A failed case-file server or a fee-earner's dead laptop is usually more than a storage issue; how the device is treated during the first hour will determine if any recovered information can be trusted at a later date. We are contacted for both types of work by practices and chambers throughout Cambridgeshire: straightforward recovery where speed is paramount and forensically sound recovery where it may need to be examined. Both are completed internally and under NDA, with custody logged where it counts.
We handle matter files, practice databases and departing-employee computers under NDA as standard. There is only one named contact for each client, we maintain custody records where findings may be challenged and none of our clients' data leaves the United Kingdom.
Although there are common techniques used in both types of recovery, the primary difference lies in the way each type of recovery is handled. Therefore, the decision regarding which type of recovery should be done needs to be made prior to touching anything.
Within our catchment area, we receive the greatest proportion of evidential requests from the Essex legal and administrative cluster. In addition to these evidential requests, we also receive practice work from both Bury St Edmunds and Cambridge. This is largely made up of case management systems, land and estate records, and statutory retention archives.
A significant amount of that material is old when needed by the parties involved, which is why there is retention. Routine, as opposed to unusual, recovery of material from truly aged media (tape, optical, and pre-SATA drives) occurs in this type of work.
Where material is privileged, the privilege has to be preserved during the recovery as opposed to being recognised later. All work is performed in-house, nothing is outsourced or sent outside the UK, and one named engineer works on each project all the way through, therefore minimising the number of individuals who have access.
We will enter into confidentiality agreements with your firm prior to receiving the media, and if necessary we can produce a statement in a court-accepted format. We will also clearly state ahead of time whether we believe the recovered evidence will support your desired conclusion(s), which is more valuable than simply stating “we hope”.
Say so before anything is handled or touched. Handling it properly from the first hour is something that cannot be done afterwards; it's the difference between evidence that withstands legal scrutiny and evidence that doesn't.
We can often identify which account was used, but we generally do not identify who was involved, and never what their intentions were; however, we will detail what the record(s) show. Any expert providing further information is exceeding the level of support available from the existing evidence.
A typical request from clients, and frequently one we can answer. USB logs, file access timestamps and cloud sync artefacts are all examinable. Protect your source machine from use and block anyone from accessing it.
The purpose behind the process is exactly that. All of the documentation related to the recovery, including write-blocked acquisition, hash verification, chain of custody, and a report detailing the methodologies used and the limitations of those methodologies, is provided to support the results obtained. It is up to the tribunal to decide whether it does.
Standard practice in this line of work. Tape, optical media and pre-SATA drives will often come into our possession due to the length of time practices retain them. Send us a picture first if you're unsure what you've got in your hands.
Single drive recovery costs start at £300 +VAT. A quote for evidential work is made individually after a scoping conversation, always prior to starting, and will be a fixed price.