When an investigation, claim, or dispute hinges on a computer or drive containing deleted files or otherwise removed files (that some people believe are no longer retrievable), you need to recover the data in such a way so as not to alter it. That is where we come into play. We create a forensic, hash verified image of your device and then recover the data that you require from the device.
If a computer or drive may become part of the evidence chain, do not use it again. Do not turn it back on. Do not open files. Do not run file recovery software; all of these actions will modify the exact data (and its timestamp) which can ultimately affect the admissibility of the findings. Turn off the device and leave it alone. Bring it to us. We take a forensic, write-blocked image first, work only on that copy, and recover the data that you require.
Forensic recovery is for those times when what’s on your device matters legally or commercially, and needs to be recovered without changing it. These are the cases we deal with most.
We extract and document (from the forensic image) a wide range of digital forensic evidence, including items deleted by the user. What is in the image; that is our job. Factually reporting what is in the image.
Computers, laptops and workstations · servers and NAS · hard drives and SSDs · USB drives and memory cards · external and portable drives.
The integrity of the data recovered is just as important as recovering the data. Proving the recovered data is exactly as it was at the time it was copied. We create a forensic image using a write blocked system so no changes are made to the original device. We then use this copy to analyse and report on what we find.
Describe your concerns and what you wish to determine. We will agree the scope and confirm what can reasonably be expected before beginning.
Once we receive a request for service, we will create a forensic, bit-for-bit image using a write blocker to prevent modification of the original device. The image will also be verified through a cryptographic hash.
Using only the created forensic image, we retrieve deleted files, fragments and other artifact remnants and reveal the hidden and over-written data where possible.
We look at file metadata, times and activity to determine what occurred, when and how, in a factually accurate manner which allows for repeated analysis.
As part of our service, we provide an interactive browser-based display of all of the information that has been found, clearly explained in non-technical language and suitable for lawyers, HR staff and courts.
Our secure systems store your data and then either release it to you, or retain it at your discretion, whilst maintaining confidentiality throughout.
We can also use forensic methods to retrieve data from computers, laptops, servers and hard drives, using a write-blocked, hash verified copy of your device, to extract deleted evidence and present the results in a manner which will stand up.
Tell us what happened and we will get back to you, usually within one working day.
We will be in touch shortly. For anything urgent, call 0117 332 1137.
There are no additional or hidden costs, nor any pressure to commit prior to a free assessment and written quotation.
Below is a list of some of our most recent forensic recoveries. Details have been kept intentionally vague/confidential to protect our clients’ privacy.
We took a write-blocked laptop image, retrieved deleted documents and USB transfer history, and provided a written report to enable the client’s lawyer to act.
Using file metadata and system logs we constructed a factually accurate chronological account of the changes made to the document and when it had been accessed, in a clear written report.
Our investigation included retrieving traces of erased information and proving which items were deleted and at what time; our efforts supported the insurer’s evaluation.
All reviews posted on this website are based upon real customer responses; none have been created by us.
No invented reviews here — every testimonial we publish is genuine. Ask us to arrange a reference for a job like yours on 0117 332 1137.
Send us your device for a no-obligation free diagnostic and let us know what went wrong. One of our engineers will inspect it and confirm your exact quote in writing prior to doing any work.
To get started with recovering your data, first get your device to us. Wrap it securely, write your contact details on a slip of paper inside the package, include a brief description of what happened and post it to us. After running a complimentary diagnostic we will write to you confirming the exact price prior to starting work.
Do you want to post the device to us? We highly recommend using a trackable postal service with insurance. Would you prefer to deliver it yourself? That’s fine too. Our office hours for accepting deliveries are Monday to Friday, 9am to 5:30pm. Please make sure to wrap the device as described previously.
Need some additional information regarding our data recovery services? Fill out the form and provide further detail about your problem and one of our engineers will review it and offer you a personalised quote.
We’ll be in touch shortly. For anything urgent, call 0117 332 1137.
What people ask us most frequently regarding forensic recovery of digital evidence.
Forensic data recovery involves obtaining data from an item (computer or hard drive) in a manner that preserves the authenticity of that data; therefore, the data obtained through this method may be used as reliable evidence. We obtain a write-blocked image of the drive, then extract the data, including erased files.
Most likely, yes. There is typically some form of remnants remaining on a storage device (drive), even after deleting files, until they are overwritten. These remnants include deleted file parts and their associated metadata and timestamp. Additionally, using a forensically-created “image” of a device allows us to recover the deleted files without overwriting any portion of the original storage device.
Any type of application run on the original device will write to it and/or modify its timestamps. This modification can essentially destroy evidence and invalidate any conclusions reached by analysing the original data. Conversely, a forensic recovery process uses only a write-blocked “image” of the original device; therefore, no modifications are made to the original data.
Absolutely. Upon completion of our analysis, we provide a detailed written report detailing everything we find and how we found it. The report will be written in language understandable to both solicitor and layperson alike and will serve as documentation of our discovery process for use in HR related issues and/or litigation. We can also discuss assistance with serving as an expert witness if required.
Complete confidentiality. Forensic cases are treated with discretion and security. In addition, we are happy to abide by a Non-Disclosure Agreement (NDA). We only disclose findings to you, or whomever you direct us to disclose the results to.
The devices we evaluate are limited strictly to those devices for which you have the legal right to assess, including but not limited to: your personal device(s); an organisational device(s), as long as you are legally entitled to have it evaluated; and/or when you have been granted the appropriate authority and/or a court order. Before conducting any evaluation, we confirm that the devices you provide are those that you are entitled to have assessed by us.
We handle computing equipment including desktop/laptop/workstation, server/NAS, hard drive/SSD, USB drive/memory card/external storage. We will only investigate and analyse computer storage equipment such as computers, laptops etc. We do not perform analysis on mobile phone equipment.
Yes, many times. Files have metadata attached which include the date/time the file was created/changed/accessed, and system logs and other artifacts can show this too. This type of data allows forensic investigators to determine if a document/file has been “backdated” or deleted and potentially recovered. All of this information is included within our factual report.
Our initial assessment is complimentary. Once we complete an assessment of your needs we provide you with a price quote based upon how many devices you require analysed and what services are required, i.e., a basic forensic recovery is a fixed fee of £800 + VAT. Your total cost may vary depending on the number of devices being examined, the amount of time and effort required to complete your project and/or if you require a written report and/or expert testimony. We will always provide you with a written quote prior to beginning your project.
We use a write-blocking device between the evidence and everything else. Therefore, once the original evidence is captured/hashed (to prove it never changed), it is left untouched. From there, we run all of our analysis, including live files, off this exact same image. If necessary, deleted data can be carved from the unused areas (un-allocated space) where it was located at the time of capture. We also look at timestamps and user activity that directly relate to your case. Every single action taken during the examination process is recorded along with a complete chain of custody. Upon completion, we compile all results into a format that can withstand scrutiny in court proceedings.
Free assessment, a write-blocked forensic image of the evidence, deleted data recovery (if applicable) and a clear, easy-to-read written report. Speak confidentially with one of our forensic specialists today.