Recovery as evidence · exhibits and logs, Reading
An ordinary recovery answers just one question: can the files be recovered? Once that answer is going before a judge, a tribunal or an adjuster, another question follows immediately: where did this material come from, and what has anybody done to it since? That is handled by the blocker, the two hash values, and the log kept while the job runs. The same bench, the same free scoping call, and the same written figure before a single cable goes in. Forensic instructions begin at £800 + VAT.
Talk it through in confidence
0800 6890668
| What you are seeing | What the examination shows | What comes back to you |
|---|---|---|
| Files removed, by mistake or on purpose | Whether the files ever existed, when they disappeared, and how much of them can be recovered | The files, with the method used to locate them in writing |
| A drive wiped clean on purpose | The tool used, the time it was run, and what it could not reach | Whatever survived the wipe, and where on the disk it was located |
| An encrypted volume — BitLocker or otherwise | Whether Passware can reach the encryption key, once the examination is authorised | Volume opened and the route into it documented |
| An exhibit that has started to fail | Patient imaging of a failing disk, with continuity maintained throughout | The data back, and the continuity intact |
| A dispute about what happened, and when | Timestamps checked against system artefacts, with the limits of each spelled out | A timeline, with every caveat marked on it |
The first scoping call costs nothing. There will be no chargeable work on your case until you have a price in writing. The purpose of this call is to define the scope of the work. Specifically, we identify all relevant events, the accounts and machines involved and, most importantly, what the evidence needs to prove. Forensic instructions begin at £800 + VAT, and the scope decides where yours lands.
Hardware blocker first: the exhibit is connected only to the blocker. Then a complete duplicate is created, sector by sector, using E01 (the default here, since case details and checksums travel inside the file); raw dd where an instruction calls for it.
MD5 and SHA-256 hashes are calculated during the creation of the image, and calculated again after the file is closed. When both pairs match, the duplicate is identical to its source. This is arithmetic. No one has to rely on anyone's word.
Any deleted, damaged or encrypted material is worked through in the image, with the log recorded throughout. If the examination is authorised and a key or password can really be obtained, Passware is used on the copy.
Give the other side a finding they cannot check or test, and you are giving them an argument. So it all goes in the bundle: exhibit numbers, the image each conclusion came from, dated handovers, the hashes, and the working notes typed while the job was running. The examiners on the other side will be able to re-run everything and come to the same answer.
Which side of the Code your instruction sits on: version 2 of the Regulator's statutory Code came into force on 2 October 2025. It governs criminal work in England and Wales: investigations, and evidence presented to a criminal court. Recovering data from digital storage is among the activities named there, ISO/IEC 17025 is the applicable standard, and we do not hold it. Instructions arising from a civil claim, an employment matter or an insured loss fall completely outside the regime. The bench work does not vary across that line. What varies is the declaration, and you will know where you stand before any work begins.
The company laptop was wiped with a wiping tool on the evening before it was returned, by an employee who was working out their notice. The tool had been keeping its own logs. That log data came through into the image, fixing the quarter of an hour during which the tool ran and identifying each file it had been directed at.
Four questions settle it. First, is the material as it was? Second, did competent hands do the work? Third, can an outsider follow how the data went from exhibit to finding? Fourth, is it relevant to what is actually in dispute? The blocker at acquisition, matching hash values and notes written while the job happens turn the first three from assertion into proof.
Reads go through, but writes stop at the circuit level. This distinction makes the difference between stating that the exhibit remained untouched and proving it.
Sometimes. Two things have to line up: lawful authority to examine the device, and a key or password within reach. Passware works on an image created from the original media, not on the original itself, and it records everything it tries. If there is no route to the key or password, the encryption has succeeded, and you will be told before you spend anything.
At the bench, both jobs are largely the same work. The difference with a forensic job is the testing which follows afterwards. On a forensic job the blocker sits in front of the exhibit, the hash values are proved at each end, there are no gaps in the exhibit record, and all the notes are recorded while the job is happening. These are the parts that hold a finding up when the examiner on the other side starts asking questions.
Once the disk is evidence, the forensic image has to be created behind a write block, with the hashes logged from the very first sector, so don't let anyone try it first. The first look is free, the figure comes in writing, and what you tell us remains confidential.