Law & evidence · recovery that can be proved
An ordinary recovery is judged on one thing: whether the files came back. An evidential one faces two further tests — that the source is demonstrably unchanged, and that an outsider working from the notes alone would arrive where we arrived. Hardware blocking, hashes that agree and a log kept while the job runs, not after it, answer both.
Go through it with an engineer
0800 6890668
| The symptom | What we are able to establish | What we send back |
|---|---|---|
| Files deleted, by accident or by intent | Whether the files were ever there, the moment they went, and how much returns | The recovered files, with the method on record |
| A disk somebody has wiped deliberately | The tool used, the time it ran, and its leftovers | What survived the pass, and its location |
| BitLocker, or another encrypted volume | Whether Passware can reach the key, where the authority to try is lawful | The volume opened, and the route in recorded |
| An exhibit that is also a dying disk | The unhurried imaging a failing drive needs, done without leaving the custody chain | Your files back, continuity unbroken |
| A dispute over the sequence of events | Timestamps and system artefacts read against each other, limits stated | An ordered account of what happened, caveats included |
Every instruction opens in confidence. You set out the incident, the devices and accounts it touches, and what the evidence has to establish; that settles the scope, and the scope settles the single written quote you receive before any examination starts. The scoping conversation is free.
The only thing the exhibit meets is a hardware blocker, and what comes through it is a sector-by-sector duplicate: E01 by default, since it carries its own checksums, or raw if that is what you want.
An MD5 and a SHA-256 are computed while the image is written, then computed again from the closed file. If both pairs agree, the duplicate is demonstrably identical to the source — a matter of sums, not of judgement.
Deleted, corrupted and encrypted material is worked on within the image, and the audit trail continues to run the whole time. Locked volumes go to Passware, where opening them is lawful and a credential or key lies within reach.
The point of handing over the lot — report, exhibits, source files, hash values, continuity log and the notes taken at the bench — is that a tribunal, or an expert instructed against you, can repeat the work and reach the same result.
Which rules bite, and which do not: the second version of the Forensic Science Regulator's statutory Code has been enforceable since 2 October 2025, and it reaches forensic work done for criminal investigation and for proceedings in the criminal courts of England and Wales. An instruction that arises from a civil claim, an employment dispute or an insurance question falls outside its enforcement. Our method is identical either way; what we will tell you is which side of the line your case sits on.
A departing employee put a wiping tool across the laptop the evening before handing it back. Its own logs survived into the image, pinning the quarter of an hour it was running and naming the files it had passed over.
Four things: material that has not changed, an examiner competent to handle it, a route from exhibit to finding that someone else can walk, and relevance. Blocked imaging, verified hashes and notes made at the bench prove the first three instead of asserting them.
Because a physical device that passes reads and refuses writes is the only way to show, rather than assert, that the exhibit left the bench exactly as it reached it.
Where you have lawful authority to open it and there is a credible route to the password or key, yes: Passware does that work, always against the image rather than the exhibit, with the method written down. Where no key can be reached, sound encryption does not yield, and we say so before you commit.
Much of the bench work is the same; what differs is the scrutiny the outcome must withstand. A forensic instruction adds write blocking, verified hashes, an unbroken exhibit record and notes made while the work happens — what holds a finding together when an opposing expert starts pulling at it.
Loop recording is already writing over what you need, and the deadline will not move. Open a case today: the diagnosis costs nothing and stays confidential.