Investigations & evidence · digital forensic recovery
A standard job has one test: will the files return? A forensic job adds two: can you show the original was untouched, and could someone else repeat the work? That is what write blockers, hashing and notes made at the bench are for — not written up later.
Speak to us in confidence
0800 6890668
| The problem | What the analysis shows | What you get |
|---|---|---|
| Deleted files — by accident or by design | Whether they existed, at what point they went, and how much is retrievable | The recovered files, plus a record of how |
| A disk that has been through a wiper | Which utility was used, at what time, and how much it left behind | What lived through it, and where |
| A BitLocker volume or encrypted container | Unlocking with Passware, provided a key or password can be obtained lawfully | The contents opened up, with the method written down |
| Evidence sitting on a dying piece of hardware | The same imaging routine the bench uses on any sick drive, with the evidential trail laid on top | Your files returned, custody chain unbroken |
| An argument about dates and times | Timestamps and artefacts from the file system, read together and caveated honestly | A sequence of events, with its limits stated |
Every instruction opens with a private discussion: the events so far, the devices and accounts involved, and the question the evidence has to settle. Before any examination is carried out you get one fixed quote in writing — and that first scoping stage is free.
The original meets nothing but a hardware write blocker, and the copy is taken bit-for-bit — E01 with checksums inside the file, or raw if instructed.
An MD5 and a SHA-256 value are taken as the copy is made, then run again over the finished image — arithmetic proof that the copy is identical to what went in.
Anything deleted, corrupted or locked is pulled from the copy with the audit trail kept intact — Passware opens encrypted volumes where you hold lawful authority and the credentials exist.
What comes back to you is the full set — the report, its exhibits, the underlying files — along with hashes, continuity logs and the notes we made as we worked. Should another expert or a tribunal later probe it, every step can be retraced.
Where the statutory boundary falls: Version 2 of the Forensic Science Regulator's Code took legal effect on 2 October 2025 and binds forensic work carried out for criminal investigations and criminal proceedings in England and Wales. Instructions in civil, employment and insurance matters fall outside what it enforces. Our methods do not change between the two, and we will say openly which side your case falls on.
The night before handing back their laptop, a departing employee ran a wiping utility. From the image we pulled its own logs, the window in which it ran, and the files it never reached — then the sequence of events filled in everything else.
In short: unaltered data, a capable examiner, an audit trail others can repeat, and relevance. Write-blocked imaging, hashing and notes taken at the time prove the first three rather than assert them.
A piece of hardware that permits reading from a drive while physically blocking every write, leaving the original in the state it arrived in — provably so.
Yes, where the instructing party holds lawful authority and a password or key can be established — we use Passware for it, run against the image, and document the method. With no key at all, strong encryption stays closed; we'll tell you that early.
Much of the method is shared; what separates them is evidence. Forensics layers on write-blocking, hashing, an unbroken exhibit trail and contemporaneous notes — so the findings hold up against a person paid to pick holes in them.
Loops write over themselves, traces fade, deadlines run out. Start a case early — scoping it costs nothing and stays confidential.