Forensic data recovery (also referred to as "data forensics") is recovery of data to an evidentiary standard. How you recover data matters just as much as what you recover. All steps of forensic data recovery are documented; the original is never modified; and all results are prepared with the intent of withstanding scrutiny. We provide in-house services to clients requiring confidential digital evidence handling for use in various legal, HR, insurance and dispute resolutions.
When someone browses through a device simply to “take a look,” they alter the device. Timestamps are changed; files are accessed/opened; and consequently the evidentiary value of the device decreases significantly. Therefore if there is any potentiality for data to be used as evidence, stop using the device, do not allow anyone else to view the device, document who has viewed/accessed the device, and then submit the device to us so that a forensically sound copy can be made prior to performing any analysis.
When data has to be recovered and then provided in a manner acceptable to law courts or other legal proceedings, forensic recovery is required. These are the situations we are typically called in for.
We review all types of computer based and storage media to obtain the evidence required to support a case.
Computer & laptop hard drives; server & NAS storage devices; external drives; memory cards; solid state drives (SSD); & USB devices.
Our forensic process works as a defendable chain of custody once your item reaches us. Once received we document the state of your item, create a write-blocked forensically captured image of your item, use this single image for all forensic examination purposes, and document each stage of the forensic process. If required these documented findings would be able to withstand scrutiny, including within the courts should such action be taken.
The device, along with all conditions and individuals that have handled the device since it arrived at our facility, are logged in detail to document and support any handling of the device.
We take a digital (forensic) image of your device utilising write blockers. This ensures no changes are made to the original, and we then use a hash to ensure the image created is identical to the original.
Analysis and recovery occur entirely within the verified forensic image itself, so no changes are made to the original device which remains intact and can be used as evidence.
We are able to recover deleted files, records and file pieces from your device. We will also examine "unallocated" areas of the device to see if we can recover items that were meant to be removed forever.
We will identify the parts of the data that have relevance (files, time last accessed, etc.) and then we will create a timeline based on those pieces of data.
We will provide a straightforward factual account of our findings and how they were made; this report should be easily understandable for someone without technical knowledge and should stand up to scrutiny and/or potential court challenges.
The findings, the preserved original item(s), and the report will be returned along with any explanation required in the event of any additional proceedings.
Regardless of whether you're looking at computers/drives, USB devices, servers or any other type of digital device, we will recover and examine your digital evidence; we will document each piece of evidence (write-blocked, hashed); and we will present all of your findings according to the standards required by the courts in Northern Ireland.
Please provide an explanation of how things went wrong and one of our engineers will contact you, usually by the end of the next working day.
We will get back to you soon. If it is urgent, call 028 9002 0144.
The process always starts with an initial free, confidential consultation; this is followed by a written, fixed price quotation. Our basic forensic recovery services are priced at a flat £800 + VAT; the total fee paid for our services will be influenced by the number of devices included in the original problem statement, the scope of the project, and whether you require additional services such as reporting or expert testimony.
Examples of forensic recovery cases: general case types and outcomes, with all client and party information kept strictly confidential.
In this example, we recovered deleted files from a write blocked image and provided documentation as well as a chain of custody to the client's lawyer.
The analysis of the device identified which files were transferred to an external storage device and when they were moved; all of this information is contained within a report capable of being used as part of legal proceedings.
We have recreated and detailed all activity on the computer, and the timeline of events, and presented this factual account to the court.
Testimonials from solicitors, companies and individuals who used our services to recover forensic data.
Don't worry, there are no fake reviews here! As soon as we get a new verified, named review from one of our clients based in Belfast, we'll add it to this page. Until then, please don't hesitate to give us a call and speak directly with an engineer at 028 9002 0144 for any further information regarding your specific issue.
Send or drop off your item for a free diagnostic check with a description of the issue. One of our engineers will review the item, then provide you a written quote prior to doing any repairs.
Prior to sending or dropping off your device for a diagnostic test (free), obtain a quotation from us via telephone or using the provided form. Step one: get the device to our Belfast bench. Carefully wrap the device and include your contact information inside the parcel. Then send it over. There is no charge for this diagnostic service. Once we receive it, you will be given a firm written price to confirm whether you wish to go ahead, before any work is done.
Sending it? The use of a tracked, insured delivery method would be recommended. Alternatively, dropping it off can also be done Monday to Friday, 9am–5:30pm; no prior booking required but do ensure that all items are packed accordingly.
Still waiting to send something? Please complete the form describing the failure/fault in your own words and one of our engineers will get back to you with a quotation based upon your individual circumstances.
We will get back to you soon. If it is urgent, call 028 9002 0144.
Commonly-asked questions regarding forensic data recovery.
Although recovery techniques are similar in both cases, forensic recovery is conducted with a different goal in mind; namely an evidence-based process that includes documenting each step of the process (chain-of-custody), write-blocked imaging (to ensure no alteration of the original source media occurs), hashing of images created during the process, and reporting on all findings and methodology. In other words, the recovered items were obtained in a way that ensures their reliability, not merely availability.
The whole point is that you do it in a way that will be able to stand up to being challenged. With this approach, everything is preserved as the original; we work only from an image that has been confirmed to be accurate; we record everything that we do (in case anyone challenges what we did or how we got the evidence) and we present our conclusions based upon the same standards used in all courts in Northern Ireland.
The record documents who had possession of the device at what time, as well as all actions taken against the device. This is important because in order to prove that the evidence has not been altered, it is necessary to show a clear chain of custody from the time of the seizure until the time the data is analysed.
Forensic examination may provide additional information beyond simply identifying active files on a computer system. Deleted files may still exist on the hard drive. Files may have been copied to a portable media device or placed into a cloud service. Access timestamps created by operating systems may assist in building a chronological timeline of activity related to files accessed via the computer system. What can be recovered depends on the device and how it was used, which we'll assess at the outset.
All clients receive confidential treatment. All parties and case details remain completely anonymous and will never be referenced in any published example. We are listed with the Information Commissioner's Office (ICO), Reg. No.: ZC173784, and operate under those guidelines.
Our consultation service is complimentary and confidential, and basic forensic work is charged at a fixed price of £800 + VAT. All costs beyond that will depend on how many devices are involved and how extensive the requirements are, as well as whether you require a formal report or an expert witness. This will be clearly outlined in writing prior to starting any work.
First contact us at 028 9002 0144 or visit our Belfast office to speak about this project privately. In the meantime, make sure to not touch the disk or have anyone else look at it, just leave it alone. Document everyone that has touched the disk because once we get our hands on the disk we will create an image of it that is defensible and will not alter what is on the disk.
We create an image of the disk using a write-blocker to ensure that no information is altered on the original disk. Next, we will hash the image so that if anyone were to edit anything or add/modify existing content on the disk that hash would show it has been tampered with. Once that is complete, we will begin analysing the image which includes all live files, deleted data from unallocated space & timestamps/user activity when required by the case. Every step is logged on a chain of custody document and all findings are documented as evidence that can be used in court proceedings.
Recovery of the data is performed to evidentiary standards (write-blocked, documented & ready for the courts in Northern Ireland). Do not open the disk drive, stop using it immediately and give us a call for a free, private consultation to discuss your options.