written fee quotation has been delivered to you.
We treat every item that arrives here as an exhibit and not as a collection of documentation. As such, we seal every item immediately upon receipt. We attach a write blocker to the device and create a full disk image whilst it is attached to the write blocker. No one views anything, nor reads any of the contents, until both processes are completed. Once both have been completed, the original item will be stored under controlled access. The duplicate will remain so further examination can be conducted.
Examination takes place within the copy, and your exhibit is never opened again. OSForensics indexes the entire lot: what the system writes about itself while running, which documents were opened and at what time, and what went, in what sequence. Step-by-step notes are taken whilst the examination occurs.
Paragraph one answers the question asked, in plain English, and the working details sit beneath it for anyone wanting to test them. Findings that help neither party go in as well, and nobody removes them afterwards.
Hand the opposite side a finding they have no way to verify, and the argument is theirs. So the bundle contains everything: each exhibit numbered, the hash values for each, dated and countersigned handovers, the images used for the conclusions reached, and the bench notes created whilst the work was ongoing. Repeat the steps and the result does not change.
Image it in week one, before anyone else gets a look: after two weeks of regular use, you will find yourself capturing an entirely different computer system. Data is being generated independently by Windows. A space that was once used to store deleted files is now going to be used for something else. The event logs will have rolled over and started again. If you want to capture the current state of the computer system at a particular point in time, you need to create an image of the system today. If you create an image next month, you will capture the system that has run continuously in the meantime. If there is any chance that there could be a dispute, take a copy of all of the data, seal the source of the copy, and store it under controlled access.
| Equipment used | What it is there for | The reason for it |
|---|---|---|
| X-Ways Forensics suite | Close examination inside the duplicate: usage history, system traces, timelines and deleted content | Quick, uncluttered, and knowing one tool well is worth knowing four tools roughly |
| PassMark OSForensics | Creates a searchable index across a Windows machine or across the image taken from one | Initial wide sweep: registry hives, recent file lists, every USB device this machine has ever encountered |
| Passware Kit | Locked volumes that can be opened when authority exists and keys are available to do so | Either the volume will give way or it won't. And whether it does or not will be documented by the report as such. Nothing here is dressed up. |
| Atola Insight Forensic imager | Acquisition with the write block already applied, and hash computation on the same pass | Continuity of acquisition is documented by the acquiring machine itself. Thus continuity is on record from sector zero. |
| ACE Lab PC-3000, with Data Extractor | When the evidence itself is a drive and it is on its way out: firmware work. | Some disks serve as exhibits and repairs at the same time, and both professions exist in this location. |
Why it goes at the top: an expert must declare, under the rules applicable to criminal cases, whatever a court could reasonably treat as having dented their credibility, and guidance issued by the CPS puts the lack of an accreditation directly in this class. Declaring it first is arithmetic rather than modesty. The least expensive question opposing counsel had is removed, and the argument shifts to methodology, which is where we would prefer it to remain.
None of that had occurred. A wrong sync client configuration had independently wiped out the share, certainly a less exciting reason than the client had assumed. Most of what had gone was able to be restored. This discovery resolved the issue without anyone receiving blame for anything.
Always three stages, in that order. A duplicate is created, the duplicate is worked on, and the final findings are written in a manner that enables them to stand together upon being challenged. Nothing is opened before the image exists, and bench notes are typed while the job runs, close enough that another examiner could walk down the same road and arrive at the same destination as we did.
No rate card exists here because instructions are never repeated. Scoping costs nothing. What comes out of it is one written figure, with the imaging, examination and reporting all included inside that one number, agreed before a cable touches your exhibit. Forensic instructions start at £800 + VAT. There is no hourly meter running underneath.
No. Computers are what this bench receives (Windows machines and Macs), plus drives, memory cards, and whichever disk was living inside a CCTV or DVR box. Handsets and tablets want equipment we don't keep. If a matter plainly turns on somebody's phone you hear about it on the first call, and you'll receive the name of a laboratory equipped specifically for handling handsets.
No, and we do not hold any other accreditation either: there is no UKAS schedule, no ISO/IEC 17025 certificate, no police or Home Office approval and no trade association. An expert is required to declare that, and so it is stated at the opening of page one of every report. The Regulator's Code has been statutory since October 2023, and in its second version since 2 October 2025, and digital evidence in criminal proceedings in England and Wales is regulated by that Code and therefore required to meet the standards set out in ISO/IEC 17025, specifically DIG 100 for data from storage devices and DIG 300 for CCTV footage. Instructions within that scope have to be referred to an accredited laboratory, and we will name one for you. All other forms of work (civil, family, employment and insurance) fall entirely outside it.
Regardless of what contains the evidence, turn off electrical power to it before doing anything else: a recorder still operating overwrites its oldest evidence every hour. Once power is removed, secure a price quotation (either by phone or through submitting a form), then post us just the disk or drive (do not include the recorder or computer), or drop it off at our Guildford intake lab, Monday to Friday, 9am to 5:30pm (no appointment needed). Evaluation costs nothing; work on recorders costs £400 + VAT and forensic analysis starts at £800 + VAT, both prices agreed to in writing beforehand. What sits on that disk stays here.