If your case file server crashes or one of the drives on it dies during a case, you need this information back as soon as possible, and we can recover it in such a manner that preserves client privilege and is admissible in court. We are working from Oxford and provide legal data recovery services for solicitors and chambers across Oxfordshire and the surrounding areas; we work in house, under non-disclosure agreement (NDA); we maintain full custody records of the entire process (which is also forensically sound), and the recovered data will remain within Great Britain at all times.
Recovery of fee-earner’s laptop, computer hard drives, and server(s) containing case file information, on behalf of your firm (and/or) client, by our experienced team under NDA, including logging of all custodial activities and forensic readiness of evidence for submission to the courts when required.
Any boot-up, access to data contained within those files or connection of an external device to the system will write new date/time stamps onto the original data which can be compromised thereby potentially rendering evidence unusable. Do not allow anyone to open/access files/data prior to proper examination.
Files/information related to the matter being litigated and the systems upon which they are stored; and other materials that may be subject to legal challenge.
A legal framework a practice must have prior to sending us anything.
All work occurs under NDA and confidentiality is presumed, not negotiated. All communications occur through a single point-of-contact within our firm. Any data is maintained and stored in the United Kingdom and upon completion of our services, any recovered data will be provided back to you on new media and all working copies will be destroyed within an established timeframe.
If material is deemed privileged by you, please inform us prior to commencing work. In such cases, we will treat that material exclusively for recovery purposes only; we will never review or examine any material which has been identified as privileged, unless specifically instructed to do so by you as to how you would like file sampling to proceed.
It is worth deciding between the two jobs of ordinary file restoration (to restore files) and forensic file recovery (to prove the integrity of the original) before accessing the media.
In terms of job definition, ordinary recovery restores your files; forensic work shows that nothing has been altered: the data source is accessed by reading the data off the drive behind a hardware write-blocker and hash checked using SHA-256 to show the copied data is identical, with all steps logged to allow an independent third-party to replicate each step to produce an identical result. This is performed according to ACPO guidelines for digital evidence.
It is this distinction that is most critical for departing employee cases or when disclosing information. The process used for forensic work may be scrutinised. Forensic work starts at £800 +VAT, quoted after scoping, with a 50% deposit, and is charged regardless of the outcome since knowing that no improper actions were taken is an end-result of value.
We will have an engineer review your device after you send it into our lab for a no-cost evaluation (free diagnostic) with a short note on what happened, and provide you with your exact quote in writing prior to doing any work.
Data recovery begins by sending your drive to us. When you do so, be sure to package it carefully, put a note in there with some information about what occurred (and include your contact info), and then ship it to us. Once we perform the diagnostic at no cost to you, we will confirm your exact price in writing before we start working on your device.
Sending it by post? We recommend sending via a trackable and insured delivery method. If you prefer to hand-deliver it, then you can do this Monday to Friday, from 9am to 5:30pm. No prior appointment is required; simply package the unit as described previously.
Want some additional details first? Please fill out the form on our website with a description of your problem. An engineer will then review your information and provide you with a customised quote based upon that review.
We'll reply shortly. Anything urgent, call 01865 593000.
Some quick answers to questions that are commonly asked of us.
Yes. An NDA is signed with all clients prior to starting work. Work flows through only one identified point-of-contact. Data remains within the United Kingdom. If the recovered material contains privilege, please advise us at the outset; we do not read the files we recover and we will follow your instructions as to how to verify the files.
Data recovery simply retrieves your lost data. The forensic aspect of our service also shows that no additional changes were made: we create write-blocked images, hash them with SHA-256 to prove they are bit-for-bit identical, and maintain a chain-of-custody log according to ACPO standards (and guidelines) to allow testing of our findings.
No. This is the most common method of compromising digital evidence. Anytime you boot a computer, open files, etc., you alter timestamp values and may cause writes on storage devices. Therefore, if there’s a possibility that the media could potentially be considered as evidence, then it should remain unaltered in its original form.
Frequently. A combination of information from USB logs, links, jump lists, shellbags, and file-system timestamp values will help identify what items were connected to your system and accessed, and when; however, what can be determined may vary depending upon the operating system and amount of time that has elapsed since events have occurred.
Yes; recovered in an “attached” mountable state instead of being delivered as individual extracted files. Internal structures maintained within databases provide integrity and consistency, therefore even though a byte-for-byte complete version of the file exists, it still may not successfully attach; these issues would be identified and relevant matter communicated.
The cost of our services is as follows: servers and arrays: from £500 + VAT; a single drive: £300 + VAT; forensic work: quoted after we have completed a scope, from £800 + VAT. A 48 hour no-obligation diagnostic is always provided at no charge. We will provide you with a fixed written quote prior to commencing any recovery. In most cases you only pay if we recover your data.
Contact us today for a free diagnostic and a written quote; we have an NDA in place and our recovery work is done in house. Custody logs can be provided where required.