When a claim, inquiry or investigation depends on what is on a drive or computer, including deleted files people assume no longer exist, the data has to be extracted without being altered. We take a forensic image, verified by hashing, and recover whatever is required.
The moment a computer or drive may be needed as evidence, the one thing that matters is not using it. If you switch it on, open a file or run recovery software, you overwrite the very data and timestamps in question, which could make any findings inadmissible. Turn it off, leave it alone and bring it to us: we image it behind a write blocker first, work only from that copy, and recover what is needed.
There are times when the data on a device carries legal or commercial weight and must be retrieved without a single change, and that is what forensic recovery is for. Below are the situations we see most often.
Working from a forensic image of a drive or computer, we recover and document a wide range of evidence, including data the user insists was deleted long ago. We report what is actually there, plainly and without spin.
Hard drives and SSDs; servers and NAS; USB drives, memory cards and external units; and the computers, laptops and workstations themselves.
In forensic work, integrity is as important as recovery: the aim is to prove that what comes back is exactly what was found. So we image the device behind a write blocker, carry out the recovery and analysis on that copy alone, and present our findings clearly.
Tell us what is in dispute and what you are trying to establish. Before any work begins, we agree the scope and tell you plainly what can be achieved.
Using a hardware write blocker, which stops anything altering a single byte of the original, we capture a bit-for-bit forensic image of the device. It is then checked against the source by cryptographic hash (MD5 and SHA-256), the fingerprint that proves the evidence is untouched.
Working on the verified image alone, we carve back deleted files and fragments, and bring hidden or overwritten data and system artefacts, such as registry hives, prefetch files, LNK files, journals and the $MFT, to light wherever they have survived.
Timestamps and metadata from event logs, the $UsnJrnl change journal and the $MFT are combined into a single timeline showing what happened and when, set out factually and in a way any other examiner could reproduce.
Findings are presented as an interactive browser listing, in plain English suitable for HR, solicitors or a court.
Confidentiality is maintained throughout, and the data is stored securely until it is returned or retained exactly as you instruct.
Working from a write-blocked, hash-verified image, we carry out forensic recoveries from servers, PCs, laptops and drives, bringing back deleted evidence and documenting the findings so they stand up to scrutiny.
Tell us what happened and we’ll get back to you, usually within a working day.
We’ll be in touch shortly. If it’s urgent, call 01483 901310.
There are never any hidden costs or aggressive sales tactics: you get a free assessment and a written quote before any work begins.
Some of our most recent forensic recoveries, kept strictly confidential and described only in the broadest terms. Full write-ups: an ex-employee investigation.
The laptop was imaged behind a write blocker. We recovered the deleted documents along with a record of USB transfers made from the device, and wrote up the findings for the client’s solicitor.
Using system logs and file metadata, we built a factual timeline of when files were accessed and edited, presented in a clear written report.
We retrieved traces of deleted data and confirmed what had been removed and when, supporting the insurer’s review of the claim.
Send us the device for a free assessment and tell us briefly what is at issue. One of our engineers will review it and confirm your exact quote in writing before any work starts.
The first step to getting your data back is sending the device to us. Pack it safely, put your contact details inside the package and send it in. Once we have completed the free diagnostic, we will confirm the exact cost in writing before any work starts.
Sending it by post? We’d recommend a tracked, insured service. Dropping it in? No problem: Monday to Friday, 9am to 5:30pm. Please package the device as described above first.
Would you like more information first? Complete the form with further details about your issue, and one of our engineers will review it and send you a tailored quote.
We’ll be in touch shortly. If it’s urgent, call 01483 901310.
What do people most often ask about forensic data recovery?
In essence, it means recovering data from a computer or drive in a way that keeps it sound as evidence. The original is never touched: a bit-for-bit image is taken through a write blocker and verified by cryptographic hash, and every step of the process is documented so the results stand up for HR, solicitors or a court.
Usually, yes. Deleted files and fragments generally remain on the drive until something else overwrites them, and we recover them along with their timestamps and metadata. Because all the work takes place on a forensic image, the original device remains unchanged.
Because running software on the original writes to it, changing the timestamps and metadata that are themselves the evidence, and it can overwrite deleted data before anyone has captured it. Forensically, that can be enough to make the findings inadmissible. We image the device behind a write blocker first and only ever work on the verified copy.
Yes, you will receive a clear written report describing what was found and how, in plain language suitable for court, HR procedures or solicitors. If you need expert witness support, we can discuss that with you.
Completely. These matters are handled securely and discreetly, signing an NDA is no problem, and the findings go only to you or to whoever you authorise us to send them to.
Only devices you are entitled to have examined: your own or your organisation’s, or where you hold proper authority or a court order. We check this before we begin, and we will not examine a device that someone has no right to have examined.
Hard drives and SSDs, servers and NAS devices, USB drives, memory cards, external drives, and computers, laptops and workstations. Storage media and computers are what we examine forensically; we do not handle mobile phones.
Often. When a file was created, modified or deleted is recorded across the file-system timestamps ($MFT created, modified and accessed), the $UsnJrnl change journal, event logs and other artefacts, and backdating gives itself away where those records contradict each other. We arrange them into a timeline and report on it plainly.
The first assessment is free, and after that the work is priced case by case. A basic forensic recovery is a fixed £800 + VAT, and the fee depends on the number of devices, the scope of work and whether you need a written report or expert testimony. You receive the quote in writing before any work is undertaken.
A write blocker sits between the evidence drive and everything else, allowing reads while physically preventing every write, so imaging cannot alter the original. Hashing the image then proves that it matches the source. That is what makes a forensic recovery defensible.
A free assessment, a write-blocked forensic image, deleted-data recovery and a clear written report. Contact us in confidence today.