It’s already bad enough to lose information, but now add the stress of wondering who may have seen it. Our business fully complies with all applicable UK data protection legislation. We are registered on the Information Commissioner’s Office register and conduct every data recovery operation in-house with our own engineers. Your files remain in our possession throughout the entire recovery process and never leave the United Kingdom.
We are registered on the ICO register & compliant with GDPR. Your data will be handled by our engineers alone, will remain confidential throughout and once we have returned it to you we will delete all records of it from our systems.
Our processes are described clearly (not buried in legal terms).
Where recovery occurs and who has access to this recovery process.
Our engineers perform the recovery rather than passing it to a third party. Each job goes through one named contact from start to finish. This reduces the number of people accessing your device and aids in maintaining confidentiality.
We do not review what is recovered. A successful “verification” of file integrity occurs when we confirm that files can be opened and match the expected layout, i.e., they appear as if no problem occurred; however, we do not view their content. If there is a possibility of issues related to privileged or sensitive information, please inform us prior to beginning and we will comply with your wishes regarding how you desire verification to proceed.
Included as standard for all forensic jobs. Available to include with any other job which could potentially become subject to scrutiny.
When dealing with material that could potentially serve as evidence in some capacity, or could lead to a regulatory response, the material is handled accordingly; documentation includes signed exhibit records of movement, logging of materials during transportation, and use of cryptographic hash values at the point of imaging, and subsequent verification of these values at every point along the chain so that any potential alterations can be demonstrated. This is done in accordance with the standards set forth by the Association of Chief Police Officers (ACPO) for digital evidence.
In addition, it should be noted that this practice is applicable whether the initial call for assistance arose from a forensic-related incident, or whether the issue simply involved a non-forensic related matter such as an insurance claim, or perhaps a breach involving personally identifiable information. If the material was initially imaged read-only at the beginning of the process (which it will have been), it makes documenting the progression of the case much simpler.
What about the items you cannot bring back on line?
Even after deleting files or formatting the device, there still remains data recoverable. Therefore, when equipment truly does need to be removed from your possession, then the technique used should depend upon the type of media. Overwrite (and verify overwrite) is required for all types of hard disk storage, while using a cryptographically secure “erase” for solid state disks (SSDs), where wear levelling prevents reserved blocks from being erased, is recommended. Additionally, physically destroying a failed disk (whereby the disk fails to respond to commands) provides a final solution.
All certificates show serial number, the method and date that the certificate was produced; typically, this is also what is requested by auditors or clients when they wish to verify the existence of the certificate. Your original item is always returned to you once a recovery has been completed (unless you request otherwise) and prior to making any destructive actions regarding your item, we will ensure that all parties agree on what will be destroyed and what action will be taken.
Some quick answers to questions that are commonly asked of us.
No. At each stage of our data handling process, data is located within the United Kingdom and there is no off-shore processing nor any cloud based staging outside of the United Kingdom.
Only our engineers have direct interaction with your information during the course of any work we do on your behalf; these interactions occur through a single designated point of contact per project. We do not subcontract out any aspect of our services to minimise the potential number of individuals who may gain access to your information.
No. The primary purpose of verification is to validate that files can be opened and that the file structure corresponds with the anticipated structure, not to examine their content. In cases where verification involves sensitive or confidential material, please advise us and we will implement your instructions as to how the verification process should proceed.
A retention period is established according to your specifications for copies used to complete work. Once the retention period expires, secure destruction of those copies will occur. You determine the length of time copies are retained as per your requirements. Some clients require a defined retention period to allow for a specified amount of time in case something is overlooked while other clients desire that their copies be disposed of immediately upon completion of the work.
Yes. Forensic evidence is processed to the highest standards of integrity (using signed exhibits, logged handlings and cryptographic hashes at each stage) and follows the principles set out by ACPO. This is standard procedure in all forensic cases and is available for any job which may later be subject to scrutiny.
Yes; however if you wish for us to destroy it, we can do so in accordance with our secure procedures. In this instance, we will confirm with you exactly what is being destroyed, via its serial number(s), prior to taking any action which cannot be reversed.
Either because of a commercial confidentiality concern or simply because they are irreplaceable personal files, whatever your reason, we treat them safely here in the UK. Begin with a free diagnostic, or ask how to obtain an NDA.