Law & evidence · recovery that can be proved
To be successful an ordinary recovery depends upon one factor: were the files recovered? An evidentiary recovery will require passing two additional tests: can it be proved that the original source of the data was unaltered during the recovery process, and could an independent person utilising nothing but the notes replicate the findings? Hardware blocking (to prevent unauthorised writes), hashes (which match) and a log of events kept during the processing of the media (not afterwards) meet both conditions.
Go through it with an engineer
0800 6890668
| The symptom | What we are able to establish | What we send back |
|---|---|---|
| Data that has been intentionally or unintentionally removed | Whether the data was originally present, when it was removed, and what amount of data returned | All recovered files along with the methodology used to recover them |
| Disk(s) that have been intentionally wiped by someone | Tool, time used & leftovers | Surviving elements (type and location) |
| BitLocker / other encrypted volume(s) | Can Passware access the key, where the authority to attempt it is lawful? | Opened volume & route in recorded |
| Exhibit = dying disk | The slow imaging a failing drive requires, without leaving the custody chain | Files back; continuity maintained |
| Dispute over order of events | System artefact & timestamps read against each other, limits stated | A chronological, as well as documented listing of events (with any caveats stated) |
All instructions commence in confidence. First outline the incident, the devices and accounts involved in the incident and what the evidence needs to prove; this establishes the scope, and once established, it also sets the single written quote you will be provided prior to any examination commencing. The scoping discussion is free.
All the exhibit meets is a hardware blocker, and whatever is passed through it is a sector-for-sector copy; E01 by default because it contains its own checksums, or raw if that's what you'd like.
While the image is being written, an MD5 and a SHA-256 are calculated. Afterwards they are recalculated using the now-closed file. When both sets show agreement, the duplicate can be demonstrated to be an exact replica of the original: merely a function of mathematics, not opinion.
All deleted, corrupted, and encrypted information is processed on the image, with the audit trail continuing to run at all times. Locked volumes are sent to Passware where legal access to them exists and there is a credential or key within reach.
When all aspects of the case are handed over to another entity (report, exhibits, source files, hash values, continuity log and bench notes), a tribunal, or another expert who has been instructed against you, may replicate the work and obtain the same result(s).
Which rules bite, and which do not: the second version of the statutory code of practice by the Forensic Science Regulator came into force on 2 October 2025 and applies to all forensic work carried out as part of investigations (criminal) and court cases (criminal) in England & Wales. Any instructions that arise from civil claims, employment disputes or insurance questions fall outside the enforcement of this code. Regardless of how your case fits into one category or another our methods remain the same; we will simply indicate which side of the line your case lies on.
A departing employee used a wipe utility on the laptop the night before returning it. This utility left its own log data in the image so that the quarter of an hour that the utility ran could be identified along with the names of files that were accessed.
Four things: material that remains unchanged, an examiner who has competence in handling it, a path for the exhibit to go from where it was received to findings that another person could follow, and relevance. The first three are proven by methods such as blocked imaging, verifying hash values and notes being created at the bench rather than asserted.
There are no other ways to prove that an exhibit leaves the bench in the exact condition it was in upon receipt except through use of a physical device that accepts read requests but rejects write requests.
Yes, if you have legal authority to access it and there exists a reliable process to obtain a password or key; we then do the work using Passware (which is performed on the image as opposed to the original) and document our procedure. If none exists, good encryption prevents this from happening, and we will clearly state prior to proceeding that this cannot happen.
Much of the actual bench work is the same; however, it is the level of scrutiny that must be applied to each case's results which differs. Forensic instructions include write-blocking, verification of hash values, documentation of the entire history of the exhibit and documentation of all work being done as it occurs: these factors allow a finding to remain intact once challenged by an opposing expert.
Recording in a loop is already overwriting your needed evidence, and the deadline will not move. There is no cost associated with opening a case today: diagnoses are free and remain completely confidential.