Investigations & evidence · forensically sound recovery
Ordinary recovery asks one thing: did the files come back? Forensic recovery adds two more: is the original provably unchanged, and could another examiner repeat the work? Write blockers, hash checks and notes made as the job runs answer those — live, not in hindsight.
A quiet word, in confidence
0800 6890668
| What's wrong | What the examination finds | What's returned |
|---|---|---|
| Files deleted, innocently or otherwise | Proof they existed, when they vanished, and what portion can return | Recovered data with the method documented |
| A drive attacked with wiping software | The tool's identity, its run window, and everything it missed | The survivors, and their locations |
| BitLocker or another encrypted volume | Passware decryption where a lawful key or password can be established | Accessible contents plus a recorded method |
| An exhibit that is also a failing drive | The same careful imaging any failing drive gets here, wrapped in the full evidential process | Data back, continuity never broken |
| Disagreement about when something happened | Timestamps and file-system artefacts, interpreted together with their limits stated | An honest event sequence, caveats included |
Each new instruction starts with a confidential conversation — what has happened, which devices and accounts matter, and what the evidence needs to prove. You then receive a single written quote, fixed before any examination begins, and that opening scoping work costs nothing.
The exhibit touches nothing except a hardware write blocker, through which a bit-for-bit copy is taken — E01 with its built-in checksums, or raw format on request.
MD5 and SHA-256 values are computed during acquisition and recomputed against the completed image. Matching sums are mathematical proof the copy equals the source.
Deleted, damaged or encrypted material is recovered from the image under a continuous audit trail; where you hold lawful authority and credentials can be established, Passware opens locked volumes.
You receive everything: report, exhibits and the files behind them, plus the hashes, the continuity record and our working notes. If a tribunal or another expert wants to test it later, they can walk the whole trail step by step.
Where the statutory line sits: in England and Wales, forensic work for criminal investigations and criminal proceedings falls under the Forensic Science Regulator's Code — statutory from 2 October 2023, with version two applying from 2 October 2025. Civil, employment and insurance instructions fall outside its enforcement. Our process is identical either side of that line — and we'll tell you which side your matter is on.
An employee on their way out ran a wiping tool the evening before the laptop went back. The image gave up the tool's own logs, exactly when it ran and which files it missed — and from there the whole sequence of events fell into place.
Briefly: data nobody has altered, a competent examiner, an audit trail a stranger could repeat, and relevance. Imaging via write-blockers, hashes and contemporaneous notes show the first three rather than merely assert them.
Hardware that lets a drive be read while making writes physically impossible, so the original leaves exactly as it came in — and demonstrably so.
Yes — provided whoever instructs us has lawful authority and there's a realistic route to the password or key. Passware does that work, always run against the image, with the method written up. Where no key exists, strong encryption simply stays shut — and we say so early on.
The technique overlaps a great deal; the difference is evidential weight. Forensic work adds write-blocking, hashing, a continuous exhibit trail and notes made at the time — so what we find stands up when someone is being paid to attack it.
Recorders overwrite on a loop, evidence weakens, time limits pass. Open a case early — the first look is free and confidential.