Evidence work · forensic recovery, Hull
Ordinary recovery answers one question: can the files be got back. Once a judge, a tribunal or an insurer is going to read the result, a second question arrives — can you show where those files came from, and what has happened to them since. The blocker, the pair of hashes and the running log answer that one.
Ring us, in confidence
0800 6890668
| What you see | What the material shows | What we hand over |
|---|---|---|
| Files gone, by accident or on purpose | Whether they were ever there, when they went, and how much can be got back | The files, plus a written account of the method |
| A disk that has been wiped on purpose | The tool that ran, the time, and what it failed to erase | Whatever survived the wipe, and where it sits |
| BitLocker, or some other encrypted volume | Whether Passware can reach the key, given authority to examine it | The volume open, and the route in documented |
| An exhibit which is itself a dying drive | Slow, careful imaging of a dying disk with continuity kept intact | The data back, continuity intact |
| An argument about what happened when | Timestamps and system artefacts read side by side, limits stated | A timeline, with every caveat set out on it |
It begins with a conversation in confidence, and there is no charge for it. Three answers shape the rest: what happened, how far it reaches — the machines, the accounts — and what the evidence has to prove. Between them they fix the scope. The scope fixes the one written price, and you have that before any device is touched.
The only thing the exhibit is connected to is a hardware blocker. Off it comes a complete duplicate, sector by sector. E01 is the default, since the case details and checksums live inside the file itself; raw dd if you ask for it.
MD5 and SHA-256 are computed while the image is being made, then computed again off the finished image. Matching pairs mean the copy is identical to what it came from. That is arithmetic. Nobody has to take our word for it.
Deleted, damaged and encrypted material is worked on inside the image, with the log running throughout. Where there is authority to open a locked volume and a key or password is genuinely within reach, Passware is pointed at it.
A report nobody can test is worth little. So the bundle carries the working with it: every exhibit, the images it was read from, a log of each handover, the hash of everything, and what was written down at the time. The other side's expert can repeat it and land where we did.
Where the Regulator's Code bites: the Forensic Science Regulator's statutory Code, in its second version, became enforceable on 2 October 2025. It reaches criminal work in England and Wales — investigations, and cases before the criminal courts. Device forensics is named in it, the standard set is ISO/IEC 17025, and we do not hold it. Work arising from a civil dispute, an employment matter or an insurance loss sits outside that regime altogether. The method here does not change from one side of that line to the other, and we will tell you which side yours is on.
The night before the laptop was handed back, an outgoing employee ran a wiping tool across it. The tool wrote logs of its own, and those came through in the image — pinning the fifteen minutes it was running and listing every file it had been aimed at.
Four questions. Has the material been altered? Was whoever handled it competent? Can a stranger follow the path from exhibit to finding? Does any of it bear on the issue? Imaging behind a blocker, hashes matched at both ends and notes written as the work goes show the first three instead of claiming them.
It lets reads through and cuts writes off in the hardware itself. The difference matters: one way you tell a court the exhibit was never written to, the other way you show it.
Sometimes. You need lawful authority to have the device examined, and a key or password has to be within reach. Passware does that job, aimed at the copy and never at the exhibit itself, with the attempt logged as it runs. If no route to a key exists, the encryption has won, and we say so before you spend anything.
Most of the bench work is the same either way. What changes is what the result has to stand up to afterwards. A forensic job puts a blocker in front of the exhibit, proves the hashes at each end, keeps an exhibit record with no gaps, and takes notes as things happen — the parts that keep a finding steady when the other examiner leans on it.
Imaged once, as found, it keeps every option open; run and retried, it loses them. Do it before anything else touches the disk. Log a job. The first look costs nothing, and what you tell us stays private.