Recovery that stands as evidence · exhibits and logs, Nottingham
Are the files recoverable? That is the core of standard recovery. However, when you present this as proof to a judge, a tribunal or an insurance adjuster, another question comes along behind the first: where did this data come from, and who has done what to it since. The blocker answers that, as do the two hash values, and so does the log kept during each step of the work. The same bench, the same free scoping call, with the figure agreed in writing before any cable is connected. The price at which forensic work begins is £800 + VAT.
An engineer will talk it through with you, in confidence
0115 8220606
| What is happening | What the examination turns up | What we hand back |
|---|---|---|
| Files gone — by accident, or deliberately | Whether they existed at all, when they disappeared, and how much comes back | The files, and the method that reached them, in writing |
| A disk somebody wiped on purpose | Which tool ran, at what time, and what it never got to | What survived the wipe, and where on the disk it was located |
| A BitLocker volume, or another encrypted one | Whether Passware can find the key, once examination is authorised | The volume opened, and the route in on the record |
| An exhibit already going wrong | Slow, careful imaging of a failing hard drive, continuity preserved throughout | The data back, and continuity intact |
| A dispute over the order of events | Timestamps set against system artefacts, and the limits of each spelled out | A timeline, each caveat marked on it |
Forensic costs start at £800 + VAT depending on the scope of the job, as identified on your first call to us: what time frame and specific dates are in dispute? What equipment or accounts are involved? What evidence is needed? Your first call to us is free. Nothing is charged until you have our quote in writing.
Only the blocker touches the exhibit, while a complete replica is created behind it, one sector at a time. The default container is E01 unless instructions say otherwise, since case information and checksums are embedded within the file. If raw dd is wanted, raw dd is made.
Both values are calculated while the image is created, and again once the file has been completed and closed. When both sets match, source and duplicate are exact copies: that's mathematics. It doesn't rely on anyone's word.
Deleted data, damaged data and encrypted data are all processed inside the image, and a log is kept throughout. Passware works on the image, but only where the examination is authorised and there is actually a key or password to be had.
If you give another party a result they can't verify themselves, then you have given them grounds for argument. So the bundle contains all the information: exhibit numbers, hash values, dated handovers (signed at both ends), the image each conclusion came from, and the notes taken while working at the bench. Run it again and you get the same answer.
Which side of the Code does your instruction sit on: the Regulator's statutory Code reached version 2 on 2 October 2025 and applies to criminal work within England and Wales: investigation, and evidence presented before a criminal court. Data capture from digital storage is listed among the activities it covers, ISO/IEC 17025 is the standard set for that activity, and this laboratory does not hold that accreditation. Instructions arising from civil claims, employment matters or policy claims fall entirely outside the regime. Nothing about the bench work changes across this line. What changes is the declaration, and you know which applies before anything begins.
On the evening before returning a company laptop, an employee working out their notice used a wiping tool on it. As part of its function, the wiping tool logged what it did while running. Those logs came through into the image, fixed the fifteen minutes the tool had run, and identified every file it targeted.
Four questions decide it. Did the material remain unchanged? Were those doing the bench work competent to do it? Can an outsider trace the line from exhibit through to findings? And does any of it relate to the dispute? Proof rather than assertion on the first three comes from three things: the blocker fitted at acquisition, hash values that agree, and notes made at the time of the work.
Reads pass; writes are stopped inside its circuitry. Saying an exhibit was untouched is one thing, and being able to demonstrate it is another: the blocker is what separates them.
Sometimes. Two requirements have to be met together. One, someone must be legally entitled to authorise an examination of the device. Two, there must be a key or password that can actually be got at. Passware does this on the duplicate, never the original, and its attempts appear in the log while it runs. Where there is no path to a key, encryption has done what it was designed for, and you would know that before spending a penny.
It is mostly the same work, on the same bench. The differences are in everything that comes after. On forensic jobs we put a blocker in front of the exhibit from the beginning, validate both hash values twice, keep a continuous record of everything to do with the exhibit, and write up notes as things happen. Those four are what hold a finding up when the opposing examiner challenges it.
Remove power from the DVR before you do anything else: as long as it is powered, it keeps writing, and the oldest footage goes first. Then get a quote and post the disk in. The first look is free. CCTV and DVR work is £400 + VAT, quoted in writing before any work starts, and anything recovered from the disk goes no further than our bench.