Recovery that stands as evidence · exhibits and logs, Nottingham
Can the files be got back? That is the whole of ordinary recovery. But put the answer before a judge, a tribunal or an adjuster and a second question walks in behind it: where did this material come from, and who has done what to it since. The blocker answers that, so do the two hash values, and so does the log kept while the work is under way. Same bench and the same free scoping call, with the figure agreed in writing before any cable is connected. £800 + VAT is where forensic instructions begin.
An engineer will talk it through, in confidence
0115 8220606
| What is happening | What the examination turns up | What we hand back |
|---|---|---|
| Files gone — by accident, or deliberately | Whether they existed at all, the moment they went, and how much comes back | The files, and the method that reached them, in writing |
| A disk somebody wiped on purpose | Which tool ran, at what hour, and what it never got to | Whatever survived the wipe, and whereabouts on the disk it sat |
| A BitLocker volume, or another encrypted one | Whether Passware can get at the key, once examination is authorised | The volume opened, and the route in on the record |
| An exhibit already going wrong | Slow, careful imaging of a dying disk, continuity held throughout | The data back, and continuity intact |
| A dispute over the order of events | Timestamps set beside system artefacts, and the limits spelled out | A timeline, each caveat marked on it |
Forensic instructions begin at £800 + VAT, and where yours sits depends on scope — which is exactly what the first call settles: the events and dates at issue, the machines and accounts involved, and what precisely has to be proved. That call is free, and nothing chargeable starts before the figure is with you in writing.
Nothing touches the exhibit except the blocker. Behind it, a full duplicate is written out one sector at a time. The container is E01 unless an instruction asks otherwise, since case details and checksums then ride inside the file; where raw dd is wanted, raw dd is made.
Both values are computed as the image is written, and computed a second time from the file once it has closed. Where the two pairs agree, source and duplicate are identical. That is arithmetic. It does not depend on anyone's word.
Deleted material, damaged material and encrypted material are all worked inside the image, and the log runs the whole time. Passware goes at the copy — but only where the examination is authorised and there is a key or password genuinely to be had.
Give the other side a finding they cannot check for themselves and you have given them an argument. So the bundle carries all of it: exhibit numbers, hashes, dated handovers signed at both ends, which image every conclusion came off, and the notes typed at the bench as the job ran. Run the same steps again and the answer is the same.
Which side of the Code does your instruction sit on: the Regulator's statutory Code reached version 2 on 2 October 2025. It applies to criminal work in England and Wales: investigation, and evidence placed before a criminal court. Among the activities it names is the capture of data from digital storage; ISO/IEC 17025 is the standard set for that activity; and this laboratory does not hold it. An instruction that arises out of a civil claim, an employment matter or a claim on a policy falls outside the regime completely. Nothing about the bench work changes across that line. What changes is the declaration — and you know which applies before anything begins.
On the evening before a company laptop went back, an employee working out notice ran a wiping tool over it. Logs of its own were something that tool had been keeping. They came through into the image, fixed the fifteen minutes during which it had run, and named each file it was pointed at.
Four questions decide it. Is the material as it was? Was the work done by hands competent to do it? Can an outsider follow the line running from exhibit through to finding? And does any of it bear on the dispute? Proof rather than assertion on the first three comes from three things: the blocker fitted at acquisition, hash values that agree, and notes made while the job is happening.
Reads pass; writes are stopped inside its circuitry. Saying an exhibit was untouched is one thing, and being able to demonstrate it is another — the blocker is what separates them.
Sometimes. Two conditions have to hold together. The first is that somebody may lawfully authorise an examination of the device. The second is a key or a password that can actually be got at. Passware does that part on the copy, never on the exhibit, and its attempt goes onto the log as it runs. Where nothing leads to a key, encryption has done what it was for — and you hear that before any money has been spent.
Largely the same work, at the same bench. Everything that comes afterwards is what differs. Forensic jobs put a blocker ahead of the exhibit, prove both hash values twice, keep an exhibit record with no gaps in it, and write the notes as things happen. Those four are what hold a finding upright when the examiner opposite starts pressing on it.
Cut the power to the DVR before anything else — while it runs it keeps writing, and the oldest footage goes first. Then post it in. The first look is free, CCTV and DVR work is £400 + VAT quoted in writing before anything starts, and what is on that disk goes no further than the bench.