The overlap in equipment used to recover files, and to perform forensic examination of those same files, creates two distinct results. Recovery will allow you to get back your files. Forensic analysis will provide proof that the files were not altered during their recovery. If findings might be challenged in a tribunal, a court or a disciplinary hearing, this difference could be the determining factor as to whether you have "evidence" or simply "an assertion".
Simply accessing the computer, opening files, booting the machine or even just plugging the drive in will modify some of the time stamps associated with the file(s) being accessed and may also cause writes to occur. In most cases where material is compromised prior to its proper review by someone, this occurs because of good faith actions.
The equipment used by each job can overlap and the products produced are very different, and the decision cannot easily be made retrospectively.
Recovery restores your files. No one wants to know how the recovery was accomplished; the recovery process is not documented in detail so as to be scrutinised, and recovery is generally the cheapest and correct solution for almost all cases.
Forensic work shows that no changes took place. The source is accessed through a hardware write-blocker, then hashed using SHA-256 to prove that the duplicate file contains the exact same bits as the original. All steps taken are documented so they can be repeated independently by a forensic expert, following ACPO principles for digital evidence. Should a tribunal, court or disciplinary body challenge any of the findings made from the analysis, documenting all of these steps will provide the distinction between an assertion and actual evidence.
Both Windows and macOS keep extensive records of activities performed on them, often long after the original file(s) have been removed.
The piece which defends a finding and distinguishes it from being simply correct.
What was received; from whom; in what condition; sealed and referenced.
Acquisition is done by reading the source using equipment designed to prevent any write operations — the original therefore cannot be altered even accidentally.
SHA-256 calculated at the time of imaging, re-calculated at every step — demonstrates that the working copy has been identical to the source for all stages.
All tools used, their version numbers; parameters entered into those tools; and what was found documented. So if another examiner wanted to perform the same work again, they would have access to the information needed to do it themselves.
The findings will be written in non-technical terms for lawyers, HR personnel, and/or tribunals. The technical details on which the findings are based are contained in separate appendices instead of being part of the main body of the document.
One of only three exceptions here, for a reason worth explaining.
Forensic work starts from £800 +VAT (quoted once the scope has been determined), with a deposit of 50%. Unlike most of our work, we charge regardless of whether there is anything improper found in relation to your case. This is because determining that there was nothing improper can be a valid and useful outcome. And, as such, the cost of the investigation is exactly the same whichever of those two outcomes occurs. Regardless of how you look at it, a finding of 'nothing' is still a finding. Often the one a client wants most.
NDAs are used as standard. All work goes through a single designated point-of-contact. All data stays within the UK. Material examined will only go as far as required by the specific instruction received.
Just send it in for its complimentary evaluation and let us know briefly about the problem you are trying to solve. An engineer will review the device and confirm your exact quote in writing prior to doing anything.
This is the only step that requires input from you and nothing else can happen until the device is on our bench. Package your item properly and include all the information we require about you and your item(s), then ship them to us. Then comes a no-cost diagnostic, followed by a written quote.
Posting it? Use a tracked and insured service. The value of what is on the drive far exceeds the cost of postage. Bringing it in? Weekdays from 9am to 5:30pm, and it still needs packing as described above for the journey.
Tell us about the item in question, tell us how it has been behaving lately, and let us know if there is anything you have done as far as troubleshooting goes so that our engineers may provide a realistic estimate of success and a probable cost range prior to sending your items off.
We’ll be in touch shortly. If it’s urgent, call 0161 871 0788.
The things that people usually want to know about recovering their data using forensic means.
Data recovery restores your data. However, forensic data recovery also shows that no changes were made to your original device by demonstrating that the copy is identical in every way — using write blocked imaging, SHA-256 hashing and documenting a chain of custody in accordance with ACPO guidelines which would allow any findings to be tested.
Often. Records from USB devices, link files, jump lists, shellbags, file system time stamps, etc., when combined, provide evidence of what was attached to the computer and accessed and when, and frequently they contain information that has already been removed or "deleted".
No, you shouldn't. This is where most evidence becomes compromised. When you boot up your computer, open files etc., it causes changes in the timestamp and may cause writing. If it might become evidence, preserve it exactly as it is.
Yes. That is what it is designed for. The findings will be presented clearly in plain English to lawyers, HR, a tribunal etc. Technical details will be provided in an appendix for those who require testing.
That is a legitimate result, and frequently the one the client hoped for. Forensic examinations are always charged regardless of the results because establishing that nothing improper occurred takes the same amount of investigation as establishing that it did.
From £800 +VAT. Quoted based on a scope of works. A 50% deposit is required. All costs vary depending on the amount of media, number of questions being asked etc.
Free assessment – forensic write-blocked image – deleted data recovery – clear written report. Contact us today in confidence.