Recovery built to be tested · exhibits, hashes and logs, London
Can the files be got back? Ordinary recovery ends there. Take the answer into a court, a tribunal or a claim file and a second question arrives with it: where has this material been, and whose hands have been on it. That is what the blocker is for, and the two hash values, and the log written as the job goes. In one week this bench may see a Shoreditch studio's project archive and a laptop out of a Havering haulage office; the questions put to each are the same. Scoping costs nothing, and a fixed figure is put in writing before any cable touches the exhibit. Forensic instructions begin at £800 + VAT.
Talk it over with an engineer, in confidence
0203 0868633
| What is going on | What an examination shows | What is handed over |
|---|---|---|
| Files gone, whether by mistake or design | Whether they were ever there at all, the moment they left, and how much of them returns | The files, plus the method that reached them, in writing |
| A disk wiped deliberately | The tool that ran, the hour it ran, and what it left alone | Whatever the wipe did not reach, and its position on the disk |
| A BitLocker volume, or another locked one | Whether Passware reaches the key, once examination is authorised | The volume open, and the way in on the record |
| An exhibit already failing | Slow, patient imaging of a dying disk, continuity unbroken | The data returned, continuity whole |
| An argument about the order of events | Timestamps read beside system artefacts, with the limits stated | A timeline, every caveat marked |
Forensic instructions start at £800 + VAT, and where a particular job lands within that depends on scope — which is what the first conversation is for: the dates and events in dispute, the machines and accounts in play, and what has to be shown. That conversation is not charged for, and no work that costs you anything begins before the written figure reaches you.
The blocker is the only thing that touches the exhibit. Behind it, the whole disk is duplicated a sector at a time. Expert Witness format is used unless an instruction says otherwise — case details and checksums then live in the file itself — and where plain dd is asked for, plain dd is produced.
One pair of values is produced during the write; a second pair is read back off the closed file. Agreement between the pairs means source and copy are the same thing. It is a sum, not an opinion, and anyone may repeat it.
Everything after the image happens on the image: deleted material, damaged material, encrypted material, with the log running the whole time. Passware is pointed at the copy, and only where an examination has been authorised and a key or a password can genuinely be reached.
Hand the other side a finding they have no way of testing and the argument is theirs. So the bundle carries the lot: every exhibit numbered, every hash, handovers dated and countersigned, the image behind each conclusion, and the notes written up at the bench while the work went on. Repeat the steps and the result does not move.
Where your instruction sits against the Code: the Regulator's statutory Code has been at version 2 since 2 October 2025. Its reach is criminal: investigation in England and Wales, and evidence going before a criminal court. DIG 100 — data captured from digital storage — is one of the activities it lists, ISO/IEC 17025 is the standard attached to it, and nothing of the kind is held here. Where the instruction grows out of a civil claim, an employment dispute or a policy claim, the regime does not apply to it at all. Nothing on the bench alters between those two cases. The declaration does — and you know which one yours takes before a single step is made.
A company laptop was due back the next morning, and the employee working out notice put a wiping tool over it that evening. What the tool did not advertise was that it kept a log. That log survived into the image, fixed the run to a fifteen-minute window, and listed each file it had been aimed at.
Four tests, and they decide everything. Has the material altered? Was whoever handled it competent to? Is the route from exhibit to conclusion one a stranger could follow? Does the material touch the issue at all? For the first three, what turns assertion into proof is small and specific: a blocker at the moment of acquisition, two agreeing hash values, and notes made while the job is under way.
Reads go through it; writes stop in its circuitry. Claiming an exhibit was untouched is one thing; being able to demonstrate it is another, and the blocker is what stands between the two.
Sometimes. Two things have to be true together. Somebody with the right to permit an examination must actually permit it. And a key or a password must be within reach. Passware runs against the copy, never against the exhibit itself, and every attempt goes on the log while it happens. If no key turns up, encryption has done what it was built to do — and you learn that before you have paid for anything.
Broadly the same job, on the same bench. It is the scaffolding around it that changes. Forensic work sets a blocker ahead of the exhibit, reproves both hash values, keeps an exhibit record without holes, and puts the notes down as the job goes. Those four are what hold a conclusion steady once the examiner opposite starts leaning on it.
Whatever holds the evidence, take it off power before anything else — a recorder that is still running overwrites its own oldest material, hour by hour. Send it to us after that. Looking costs nothing; recorder work is £400 + VAT and forensic instructions start at £800 + VAT, both settled in writing beforehand. What sits on that disk stays here.