Evidence work · recovery for court, Plymouth
An ordinary recovery answers a single question: are the files retrievable. As soon as a judge, a tribunal or a loss adjuster is going to read the outcome, a second question turns up — can you demonstrate where the files came from and what has been done to them since. That one is answered by the blocker, the two hashes and the log kept as the job runs.
A quiet word first?
0800 6890668
| What shows up | What examination shows | What goes to you |
|---|---|---|
| Files gone, by mistake or by intent | Whether they ever existed, when they left, and how much comes back | The files, and a written record of the method used |
| A disk that was deliberately wiped | Which tool was run, when, and what it did not reach | What came through the wipe, and where it lies |
| BitLocker, or another encrypted volume | Whether Passware can get at the key, with authority to examine | The volume open, with the route in recorded |
| An exhibit that happens to be a failing drive | Patient imaging of a failing disk, continuity held throughout | The data back, and continuity held |
| A dispute over what happened when | Timestamps read against system artefacts, with the limits stated | A timeline, with each caveat marked on it |
Ring us and say as much or as little as you like; the call itself is not charged for. What it has to settle is the shape of the matter — what took place, which machines and accounts it reaches, and the question the evidence must answer. That is the scope. One written figure follows from it, and you have that before anything is opened.
The exhibit is plugged into a hardware blocker and nothing else. From there a full duplicate is taken, sector by sector. E01 is what we use unless told otherwise, because the case details and checksums live in the file; raw dd if that is what you want.
MD5 and SHA-256 are calculated during the write, then calculated again off the completed file. If the pairs agree, the duplicate matches its source exactly. That is arithmetic. There is no need to take anyone's word for it.
Everything deleted, damaged or encrypted gets worked through inside the image, with the log running the whole time. Where authority to open a locked volume exists and a key or password is genuinely obtainable, Passware gets pointed at it.
Anything the other side cannot check is worth arguing about. So the bundle is built to be checked: the exhibit references, the images each finding was read from, every handover with a date on it, the hashes, and the notes written while the work was going on. Their own examiner can repeat the work and land in the same place.
Which side of the Code you fall on: the statutory Code written by the Forensic Science Regulator went to a second version and became enforceable on 2 October 2025. Its reach is criminal work done in England and Wales — investigations, and matters going before a criminal court. Device forensics is named there; the standard it sets is ISO/IEC 17025; and that is not held here. Anything growing out of a civil claim, an employment row or an insured loss falls outside the regime entirely. The method used here does not alter across that boundary, and you will be told which side your instruction is on.
An employee working out their notice ran a wiping tool over the laptop the evening before handing it in. That tool had been keeping its own logs, and those came through into the image — pinning down the fifteen minutes it ran, and listing each file it had been set to erase.
Four questions decide it. Has anything on the material changed? Did competent hands do the handling? Could an outsider trace the line from exhibit to finding? Is any of it relevant to the issue? A blocker on acquisition, hashes matched at each end and notes taken as the work happens prove the first three of those, rather than assert them.
Reads pass; writes are cut off in the circuitry itself. That distinction counts: one way you assure a court that nothing was written to the exhibit, the other way you prove it.
Sometimes. Two things are needed: lawful authority for the device to be examined, and a key or password that can be reached. Passware does that part, pointed at the copy and not the exhibit, with the attempt logged as it runs. Where there is no way through to a key, the encryption has held, and you hear so before spending anything.
At the bench the work is largely identical. What differs is what the outcome must survive later on. A forensic job runs a blocker ahead of the exhibit, proves hashes at both ends, keeps an exhibit record without gaps, and writes notes as things occur — the parts that hold a finding upright when the opposing examiner leans on it.
A drive imaged once, as found, keeps every option open; one that is run and retried loses them. Start it here before anything else touches it. The first look is free, and what you tell us goes no further.