The difference between ordinary recovery (i.e. recovering your lost data) and forensic recovery is simply this: Ordinary recovery seeks to determine if your data has been restored. Forensic recovery seeks to prove that no changes were made to the original media, and that you can still show an unaltered copy of the data months after the event, even under challenge. That being said, forensic work uses write-blocked images (and hashes), along with documentation of the chain of custody, and the artefacts that provide these answers are usually not going to be the files themselves.
Probably the most common reason why people damage their evidence is by having someone check out what is stored on a device prior to handing it over. Booting up a computer and/or opening files on the device will modify the date/time stamps of those items. Additionally, if you plug the drive into another machine, there is always a chance that some writes could occur. As soon as you know that a piece of equipment could potentially be considered as evidence, do not use it; hand it off as-is.
Forensic recovery generally costs much more money, and takes much longer to complete than ordinary file restoration. However, it is worth doing so if the results from your recovery may need to be verified at some point down the road.
There are many similarities with ordinary recovery. The major differences are surrounding those similarities.
The media is examined through a hardware write block device which will reject all attempts to write data onto the media. This enables us to make an exact copy while ensuring there has been no alteration. On top of this, every time we copy or verify the image, we use a cryptographic hash (typically SHA-256) on both the source media and the resultant image. We then recheck these hashes at each stage to prove if even one bit of information has changed. Each process is documented in detail as well as exhibits being recorded with a signature placed upon them. All of our work complies with ACPO guidelines for digital evidence.
What you pay for is that you can show after many months if the material analysed is identical to the seized material and that you did not alter it by any means.
The most important evidence of interest is usually not the files themselves.
Registry records containing information on which external devices were attached to your computer with their serial number and when they were attached; these registry records are often a key element in cases involving employees who left the company (departing employee).
Records of what was opened from where, which survive long after the file has gone.
Evidence of which folders have been browsed including those found on external media that are no longer present on your computer.
Creation, modification, and access times can be identified and verified against file system journals (which may be difficult to modify convincingly).
Files, fragments of files, and database records can be recovered long after they have been deleted, and in their original context.
The cost will vary from that of standard recovery, and there is a good reason for this.
Forensic investigation begins at £800 +VAT, and following an initial ‘scoping’ meeting we will provide a quotation. This is due to the fact that the amount of work required to establish what needs to be proven varies greatly from client-to-client. It carries a 50% deposit and is charged whatever the outcome, because regardless of how many hours or days it takes, the results will always carry some value. Clients often need proof that something did not occur improperly, and therefore require an equal level of satisfaction from an investigation.
Forensic reports are intended for non-technical readers, but include all of the technical details beneath. Full write-up of an ex-employee investigation.
Simply send in your device for a free evaluation and provide some information about the problem you’re experiencing. An engineer will review your unit and confirm your exact quote in writing prior to beginning work.
Before dropping off or posting your device please request a quotation either by telephone or using our quotation form. The first step to recover your data is to get the device to us. Please ensure that you pack the device securely, include your contact information and then forward it to us. Once we have completed the free diagnostic of your device we will provide you with your exact price in writing prior to commencing any further work.
Posting it? We would suggest using a tracked and insured delivery method. Want to drop it off? That’s okay too. Monday to Friday, from 9am to 5:30pm is good; no appointment necessary: simply prepare the item as described above.
If you want a few more details first, fill out this form and let an engineer go through it and send you back a custom quote.
We’ll be in touch shortly. If it’s urgent, call 01865 593000.
Most asked questions about forensic data recovery.
That this entire process is verifiable (not only the end result). The source is examined behind a write-blocker and hashed to ensure that it is identical to the copied data; every step of the process is logged to allow another entity to replicate these steps and obtain the same results, all under the guidance of ACPO guidelines for digital evidence.
Often. The combination of USB device logs, link files, jump lists, shellbags, and file system date/time stamps often helps identify which devices have been connected, when they were connected, and which items were opened/modified near those times. However, establishing specific details will depend upon both the nature of the system as well as what has occurred since then.
No, most often evidence is compromised by booting the device up, accessing/reading data from it or attaching a cable. The only thing you should do is preserve the state of the media as-is, and allow an expert to create a forensic (write) blocked image.
We prepare our forensics reports to that standard, including hashed forensic images, documented chain of custody, compliant with ACPO guidelines and written in plain language for anyone who is not technical. What happens next is entirely at your discretion. We produce our reports in such a manner that they can be used in court if required, but also provide sufficient detail for non-legal purposes.
A finding that there has been no wrongdoing may be just as useful as proving wrongdoing, which is why this work is charged whatever the outcome. And regardless of which scenario occurs, the cost of producing the report will be the same.
The cost of our services starts at £800 + VAT (dependent upon the extent of investigation). After a preliminary discussion regarding scope we will quote, with a 50% deposit.
Our service includes a free assessment; a forensic write-blocked image of the device(s); deleted data recovery (if recoverable) and a comprehensive written report detailing findings. Contact us confidentially today.