They are using some of the same hardware and producing quite different output. If your findings might be tested (a tribunal, court case, disciplinary proceeding, an insurance claim), that difference will determine if what you say is evidence or just an allegation.
Technically, both methods are similar with very little separation; however, the key difference is that nothing may write to the original in any way, and everything will be hashed, which makes any changes to the data clearly identifiable. Every time something is done, exactly what happened is logged, well enough to repeat it months later.
Ordinary recovery attempts to restore files; forensic recovery attempts to document events, timing and actions taken by individuals in a form that will survive being challenged. Methods are similar but handling is different. A decision must be made prior to touching anything.
The distinction lies in how evidence is documented and validated, not in methodology. All procedures are fully documented. The media is acquired using a hardware write block to prevent any changes from being made to the media that would alter its state. The image created of the data on the media is then hashed; if anyone were to make an alteration at some future date, it could be determined via comparing the new hash value to the previously captured hash value.
Documentation and validation cannot be retroactively applied to machines that have either been operated upon, inspected or otherwise serviced. In other words, once a piece of equipment has been used, operated upon, inspected or serviced, the evidential position has been compromised; this is true regardless of what subsequent efforts may be taken to preserve and protect the integrity of the evidence.
Receipt. Once media arrives, it is logged in detail, including documenting its physical condition, identifying each device's serial number(s) and taking photographs of all seal(s). Each time the media is moved/transferred, someone signs for it.
Acquisition. A digital copy is created of the data contained within the original media via a hardware write block. This ensures that there will be no modifications made to the original media. The image is also hashed. Documentation of both the image created and the hash values is maintained.
Analysis. Analysis is performed exclusively against the images (verified copies). Originals remain sealed, secured and ready for independent inspection by any other interested parties.
Reporting. Methodology, findings and limitations will need to be discussed in the written report. The limitations will matter as much as the findings.
Evidence about deleted files and traces of those files, evidence regarding file timestamps and whether they are internally consistent, evidence concerning USB devices connected and when connected, evidence about printing of documents, evidence about syncing of cloud accounts.
Frequently accounts are identified, rarely people and never their intentions. We will tell you what the records show, and any expert who claims more exceeds the available data.
Say that and stop at this point. Having already looked at the machine does not necessarily damage the investigation; however, recording it is necessary in order to account for it.
From £800 +VAT; above that, individual quotes are provided on a scope call prior to commencing the works, and these costs remain fixed. Normally takes 2-4 weeks.