A failed case-file server or a fee-earner’s dead laptop is rarely just a storage problem; the handling of it in the first hour will determine if there is reliable information when it comes back. The legal sector sends us two types of jobs in the Greater Manchester area; straightforward recoveries, which need to happen quickly, and forensic acquisitions, which need to be done in an evidentially safe manner. All work is performed in house with our customers’ information stored under non-disclosure agreement (NDA), with custodial logs recorded where it counts.
Files containing privileged information including matter files, practice databases, and computers used by departing employees – we operate under non-disclosure agreement for all clients. You get one designated point of contact, and we keep custody records where findings may be challenged. Additionally, we never export any recovered materials out of the United Kingdom.
Turning on the computer to view its contents writes to the hard drive and alters timestamps on the computer before you've had a chance to review any content. This simple action can render once valid and admissible evidence useless. Simply leave it alone and let us know immediately upon calling.
It's very difficult to decide after someone has touched it. And the choice completely changes how we treat your device from the time we receive it.
Recovery restores your files. It does not require anyone to document how the files were recovered; in most cases, it is the right and least expensive method for restoring your data.
Forensic examination provides proof that nothing was altered during the process of recovering your data. This can be demonstrated by using write block devices for the forensic image; calculating a hash value (SHA-256) so the copy can be shown to be bit-identical; documenting all steps taken with time stamps; and enabling an independent reviewer to replicate all actions taken to produce the same results as described above and according to ACPO principles. In legal proceedings such as a tribunal, a court case or a disciplinary hearing, these documents will provide the basis for evidence vs. an unsubstantiated claim.
If there is any possibility that the second option will be needed, state this at the first contact. Most often when individuals boot up a computer or open a file to check, they change timestamps prior to any analysis being performed, undermining their own potential evidence.
These are the four things that organisations normally forward to us.
What a practice must have set up for it to be able to send anything.
Confidentiality is assumed, not negotiated, with NDAs signed as standard. The work flows via one named contact; all data remains in the UK; nothing is sub-contracted out to another laboratory.
If material is sensitive/privileged let us know from the outset. We do not read what we recover — verification simply involves opening files to confirm they exist & that the file structure matches your description, not examining content — on matters related to privilege we will accept your guidance on how you wish verification to be treated regarding these issues, including taking no samples from documents if you would prefer not.
Departing employee and disclosure issues specifically.
Windows and macOS have a lot of tracking on them, and many of these records survive the removal of the file itself. The history of USB devices will tell you which drives were plugged into your computer and at what time. Link files, jump lists and shellbags will also reveal what was opened, as well as what folders were accessed. When deleted data is recovered from free space it typically retains the same timestamp that existed prior to being deleted, and all of these things together provide an organised chronological picture of events.
What can be established is based upon both the operating system being used and how much has happened since — this is why it is better to preserve the computer immediately, instead of waiting until several weeks later when continued use may potentially alter the state of the computer. Forensics work is from £800 +VAT, subject to scoping prior to commencement, with a 50% deposit, and forensics work is billed at full cost as evidence that no inappropriate action occurred provides significant value.
Recovering data gives you back your files. Forensics work verifies that there was no alteration — forensic imaging using write block technology, hash functions (SHA-256) verifying that a copy is identical to the original file, and a documented chain of custody following ACPO principles — thus, findings are testable.
No. This is where most potential evidence is compromised. When a machine boots or a file opens, then dates/times associated with the file are updated, and it can trigger additional writing to occur on the machine. If it could ever become relevant evidence, preserve it as-is.
Yes. All NDAs are signed as standard. One named contact at all times. Data is always stored within the UK and is never sub-contracted. The team do not read through what they recover. On privileged matters, you will provide an instruction regarding how verification of that matter should be carried out.
Yes. Frequently. Files such as USB device records; link files; jump lists; shellbags and file system time stamps often record details of what has been connected to or accessed, and when — frequently including material that has since been deleted.
Yes. And returned in a mountable state as opposed to being split into individual files. A byte-complete database may still fail to mount, therefore these are checked for consistency and any affected matters identified by name are then reported back to you.
From £500 + VAT for servers and arrays; from £300 +VAT for a single hard disk; forensic work prices start from £800 + VAT. Each job gets a free 48-hour diagnostic and a fixed price on a case-by-case basis, provided in writing prior to any recovery taking place. On most jobs, if the recovery does not succeed, there are no charges incurred by you.
Please get in touch for a free diagnostic and quotation – all NDAs are executed prior to any recovery taking place. All recovery work is completed in house. Wherever applicable custody log entries are recorded.