Evidence & investigations · forensic data recovery
Ordinary recovery asks one question: can the data come back? Forensic recovery asks two more: can you prove nothing changed, and could someone else repeat it? The answer is write-blockers, hashes, and notes taken as it happens — not afterwards.
Talk it through, in confidence
01273 964902
| The situation | What we establish | What you receive |
|---|---|---|
| Files deleted — innocently or otherwise | Whether they existed, when they went, and what can be brought back | Recovered material with its recovery documented |
| A drive someone tried to wipe | What the wiping tool was, when it ran, and what survived it | A survival map, and the survivors |
| An encrypted container or BitLocker volume | Decryption via Passware where passwords or keys can be lawfully established | Decrypted evidence, method on the record |
| A physically failing drive that's also evidence | Recovery with the same imaging discipline our lab applies to any failing drive — plus the forensic trail | Data back, chain of custody intact |
| A dispute over when something happened | File-system timestamps and artefacts, read together and honestly caveated | A timeline that says what it can prove |
Every instruction starts with a confidential conversation: what happened, which devices and accounts exist, and what question the evidence needs to answer. You get a fixed written quote before any examination begins — and the initial scoping costs nothing.
The source connects only through a hardware write-blocker and is imaged bit-for-bit — E01 with embedded checksums, or raw where instructed.
MD5 and SHA-256 fingerprints are computed at acquisition and re-verified against the completed image — the mathematical proof that nothing changed in the copying.
Deleted, damaged and encrypted material is recovered from the image with the trail preserved — Passware handles encrypted volumes where lawful authority and credentials exist.
You receive the findings — report, exhibits and supporting files — with hashes, continuity records and our contemporaneous notes preserved. If the work is ever tested by another expert or a tribunal, the trail is there to be followed.
Where the statutory line sits: the Forensic Science Regulator's Code — Version 2, in force since 2 October 2025 — legally governs forensic work for criminal investigations and proceedings in England and Wales. Civil, workplace and insurance instructions sit outside its enforcement scope. We work to the same disciplines either way, and we'll tell you plainly which side of that line your matter is on.
A leaver ran a wiping tool the night before returning their machine. The tool's own logs, the run window, and the files it missed were all recovered from the image — and the timeline of what happened first told the rest of the story.
Broadly: unchanged data, a competent examiner, a reproducible audit trail, and relevance. Write-blocked imaging, hashing and contemporaneous notes are how the first three get proven rather than promised.
A hardware device that lets a drive be read but physically prevents any write to it — so the original stays exactly as received, provably.
Where the instructing party has lawful authority and passwords or keys can be established, yes — Passware is our tool for that work, run against the image, with the method documented. Without any key, strong encryption stays shut; we'll say so early.
The recovery techniques overlap; the difference is proof. Forensic work adds write-blocking, hashing, exhibit continuity and notes taken as-it-happens — so the result can withstand someone whose job is to doubt it.
Loops overwrite, artefacts age, deadlines pass. Open a case first — the scoping conversation is free and confidential either way.