Data recovery and forensic analysis both use similar tools, but create completely different results. One restores your documents, while the other demonstrates that all of your information remained intact along the way. This distinction determines if you have proof or just an opinion when the findings might be challenged, such as at a trial, a disciplinary hearing or a tribunal.
There is no going back. That's why this section precedes all others.
Deleted files and remnants left from deleting files. Timestamps related to creating files, last modification, last access date(s), and internal consistency of these timestamp(s). Inconsistency alone can provide valuable information. Which USB device(s) were attached to the computer, and when. What documents were printed? Were any files copied to removable media? What search terms were entered? Websites visited, and cloud storage account synchronisation.
What did not happen is also important, and frequently it is the point. Showing a file was never opened, showing a device had never been hooked up, or showing that a machine was switched off during the period in question can be of equal importance to establishing the reverse.
We can't fairly say if someone intended something to happen. We report what the machines tell us. Whether someone wanted an event to occur is for whoever decides the matter, not for a lab report, and any expert providing anything beyond what he/she can prove from evidence is overstepping his/her bounds.
The media is documented upon receipt, with its condition, serial number(s) and seals photographed. Each subsequent movement of the media is documented with signatures.
Hardware write blockers used for acquisition make sure the original data remains unchanged. Hashes generated from the image and recorded ensure that any changes made after acquisition can be detected.
All examinations occur against verified copies. Original media remains sealed and secured, ready for independent analysis by another entity.
Written reports include what actions were taken, what results were obtained, and what could not be determined. The limitations portion of the report is just as important as the findings.
Forensic work starts at £800 +VAT (with all work being quoted individually above that) as the scope of each case can vary greatly from examining one laptop to reconstructing activity across an estate. A fixed quote will be agreed following a scoping conversation with you before we carry out any work for you.
If your case requires it, a statement in a format acceptable to courts may be provided, and we will tell you clearly beforehand whether we believe the materials are likely to support the findings you hope to obtain.
This is a common type of instruction and we frequently have enough information to provide you with the answers. We can look at records relating to USB connections, file access timestamps and cloud sync artefacts. Please secure the machine immediately and do not let anyone use it in the meantime.
Often, where user accounts were separate and the machine was not shared between users. What we report on is based on what the records show, not what somebody intended by it. This distinction is important if the findings are challenged.
That is why we do it this way. Write-blocked acquisition, hash verification, documented custody and a report which includes the methodology used and the limitations that apply. Whether or not the work is persuasive is for the tribunal.
Tell us, and stop now. Using the machine will cause timestamps to alter and potentially overwrite the most important information. This may or may not damage the examination, but it will have to be documented and addressed in the final report.
Yes, in that order: forensic image acquisition first and then, after verification, data recovery from the image. Doing it the other way around destroys the evidence chain for good.
Typically two to four weeks. Acquisition is usually quite fast. Analysis and compiling a report take longer. Both require patience.
A free initial assessment, a forensic write-blocked image of your device(s), deleted-data recovery, and a clear written report. Speak to us in confidence today.