A former employee hands you a laptop that has been returned suspiciously empty, and your business needs to know what took place before the data was deleted. Forensic recovery is the process of recovering lost data, but it comes with the burden of proving it. For many of our clients in and around Staines and Surrey, this is one of the most important tasks we perform.
All forensic jobs include a free diagnostic evaluation. After the evaluation, we will provide you with one fixed quote in writing before any work is performed.
In most cases you only pay if we recover your data. For all electronic and mechanical work, including chip-level repairs, 50% is required upfront, with the balance only payable if we recover your data. For BitLocker, ransomware, CCTV/DVR and forensic jobs, full payment is made upfront once you accept the fixed quote. Full details regarding our costs can be found on the data recovery cost page.
Every forensic recovery case begins with identifying the likely cause of the problem from its symptoms. These twelve common causes cover nearly everything that arrives on our bench.
This is by far our most common type of request. When an employee's computer has been wiped clean, we can usually reconstruct the wipe itself, which tool was used to carry it out and the activity that came before it.
Microsoft Windows automatically keeps track of each time a USB device connects to the computer, including the date and time of connection, which, combined with file-access records (showing which files were opened), can help identify what might have left the building.
When files are sent by webmail or uploaded to services like Dropbox, Google Drive or WeTransfer, a record of the transaction is usually left behind, in histories, logs or leftover file pieces.
Wherever documents and email communications have been deleted en masse, they can be carved back out and presented in a defensible way, verified using hashes.
By reviewing the file system metadata, USN journal entries and logs together, we can identify when a file was actually created, opened or changed.
Identify exactly which confidential materials were accessed, copied or taken, and by which user account.
Investigating the use of company property to evidence standard under company policy, typically at the direction of solicitors.
Evidence that a complaint or a case turns on (footage and device data), recovered by means of forensic examination.
Objective, fully documented and impartial conclusions drawn for use in an internal HR procedure, with an insurer or at a tribunal.
This work will be undertaken according to whatever directions have been agreed between the legal teams representing the parties.
Our team identifies any traces of software such as CCleaner, BleachBit and other "wiper" programs. Where these programs were used, we can determine what ran, when it was done and what remains.
OneDrive, Google Drive and Dropbox sync logs and remnants, which show what was uploaded and when via a user's own cloud account.
Employers tell us about this scenario all the time. An employee takes company data from their work computer (via a USB stick, a personal email account or cloud storage) and then wipes or resets the machine before returning it. The employer gets back a clean-looking laptop but believes data was removed. That's exactly where forensic recovery comes in. Many things remain even after a reset or a wiping tool has been used: which wiping utility was used and when, which external USB devices were attached during the final weeks and what was opened just before they were, and what data was sent via webmail or cloud services, as well as deleted files carved back off the drive. All of these pieces of evidence are compiled into a detailed forensic report, written in plain English, so that you can take action.
The majority of this work is carried out on our forensic bench using OSForensics (the PassMark investigation suite) to recover deleted files, index and search the whole drive, build a minute-by-minute timeline from file-system timestamps and the Windows USN journal, and retrieve the artefacts that matter (USB history, browser and download history, webmail activity, wireless networks and recent-file lists). Alongside OSForensics we also use Passware Kit Forensic to open password-protected or encrypted files and BitLocker volumes, where doing so is lawful. Every step happens on a hardware write-blocked, hash-verified duplicate of the original, so the original is never altered and all parties can verify that the duplicate is identical.
Our forensic work mostly falls into four recurring types of case, and each has its own dedicated guide. Where an employee leaves with company documents on the way out, that is employee data theft. Where spouses go through solicitors in a matrimonial or divorce case, handled lawfully, that is matrimonial and divorce. Where there are disputes between shareholders or within a partnership over company records or access, that is partnership and shareholder disputes. Finally, where designs, source code or client lists are copied, that is intellectual-property theft. Whichever category you are dealing with, the process is identical: a write-blocked image, a documented timeline, and a report built to stand up as evidence.
What turns data recovery into forensics is the procedure behind every single action we take: every original is placed behind a write-blocker from first contact with us; every image created is verified using a cryptographic hash (MD5, SHA-1, SHA-256); custody documentation begins when the item passes from your possession into ours; and clear findings are separated from technical appendices within our reports so they will stand up in a court or tribunal. We would be happy to follow directions agreed between solicitors. In short, there is a firm limit on our service: there must be a lawful basis for it. Your own devices are acceptable. Company equipment, used under your company's policy, is also acceptable. Matters instructed through your solicitors and insurers are also acceptable. However, covert access to another person's private device is something we can never provide, regardless of how strong your suspicion may be; if there is a legitimate route, that is the one we will take.
Forensic work differs from ordinary data recovery because the results produced are evidence, so the tools used and the procedures employed are equally important:
The forensic analysis suite at the centre of our bench: deleted files recovered, the whole drive searched and indexed, and artefacts extracted from hundreds of file formats with OCR.
Timestamps, the USN change journal and system logs create a minute-by-minute timeline of system and file activity: what happened, and exactly when it happened.
All cases involving data theft rely on this information: which external storage devices were connected and at what times, and what was accessed while they were connected.
When permissible by law, password-protected files, encrypted archives and BitLocker volumes standing in the way of the evidence will be opened.
From first contact, each original is placed behind a write blocker and copied to a duplicate verified by hash (MD5, SHA-1, SHA-256), so anyone involved can confirm it is exact.
Custody is documented from the moment you pass it to us. Your report comes in two parts, plain-English findings and a technical appendix, written to stand up at a tribunal or court.
We clearly define the boundaries at the start: there must be a lawful basis for conducting forensic work, meaning your own devices, company property examined under company policy, or matters instructed through solicitors or insurers. Covert access to another person's private device is something we never provide.
The drive has to be removed from your computer before you post it, because we only work on the bare drive. If you are unsure how to remove it, call us on 0800 689 0668 for a quote before sending the drive, or a local PC repair shop will take it out for you for a small fee.
The device has to be left just as you found it: turned off, with no one logging on to it, viewing the information or re-imaging it. Each time someone does something on it, some of the information that could be used as evidence is erased. Write down the relevant dates and names. Before you do anything else, call us on 0800 689 0668 or use the free online diagnostic to get a quote. Then remove the hard drive from your machine and post it to us clearly labelled. We take the hard drive, not the entire computer, and the handover of custody from you to us is documented.
Before sending anything, get a quote from us either by telephone or using our free online diagnostic. Then post your hardware to us (tracked and insured), or drop it off at our Guildford laboratory in person.
Sending a drive from a computer, laptop, MacBook, iMac, CCTV/DVR or server? You will need to remove the internal hard drive or SSD and send us just the drive, as we are unable to remove the drive for you. We also cannot recover storage soldered onto a motherboard, such as in Apple Silicon Macs and some thin laptops. Only drives that can be removed from a machine and sent to us can be recovered. If you are unsure whether your device has a removable drive, please call us before sending. RAID, server and SAN drives need to be removed from their enclosure and labelled by bay. For a NAS, send the disks themselves if they are removable, otherwise the entire NAS device. An external single drive should come to us whole, along with its cable and power supply.
↓ Print the booking-in & shipping form (PDF)
Please mark the package for the attention of Guildford Data Recovery, and we will call you as soon as we have diagnosed your media.
Unsure as to how to proceed with sending the item in for recovery? Then simply call 0800 689 0668, or complete the free online diagnostic prior to dispatching the item to obtain your price quotation.
Free diagnostic, fixed quote, and in most cases you only pay if we recover your data. Start now or call the freephone.