Data Recovery Case File · Trust, Practice & Honest Limits · The Requirements Change
Speak to the Investigating Officer Before Commissioning Anything
His enquiry concerns a drive that stopped working around 2006 and which may hold material relevant to a police investigation. "The drive starts, and will very very slowly show me the folder structures, but fails to open" anything. The technical position is ordinary and the situation is not — where material may become evidence, how it is handled matters as much as whether it can be read, and that is a decision for the investigator rather than for him or for us.
| Media | Hard drive of approximately two decades — directory structures readable slowly; file content not accessible; contents potentially relevant to an ongoing investigation |
| Reported situation | Drive out of service for approximately two decades · drive achieving start-up · directory structures presenting very slowly · file content not opening · contents potentially relevant to a police investigation · no recovery yet commissioned |
| Fault class | Read failure in content regions with structures readable — evidential handling requirements determinative of approach; dormancy effects present |
| Equipment used | Investigating officer's requirements established before any technical work · no browsing or repeated access permitted · forensic-standard imaging with hash verification where private recovery was appropriate · documented handling record maintained throughout · no alteration to the original medium |
The decode: why the first step is a phone call
What changes when material may be evidence: not the difficulty of reading it, but the requirements around how it is read. An investigation cares about where a device has been, who has handled it, and whether anything on it could have been altered — and those questions are answered by procedure rather than by technique.
Why that makes the investigating officer the first call: they may want the device handled under their own arrangements, by their own forensic unit, or by a provider they instruct. A private recovery undertaken first, however competent, can complicate how the material is treated afterwards — and that is a cost nobody wants to discover at the point it matters.
Why this is not a comment on ordinary recovery work: a normal recovery is careful, and it images write-blocked as standard. What it does not necessarily produce is the documentation an investigation may require — a recorded chain of custody, hash values verifying that the image matches the original, and a written account of who did what and when.
What to ask, and it is a short conversation: whether they want the device, whether they have a preferred route, and whether they require anything specific of whoever handles it. Some forces have their own capability and will simply take it.
If private recovery is the agreed route: ask for forensic-standard imaging with hash verification, a documented handling record, and confirmation that the original medium is not altered. Those are ordinary things to request and any competent provider will supply them — the point is asking in advance rather than afterwards.
Now the technical position, briefly. Directory structures reading slowly while content will not open means the regions holding the filing information are in better condition than the regions holding the files. The slowness is retries, and every browse of those folders is another sustained read across a surface that is struggling.
What that argues for: a single controlled image rather than any further exploration. Browsing to see what is there costs exactly what a capture would have spent, and on a drive of that age — two decades dormant, lubricant thickened, heads long at rest — the number of good start-ups is not unlimited.
What must not happen: no repair, no consistency check, no attempt to make the drive usable. Anything written alters the original, which is the one thing that cannot be undone.
On the bench
The investigating officer's requirements were established before any technical work — evidential handling turning on documented custody, verification that an image matches the original, and an account of who handled the device, none of which a routine recovery necessarily produces. No browsing or repeated access was permitted, structures reading slowly indicating retries and each exploration consuming a limited number of viable start-ups on a long-dormant drive. Forensic-standard imaging with hash verification was performed with a documented handling record and no alteration to the original medium.
The outcome
Requirements established with the investigator before any work, no exploratory access permitted, and imaging performed to forensic standard with the original unaltered. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode: the first call is not to a recovery service. Where material may be evidence, how it is handled matters as much as whether it can be read — and that is the investigator's decision to make.
Device that may hold material relevant to an investigation
Speak to the investigating officer before commissioning anything — they may want the device handled under their own arrangements or by a unit they instruct, and work done privately beforehand can complicate how the material is treated later. Ask three things: whether they want the device, whether they have a preferred route, and whether they require anything specific of whoever handles it. If a private recovery is agreed, ask for forensic-standard imaging with hash verification, a documented handling record, and confirmation that the original isn't altered. Meanwhile stop browsing it — slow folder listings mean retries, and each exploration costs a start-up you may not have to spare.
Ask the officer first — then call Oxford Data Recovery on 01865 593000; requirements established before any work, forensic-standard imaging with hash verification, documented handling record and no alteration to the original.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.