Recovery as evidence · exhibits and logs, Reading
An ordinary recovery answers one question: are the files retrievable. Once the answer is going before a judge, or a tribunal, or an adjuster, a second question follows it in — where did this material come from, and what has anybody done to it since. That is the work done by the blocker, by the two hash values, and by the log kept while the job runs. Same bench, same free scoping call, and the figure fixed in writing before a cable goes in. Forensic instructions begin at £800 + VAT.
Talk it through in confidence
0800 6890668
| What you are seeing | What the examination shows | What comes back to you |
|---|---|---|
| Files removed, by mistake or on purpose | Whether they ever existed, when they went, and how much of them comes back | The files, with the method that found them in writing |
| A drive wiped clean on purpose | Which tool was run, at what time, and what it failed to reach | Whatever came through the wipe, and where on the disk it was sitting |
| An encrypted volume — BitLocker or otherwise | Whether Passware can reach the key, once the examination is authorised | The volume open, and the route into it recorded |
| An exhibit that has started to fail | Patient imaging of a failing disk, with continuity held throughout | The data back, and the continuity intact |
| A dispute about what happened, and when | Timestamps set against system artefacts, with the limits spelled out | A timeline, with every caveat marked on it |
The scoping call costs nothing, and nothing chargeable starts until you have a price in writing. What the call fixes is the ground it covers: the events, the machines and accounts in play, and precisely what the evidence must establish. Forensic instructions start at £800 + VAT, and the scope decides where yours lands.
Hardware blocker first: the exhibit connects to that and to nothing else. A full duplicate then comes off, sector by sector. E01 is the default here, since case details and checksums travel inside the file; raw dd where an instruction calls for that.
MD5 and SHA-256 are worked out while the image is being written, then worked out again from the closed file. Where the two pairs agree, the duplicate is identical to its source. That is arithmetic. It does not rest on anybody's word.
Deleted, damaged and encrypted material gets worked through inside the image, the log running throughout. Where the examination is authorised and a key or password really can be got at, Passware is aimed at the copy.
Hand the other side a finding they cannot test and you have handed them an argument. So it all goes in the bundle: exhibit numbers, the image each conclusion came off, dated handovers, the hashes, and the working notes typed as the job ran. The examiner on the other side can run the whole thing again and reach the same answer.
Which side of the Code your instruction sits on: version 2 of the Regulator's statutory Code took effect on the second of October 2025. It governs criminal work, England and Wales: investigations, and evidence put before a criminal court. Taking data off digital storage is one of the activities named there; ISO/IEC 17025 is the standard; and we do not hold it. Instructions arising from a civil claim, from an employment matter or from an insured loss lie outside the regime altogether. Bench work does not vary across that line. What varies is the declaration, and you know where you stand before anything begins.
A wiping tool was run over a company laptop on the evening before it was handed back, by an employee working out notice. The tool had been keeping logs of its own. Those came through into the image, fixing the quarter of an hour during which it ran, and naming each file it had been pointed at.
Four questions settle it. Is the material as it was? Did competent hands do the work? Is the line from exhibit to finding one an outsider could follow? And is it relevant to what is actually in dispute? The blocker at acquisition, matching hash values, and notes written while the job happens turn the first three from assertion into proof.
Reads go through; writes stop inside the circuitry. That distinction is what separates telling a court the exhibit was untouched from proving it.
Sometimes. Two things have to line up: lawful authority to examine the device, and a key or password within reach. Passware handles that part, pointed at the image and not the exhibit, and the attempt is logged as it runs. Where no route to a key exists, encryption has done its job, and you hear about it before spending anything.
At the bench, largely the same work. What separates them is the testing that comes afterwards. On a forensic job the blocker goes in front of the exhibit, the hash values are proved at each end, the exhibit record has no gaps in it, and the notes are written while things happen. Those are the parts that hold a finding up when the examiner opposite starts pressing.
Once a disk is evidence the copy has to be made behind a write block, with the hashes logged from the first sector, so do not let anyone try it first. The first look is free, the figure comes in writing, and nothing you tell us goes anywhere else.