Evidence work · forensic recovery, Hull
Ordinary recovery answers just one thing: can we recover the data? Once a judge, tribunal or insurer is to review the outcome, another question arises: can you demonstrate where these files originated and how they have been treated since. This is exactly where the blocker, hashes & running log will answer that question.
Ring us, in confidence
0800 6890668
| What you see | What the material shows | What we hand over |
|---|---|---|
| The files have gone (either intentionally or unintentionally) | Did they ever exist? When did they leave? What can we recover? | Both the data & written documentation describing how it was achieved. |
| Disk which was purposely wiped clean | Tool used / time / items not erased | Items remaining after being wiped and their location(s). |
| Volume protected using BitLocker, or other encrypted volume. | Is Passware able to access the key to encrypted volumes, assuming authority to examine it exists? | Decoded volumes available; pathway documented |
| Exhibit, itself a dying hard drive | Forensic image creation (slow, careful), continuity kept intact | Data extracted from original media, continuity intact |
| What happened when? | Side-by-side comparison of timestamps & system artefacts, limitations acknowledged | Timeline: all limitations acknowledged |
This commences with a confidential discussion, and there is no cost involved. These three elements will define the remainder of our work together: What happened? How extensive is this issue (machines, accounts etc.)? And what does the data/evidence need to prove? Together these three factors establish the scope. The scope defines the fixed fee. You have this fixed fee in writing prior to any equipment being examined.
This exhibit can be attached to nothing but a hardware write blocker. A full copy of the evidence is taken from it (sector by sector), and the default format used will be E01 since case information & checksums exist within the file itself. Raw dd may also be requested.
MD5 and SHA-256 are calculated during the image acquisition process, and once again upon completion of the image. If both values match then the copy of the evidence is identical to the source. This is simply basic mathematics. No one needs to trust us on this point.
Evidence that was deleted/damaged/encrypted is processed within the image itself, with the log kept running throughout. When authority exists to unlock an encrypted volume and an actual key/password is within reach, Passware is utilised against it.
Reports that cannot be tested will be worth little. Therefore, the bundle includes all of the work: exhibits, images, logs of handovers, hashes of everything and notes taken at the time. A third party (the opposing side's expert) can simply repeat our process and reach the same point we reached.
Where the Forensic Science Regulator's Code bites: The second edition of the Forensic Science Regulator's statutory Code for forensic science providers came into force on 2 October 2025. This applies to criminal investigations (and all other cases brought before criminal courts) in England & Wales. Device forensic services are identified in this code as being required to operate under ISO/IEC 17025 standards. We do not hold this accreditation. All other forms of forensic examinations (e.g., those involving civil disputes, employment issues or insurance losses) fall outside of this regulatory framework entirely. We will determine whether your case falls inside of the regulatory boundaries. Regardless of where your case falls, our methods remain unchanged.
Before returning the laptop, an employee who was leaving ran a wipe tool over it during the night. The tool logged its own activity which appeared in the image, showing that it had been running for fifteen minutes and listing every file it had targeted.
Four questions. Has the material been altered? Were the people handling it competent enough? Can someone else follow the path from exhibit to finding? Does any of the material matter to the issue? Imaging behind a blocker and hashes matched at both ends, along with notes taken while working, show the first three instead of claiming them.
This allows data to be read from the media and prevents new information being written to the media, in the hardware itself. This is important because with one method you can only tell a court the media was never written to, while with the second method you can demonstrate it.
Sometimes. There needs to be some form of legal authorisation to access the device, and the decryption key/password must be within reach. Passware performs this task on the copy, never on the original data. It logs all attempts made to access a decryption key during its operation. If no viable path to decrypting a file exists, then the file remains encrypted, and we indicate this before you spend anything.
In general terms, most of the hands-on processes involved in both methods will follow similar protocols. The primary distinction lies in how the results may need to withstand scrutiny by opposing counsel post-forensic examination. Forensics puts a 'blocker' in front of the media, documents the hash values at each end of the imaging, generates a complete exhibit record (with no gaps), and maintains detailed notes throughout the process. These factors help provide stability to a conclusion when another examiner challenges it.
Once an image has been created by capturing it as-found, it maintains flexibility in regards to options available. Once run and retried, it does not maintain such flexibility. Have the disk imaged prior to taking any action on it. Log a job. The first look costs nothing and information shared with us will remain confidential.