Investigations & evidence · forensically sound recovery
Standard recoveries are about one thing: did you get your files back? Forensic recoveries add two more: is the original provably unaltered, and would another examiner be able to reproduce this work? Hash checks, write blockers and the notes we make while running this process address these issues in real time, while doing the job, not while looking back at the results.
A quiet word, in confidence
0800 6890668
| What's wrong | What the examination finds | What's returned |
|---|---|---|
| Deleted files, regardless of whether they were deleted innocently or not | Documentation proving that they existed, when they disappeared, and what portion can be recovered | Recovered data, using documented methodology |
| Drive attacked with wiping software | Tool identity, run window, and everything it missed | The survivors, and where they are located |
| BitLocker or other encrypted volume | Decryption using Passware, where a lawful key or password can be established | All of the accessible content (i.e. data) from an item, along with a documented procedure |
| Failing storage media that also serves as an exhibit | Careful imaging of failing storage media, using the same methodology used for all failing drives here, integrated into our full evidentiary process | Data sent back, with no break in continuity |
| There is disagreement regarding at what point something occurred | Using timestamps and file system artefacts together, with statements of the limitations and restrictions relative to their interpretation | An honest account of how events transpired, including the caveats |
When you instruct us on a new matter, we will first hold a confidential conversation about what has occurred, which devices/accounts matter and what the evidence needs to establish. Following this, you will receive a single written quote, fixed prior to any examination commencing, and the initial scope of works does not incur any cost.
The exhibit will come into contact with no other devices than the hardware write blocker, through which a bit-for-bit copy will be made: E01 with its built-in checksums, or raw format upon request.
The MD5 and SHA-256 values for each image are generated at the time of capture and again when the complete image is made available, and matching values are mathematical proof that the copied image matches the original.
Deleted, damaged or encrypted data is extracted from the created image as part of an ongoing audit record; where you have lawful authority to access the container and the credentials can be established, Passware will open volumes that were previously locked.
You get everything: the report, all of the exhibits and the files behind each exhibit, as well as the hashes, the continuity record and our working notes. If at some time in the future a tribunal or another expert wishes to verify anything, they will be able to follow the entire chain of evidence from start to finish.
Where the statutory line sits: in England and Wales, the Forensic Science Regulator's Code (statutory since 2 October 2023) covers criminal investigation and criminal proceeding forensics, and version two of the Code applies from 2 October 2025. Civil claims and matters related to employment or insurance fall outside the scope of the Regulator's enforcement. Our process is identical either side of that line, and we will advise which side your case is on.
A departing employee was running a wiping utility in the evening prior to returning the laptop. The image had captured logs from the wiping utility about the exact timing of its run and what files were left behind, thus providing an entire chain of events.
Quick definition: unaltered data, a competent examiner, an audit trail a stranger could re-create, and relevance. Imaging via write-blockers, hashes and contemporaneous notes show the first three rather than simply stating them.
A hardware component that allows for reading of a drive while making writing to the same drive physically impossible, therefore allowing the original data to remain demonstrably unaltered from its original form.
Yes, if whoever instructs us has legal authority and there is a reasonable way for us to obtain the password/key. Passware does this work, always performing the analysis against an image copy of the media, which is then documented in the methodology used. If no key exists, strong encryption will remain inaccessible, and we state this clearly and early on.
Techniques overlap greatly; the main distinction lies in evidentiary weight. Forensic work adds write-blocking, hash creation and a continuous evidence trail of exhibits created during forensic processing, along with contemporaneous documentation, thereby providing sufficient integrity in our findings that they can withstand challenges made by individuals being compensated for attacking them.
When recorders overwrite on a loop, all recorded evidence will weaken and time limitations expire, so open your case now. The first review is completely free and confidential.