In cases of disputes, investigations or claims that involve information stored on a computer or storage device (deleted documents or files), in those situations this information will have to be recovered from the original source (without damaging or modifying the source data). We use forensics to create an unaltered hash-verified image of the source data and then extract as much as necessary from the device.
If a computer or drive may need to remain intact as evidence do not turn it on. Opening any files, running recovery software etc., will alter the very same information, including timestamps, that we will need to prove what happened, making it inadmissible as evidence. Disconnect from anything, turn it off and keep it exactly as it was when this occurred. Bring it to us. We take a forensically write-blocked image of the original data first, so we never alter anything, we only work with a copy of the data, and retrieve whatever you require.
Forensic recovery applies to all cases where what’s on the device holds either legal or business significance. As such, these types of recoveries require that no changes occur to the data on the device. These are the cases typically handled by our firm.
In addition to recovering many types of digital information contained within a forensic image of a computer or drive, we also verify and document the recovered information. If you thought you had erased something, what is left will be documented by us with no bias, simply and factually.
Computers, laptops, workstations · servers and NAS · hard drives and SSDs · USB drives and memory cards · external and portable drives.
Forensic recovery involves integrity as much as it does recovery, proving the recovered data is exactly what was found. We create a write-blocked image of the original device, analyse from that copy and provide a clear report of findings.
What do you need to resolve? Before any work commences, we agree upon the scope of work and confirm the feasibility of your request(s).
Using a forensic bit-for-bit image created through a write blocker, we verify the hash of the original device, so no changes are ever made to the original device.
Working only with the image, we extract deleted files, file fragments and artefacts, and identify hidden and overwritten data wherever possible.
Examining file metadata, time stamps and activity helps us determine what happened and when this occurred in a factual, reproducible manner.
We create an interactive web browser-based list of what has been recovered using plain language that can be understood by solicitors, HR professionals and court officials.
The data will be stored securely and either returned to you or retained as per your instructions. At all times we maintain confidentiality.
Forensic recovery of data from computers, laptops, servers and drives: we perform forensic recovery of data from computer systems (including laptops) and other storage devices. This includes using a write-blocked, hash-verified image for the recovery process; recovering deleted evidence; reporting the findings in such a manner that the results stand up.
Tell us what happened and we’ll get back to you, usually within a working day.
We’ll be in touch shortly. If it’s urgent, call 0191 406 1051.
No hidden charges, no hard sell. Just a free assessment and quoted price in writing before any work commences.
In very general terms, and with complete confidentiality, a handful of recent forensic recoveries are described.
The laptop was imaged as write-blocked, deleted files were located and recovered from the laptop along with a history of transfers via USB; the client’s solicitor received our findings.
Through file metadata and system logs, we developed a factual chronology of the modifications and access that occurred to the documents; this is presented in a written document format.
Deleted data recovery has also allowed for confirmation as to what was removed and when in support of the insurer’s review.
Send in the device for the free evaluation and let us know in a few sentences what you’re looking into; an engineer will evaluate it and send your exact quote in writing prior to any work being done.
Before you post or drop off your device, please get a quote from us by phone or with the form. Once we receive your device, our recovery process can start. Safely pack your device, include your name and contact information within the packaging and ship it to us. After performing your free diagnostic, we’ll send you a written confirmation of the exact price of our services prior to starting any work.
If you decide to post it, we would advise using a trackable and insured postal service. Or if you prefer to drop it off, we are open Monday to Friday, 9am to 5:30pm, and you don’t need an appointment. Just pack the unit as described in step one before dropping it off.
Would you like a little more background information prior to sending it? Fill in the form to provide more details about your problem; an engineer will evaluate it and reply with a customised quote.
We’ll be in touch shortly. If it’s urgent, call 0191 406 1051.
The common questions asked about forensic data recovery.
Recovery of forensic data from a computer or storage media is the process of retrieving data while maintaining an accurate record of the data’s existence (integrity) so that it can be used as evidence. In this context, we obtain a copy of all data from the original storage media by creating a write-blocked image. Once we have created our image, we then use various techniques to locate and restore previously deleted files along with their file attributes and time stamps.
In general, yes. Files are usually recoverable when they have been deleted because many operating systems do not immediately delete files, but instead mark them as “free space” or “unallocated” and leave them until the next time new files need to be written over them. These deleted files are recoverable along with the majority of their metadata, such as file name and date and time stamp. Since we work exclusively from a forensic image of the original media, there is no possibility of altering anything in the original device.
Software applications run on the original device will cause writing to occur on the device which will alter the time stamps associated with each entry. This could potentially eliminate evidence and prevent testimony based upon the recovered information from being admissible in court. All forensic recovery activities are performed against a write-blocked image of the original media; therefore, no data is ever altered on the original device.
Yes. We create a plain English report that will set out our findings and how we obtained those findings in terms that are appropriate for use by lawyers, HR departments or in the courts. We can also discuss expert witness support when necessary.
Totally. All of our forensic examinations are conducted confidentially and in accordance with best practice security protocols. If desired, we can conduct all of our examinations under a non-disclosure agreement (NDA). The only people who will be informed of our results will be you or whoever else you authorise us to inform.
Only devices which you are legally allowed to have forensically examined, i.e. either your own devices, devices belonging to your organisation, or where you are legally entitled to carry out an examination pursuant to a court order. We obtain confirmation prior to commencing any forensic examinations. We do not undertake forensic examinations of devices that are subject to legal restrictions from being examined.
Computers, laptops, workstations, servers and NAS, hard drives and solid state drives, USB drives, memory cards, external drives. Our primary focus is computer systems and digital media storage. We do not perform forensic examinations of mobile phones.
Often yes. In many instances file metadata, system logs, etc., may be available that will provide evidence of creation, modification and/or access times. Backdated files or deletions may also be evident. This will be outlined as factual within our report.
An initial assessment is always free. After that forensic recovery is charged on a “per case” basis. A simple forensic recovery costs £800 + VAT. The amount you pay depends upon how many devices there are, the extent of the work, and if you want a written report, or expert witness testimony. You receive a detailed written quote prior to any work commencing.
A write-blocker keeps the evidence separate from all other elements while still capturing the original, hashing to show that it was not altered. Analysis is done completely based upon an image of the evidence: live files, deleted data recovered from unallocated space, as well as timestamps and user activity which may be used to determine what happened. Each step builds upon a documented chain of custody for the evidence; and conclusions derived from the analysis will be provided in a format that can withstand scrutiny during legal proceedings.
Free consultation; forensic write-blocked image; deleted data recovery; written report. Contact us today in confidence.