Evidence work · recovery that holds up in court
Standard recovery has one question to answer: are the files back? Forensic work has three. Are they back, can you show the original is untouched, and would a stranger get the same result following your notes? Write blockers, matching hashes and a log kept during the job — not written up afterwards — answer the last two.
Speak to an engineer in confidence
0800 6890668
| The problem | What the analysis turns up | What you get back |
|---|---|---|
| Deletions, whether accidental or deliberate | Evidence the files were there, the point they went, how much comes back | The data, and a written record of the method |
| A disk that has had a wiper run over it | Which program did it, when, and what it left behind | Whatever survived, and where it sat |
| A BitLocker volume, or other encryption | Passware, given lawful authority and a workable route to the key | The contents opened, with the method logged |
| A failing drive that is also evidence | Our usual patient imaging of a sick disk, run inside the evidential process | The data returned, custody intact |
| An argument about when it happened | Timestamps and artefacts read together, with the limits set out | A straight sequence of events, with the caveats |
Work opens with a confidential briefing. You set out what has happened, which devices and accounts are involved, and what the evidence needs to prove. That fixes the scope, and the scope fixes one written quote, agreed before any examination starts. The scoping itself costs nothing.
Nothing connects to the exhibit except a hardware write blocker; the copy taken through it is sector-for-sector — E01, which carries its own checksums, or plain raw if you'd rather.
The image is hashed as it is written — MD5 and SHA-256 both — and hashed again once the file is finished. If the pairs agree, the copy is provably identical to the original — arithmetic, not opinion.
Recovery of deleted, corrupted or encrypted material happens against the copy, with the audit trail running throughout. Passware handles locked volumes where the authority to open them is lawful and a credential can be found.
Everything comes to you: the report, the exhibits, the underlying files, the hash values, the continuity log and our bench notes. Another expert — or a tribunal — can then retrace every step of the work for themselves.
Where the statutory boundary runs: The Forensic Science Regulator's Code, Version 2, became legally binding on 2 October 2025, covering work done in England and Wales in relation to criminal investigations and criminal proceedings. Matters instructed in civil, employment or insurance work lie beyond what it enforces. The method we use doesn't change from one side of that boundary to the other — but we will say which side you are on.
The night before the laptop went back, a leaver ran a wiping tool. Its own logs survived in the image — the exact minute it ran, and the files it had skipped. From those, the full sequence of events came together.
In short: unaltered data, a competent examiner, a trail someone else could follow step by step, and relevance. Write-blocked imaging, hash values and notes made at the time demonstrate the first three instead of just claiming them.
A hardware device that permits reads but blocks every write at the physical level, so the original goes back precisely as it arrived, and provably so.
Yes — provided the instructing party has lawful authority and there is a realistic route to the key or password. Passware handles it, run against the image every time, with the method documented. Without a key, strong encryption stays closed, and you'll hear that from us at the outset.
The bench work overlaps heavily; the difference is what the result must survive. A forensic job adds write-blockers, hash verification, a continuous exhibit record and notes taken at the time — what keeps a finding standing when the other side's expert goes at it.
Loop recording writes over the old footage, and deadlines won't wait. Open a case now — the first look costs nothing and stays confidential.