They use overlapping equipment and produce very different things. If findings might be tested — a tribunal, a court, a disciplinary hearing, an insurance claim — that difference decides whether you have evidence or an assertion.
Technically the two overlap almost entirely. What separates them is that nothing may write to the original, everything is hashed so alteration would be demonstrable, and each step is logged well enough to repeat months later.
Ordinary recovery aims to get files back. Forensic work aims to establish what happened, when and by whom, in a form that will survive being challenged. The methods overlap and the handling does not, and the choice has to be made before anything is touched.
The difference is documentation and verification rather than technique. Every step is recorded, the media is acquired through a write blocker so the original cannot be altered, and the image is hashed so any later change is detectable.
That cannot be applied retrospectively. If a machine has already been used, examined or repaired, the evidential position is compromised in ways no amount of later care recovers.
Receipt. Media logged on arrival with condition, serial numbers and seals photographed. Every subsequent transfer signed for.
Acquisition. Imaged through a hardware write blocker so the original cannot be modified. The image is hashed and the hash recorded.
Analysis. Conducted only against verified copies. The original is sealed and retained, available for independent examination by another party.
Reporting. Methodology, findings and limitations in writing. The limitations section matters as much as the findings.
Deleted files and their traces, file timestamps and whether they are internally consistent, USB devices connected and when, documents printed, cloud accounts synced.
Often which account, rarely which person, and never what they intended. We report what the records show, and any expert claiming more is exceeding the evidence.
Say so and stop now. It does not necessarily ruin the examination, but it has to be recorded and accounted for.
From £800 +VAT, quoted individually above that after a scoping conversation and fixed before work begins. Typically two to four weeks.