Forensic data recovery is performed in such a manner that the recovered information has evidentiary value. This does not mean simply recovering the data. Any actions taken cannot compromise the original. To this end, the original media is copied behind a hardware write blocker (this prevents any changes to the original), and the original media and the copy are compared via a cryptographically secure hash function. All steps of the process are also thoroughly documented. Below is an explanation of how this is achieved, some examples of what can be discovered, and where the line sits.
The purpose of forensic data recovery is primarily related to defensibility; i.e., no modifications were made to the original media. The copy was proven to be identical to the original media, and each action during the examination process was documented so another examiner could repeat them and reach the same result.
Ordinary file recovery will restore your data. Forensic data recovery restores your data in a form that supports its use as evidence.
The primary distinction between ordinary file recovery and forensic data recovery is the concept of defensibility. Forensic data recovery begins by creating a copy of a computer hard disk using a hardware write blocker. This type of write-blocker exists between the original evidence device and other devices and allows reads from the device but prevents writes to the device. Therefore, anyone who attempts to modify the original device is prevented from doing so while the original device is being examined. Next, a full, bit-for-bit image of the original device is created. The duplicated image is then compared to the original device through a cryptographic hash function (i.e. MD5 & SHA-256). These two types of hash functions create “fingerprints” of both the original and the duplicate images that prove they are identical to one another and have remained unchanged since their creation.
Therefore, once the initial comparison has been completed, all further examinations are conducted on the duplicate image rather than the original device. If any examination is conducted directly on the original device, there is the possibility of modified timestamps and possibly overwritten deleted files, which represent the very evidence being sought, thus forensic examination of original devices should never occur.
Deleted files are just the beginning: the operating system keeps a detailed record of activity.
In terms of obvious evidence recovery, deleted files are carved from unallocated disk space and dated from whatever survives in the filesystem. However, evidence exists elsewhere on the computer where the operating system has stored other artefacts such as: $MFT (Master File Table) containing creation, modification and access timestamps; $UsnJrnl (change journal); Windows registry hive files; LNK shortcuts and prefetch records; shellbag files; USB insertion logs; browser and cloud sync remnants.
Each artefact alone provides only a tiny fragment of information about your case. Together, however, these artefacts provide investigators with answers to the who, what and when of their case i.e., “which files existed?”, “when were they created/deleted?”, “what was plugged in and when?” and “what was opened?”.
This evidence is valuable only because the artefacts can be related to one another.
The examiner takes all the metadata and timestamp information contained within those artefacts and correlates them into a single timeline detailing exactly what happened and in what order. Additionally, this process is how you will identify whether evidence has been altered/tampered with. For example, if there are discrepancies in the timestamps for two different records (i.e., a file’s claimed date/time versus the change journal) then you have identified alteration/backdating/deletion. Another important benefit to this method is that the results are repeatable. If another examiner uses the same verified image of the original source media and follows the exact methodology outlined above, he/she will develop the same timeline, draw the same conclusions and ultimately arrive at the same result.
Evidence is only as strong as the documentation of how it was handled.
Alongside the forensic analysis, each piece of equipment is logged when received. All of the equipment’s handling and returns are also recorded and there will be a link to the verifying hash of each of the images which creates a documented chain of custody showing that the evidence has remained unaltered and unchanged since receiving the items through to the final report. If an item could possibly go to court, HR or an insurer, then the recovery and analysis of the item(s) will be conducted at a court ready standard. In addition to this, the results of the analysis will be clearly reported in order to withstand scrutiny. For further information about how we treat evidence please see our data security page.
What it is generally used for, and how far we go.
Forensic recovery can be applied to employee/insider cases (data removal prior to leaving an organisation, misuse of a corporate device), commercial disputes/litigation, fraud/misconduct investigations, insurance claims and questions of whether files have been altered or back-dated. Although both ordinary data recovery and forensic recoveries use similar imaging and reconstruction techniques, the difference lies in the rigour employed. Work related to secure data destruction employs the same level of evidential care.
The limits are firm. We only examine devices that you are allowed access to. We provide a factual representation of the evidence recovered based upon what the actual evidence provides instead of providing a desired result. Our quotes for forensic recovery start at £800 +VAT once we complete your complimentary diagnostics. Additionally, all of our forensic recovery services are completed internally within the United Kingdom.
It is the recovery and analysis of data from a device employing methodologies that preserve it as evidence. A copy of the drive is created behind a hardware write-blocker, and the copy is compared to the original utilising a cryptographic hash. Each action is documented to ensure the results will hold up for solicitors, HR, and courts. The original is never worked on directly.
While both forensic and ordinary recovery employ the same principles for obtaining digital images of computers and reconstructing those images, there is a major distinction in terms of rigour applied. Computer forensics involves employing a write blocker to prevent modification of the original evidence media while also using hash validation to confirm that the digital image acquired does not contain any alteration to the original evidence. This process examines various types of system artefacts including files and their associated time stamps along with documenting the chronological order in which all devices were received and handled. This documentation provides a paper trail that supports the defensibility of the digital evidence, not just its recovery.
Forensic examination employs a hardware-based write blocker to allow read access to the evidence media while preventing any type of write operation from occurring against the original evidence media. This is important because connecting a piece of evidence media directly to a running computer can cause unintended modifications to occur due to changing time stamps of existing files and/or overwrite operations on deleted files. By utilising a write blocking device and performing hash validation on the generated image, examiners can ensure they have obtained a valid copy of the original evidence.
Yes, frequently. When examining multiple different pieces of evidence, such as file-system timestamps, the change journal, event logs, etc., investigators can see when a file was created, altered or deleted, and may find discrepancies within the different timestamp sources related to those items. These discrepancies may indicate that some of the information has been intentionally modified at a later date than it originally occurred. Investigators will create a timeline based on correlating these different timestamp sources. The timeline will then be documented in plain language and provided to the requesting party. Since the investigation is conducted solely from a validated image of the evidence media, another investigator would be able to independently recreate the findings.
Yes. All imaging is performed behind a write blocker. Once completed, a hash value is calculated to verify that the generated image contains no changes relative to the original source evidence. Documentation of receipt, handling and return of all devices examined is maintained through a chain-of-custody document. In cases requiring court readiness, investigators will perform their work to a court-ready standard. Ultimately, whether or not evidence is deemed admissible is determined by a judge during litigation proceedings; however, investigators prepare their findings accordingly.
Forensic/investigative services are quoted from £800 +VAT, depending upon number and complexity of devices being analysed, as well as extent of analysis required. Free diagnostics are included prior to generating written quotes for service. All services are performed in-house and domestically (UK), under an NDA if desired.
Tell us about the devices and what is in question, and we’ll image each one read-only behind a write blocker, maintain a documented chain of custody, and give you a free diagnostic and a fixed written quote before any work.