Evidence work · recovery for court, Plymouth
A normal recovery answers just one question: can the files be recovered? If a judge, tribunal or loss adjuster is going to read the outcome, there will be another question: can you prove where the files came from and what has been done to them since? This is answered by the write blocker, the two hash sums and the log kept as the job runs.
A quiet word first?
0800 6890668
| What turns up | What examination shows | What goes to you |
|---|---|---|
| Files gone, by mistake or by intent | Whether they ever existed, when they left, and how much of the data comes back | The files, and a documented description of the method followed |
| A disk that was deliberately wiped | Which tool was run, when it was run, and what it did not reach | What came through the wipe, and where it lies |
| BitLocker, or another encrypted volume | Whether Passware can find the key, with authority to examine | The volume open, with the route in recorded |
| An exhibit that happens to be a failing drive | Patient imaging of a failing disk, continuity held throughout | The data back, and continuity held |
| A dispute over what happened when | Timestamps read against system artefacts, with the limits stated | A timeline, with each caveat marked on it |
Call us and tell us as much or as little as you like. The call costs nothing. It needs to establish what the matter is: what happened, which devices and accounts are involved, and what question the evidence has to answer. That defines the scope. One written figure follows from it, and you get that before anything is opened.
The exhibit is connected to a hardware blocker and nothing else. A complete copy is made, sector by sector. We use E01 unless specifically instructed otherwise, since the case details and checksums are embedded within the file. Raw dd if that is desired.
MD5 and SHA-256 hashes are generated during the imaging process, then again after the imaging is complete. If the two pairs match, the duplicate matches its source exactly. That is mathematics. It requires no trust in anyone.
Everything deleted, damaged or encrypted is processed within the image, with the log running throughout. Where lawful authority to open a locked volume exists and a genuine key or password is obtainable, Passware is pointed at it.
Anything the other side can't check is something to argue over. So we put together a bundle that can be checked: exhibit references, the images each finding was read from, every handover with its date, hash values, and the notes made during the examination. Their own examiner can repeat the work and reach the same result.
Which side of the Code you fall on: the statutory Code was produced by the Forensic Science Regulator, and version 2 became enforceable on 2 October 2025. It applies only to criminal work in England and Wales: investigations, and cases brought before a criminal court. Device forensics is named there; the standard it uses is ISO/IEC 17025; and our lab does not hold it. Work arising from civil claims, employment disputes or insured losses does not come under this regime at all. The method applied here does not change across that boundary, and you will be told which side your instruction is on.
An employee working out their notice wiped the laptop the night before returning it. The wiping software had kept its own logs, and those came back into the image, pinning down the fifteen minutes it ran and listing each file it had been set to erase.
There are four questions that decide it. Has anything on the material changed? Were the handlers competent? Can someone outside trace the line from exhibit to finding? Does any of it relate to the issue? A blocker on acquisition, hashes matching at each end and notes recorded as the work occurs prove the first three, rather than simply asserting them.
Reads pass; writes get blocked in the circuitry itself. This is significant because one method assures the court that nothing was written to the exhibit, while the other proves it.
Sometimes. Two things are needed: lawful authority to examine the device, and a key or password that can be reached. Passware does that part, working on an image of the device, not the exhibit itself, and each attempt is logged as it runs. If there is no means of reaching a key, the encryption has held, and you will know before spending anything.
At the bench the methods are largely the same. What varies is what the results must survive later. A forensic job runs a blocker ahead of the exhibit, proves hashes at both ends, keeps an exhibit log that is complete and unbroken, and documents the examination as it occurs: the parts that keep a finding standing when the opposing examiner challenges it.
A drive imaged once, as found, leaves every option open; one that is run and retried loses them. Do not let anything else touch the drive before it is imaged. Begin here. Your first look is free, and whatever you tell us goes no further.