Typically by the time a hard drive arrives with us it contains items that nobody would ever want a stranger to read. The following information explains what we do with your data in practice as opposed to a mere statement of our intentions – ICO registration, one named engineer per job/project; no subcontractors and nothing crosses an international border at any time.
We are registered with the ICO and GDPR-compliant. We use a single named engineer for each project/job. All work done here will be considered confidential from the onset. Any working copies of your data will be destroyed according to your chosen schedule as opposed to when we think they should be.
Our policies regarding your data are explicitly stated, as opposed to being hidden within the fine print.
Because a policy of "no policy" is not the same as a policy.
We don’t read what we recover. Verification is just about checking that files open and match your description of their layout – it has absolutely nothing to do with checking the content. If you have privileged or sensitive material please let us know as soon as possible and we will be happy to follow your instructions regarding verification.
We don’t keep copies indefinitely. Once the agreed time has expired, all of the working copies of your documents are destroyed. There is no 'archive' of your information; there is no "just in case" retention. We don't retain anything.
We don’t move data offshore. We do not send your data abroad for processing; we do not store your data abroad for any length of time; we do not send it abroad for any specialised steps. If a task required something we were unable to perform here, we would inform you rather than sending your data to another party without notification.
These are standard rather than requested, because they are needed by most of our business clients.
We sign NDAs as a matter of course for all business work, and DPAs for any contract that involves the processing of personal information – clinical records, HR files, client data etc. Each job goes through a single named contact from diagnosis to delivery; therefore the amount of individuals who have access to the data will be minimised.
Where there is potential for scrutiny of evidence, documentation occurs: signed exhibit records, documentation of movement logs, cryptographic hash values created at imaging and validated at each subsequent stage to ensure visibility of any alterations. This aligns with the principles set forth by ACPO and is available on all jobs – including non-forensic jobs. That matters because a routine recovery occasionally develops into a personal data breach or insurance claim investigation after the imaging process has already taken place.
For media not being returned to service.
Both deleting and formatting will allow data to remain recoverable. One approach does not apply to all devices. Hard drives – overwritten and verified. Solid state drive (SSD) – cryptographically erased, as wear levelling keeps reserved blocks out of reach of any overwrite. Physical destruction of drives that no longer respond, since nothing else can be confirmed.
Certificates provide documentation regarding the manufacturer, model, serial number, method and date used — typically this represents the "deliverable" for auditors or for the ICO, as they will request this information. Your original equipment is returned unless you specifically instruct us to dispose of it, and prior to disposing of your equipment, we verify the exact piece(s), using the serial numbers, that we will be destroying.
Answers to what is normally asked about.
Never. The process does not involve sending any of your data offshore. We do not stage it in cloud storage abroad or pass it to a third-party lab overseas. Our facility and personnel are based within the UK and all of your data remains here.
No. In fact, much of what is referred to as "data recovery" in the UK is passed on to a small group of larger labs; however, all of the data recovery work performed by our company is performed in house by our engineering staff. Therefore, fewer hands involved in handling your data, less transit and a smaller list of individuals who have had access to your data.
No, we will not. Our verification will be based upon whether or not the files that have been recovered can be opened, and if the file structures match as you had previously described. We do not review the contents of any information that has been recovered from your computer; nor do we review the contents of any privileged materials. If you have privileged material, please let us know in advance and we will follow your instructions on how the verification process shall proceed.
It depends on your choice of the time frame for when you want working copies deleted, after which point they are securely erased. Some of our clients need some time just in case something has been overlooked, while others prefer them removed right away. This is your decision.
Yes. Signed exhibit logs, record of all movement, hash values obtained upon acquisition and re-checked at every subsequent step. Any changes made will clearly show up mathematically. We use this process as standard in forensic cases and will also document it in any other case that may potentially be reviewed.
We sign both, as standard for business work. A DPA if there is personal data being processed, one named contact for you throughout the whole process, and all storage of data is located within the UK.
You have some sensitive company issues or personal documents that are irreplaceable, whatever the case, they will be treated as such by our team in the UK. Start with a free diagnostic or let us help you arrange for a non-disclosure agreement if you prefer.