Recovery built to be tested · exhibits, hashes and logs, London
Are these files recoverable? Normal recovery stops right there. But when the recovered files go to the courts, a tribunal or into a claim file, the next question appears along with it: where has this information been, and whose hands has it passed through? This is exactly why we use blockers and the two hash values, and also why the log is written down as the process runs. In one week, this workbench may be looking at a Shoreditch studio's project archive and a laptop taken out of a haulage office in Havering. The exact same questions will be asked. There is no cost to scoping, and a set amount of money is agreed upon in writing prior to any cable making contact with your evidence. A forensic instruction begins at £800 + VAT.
Talk it over with an engineer, in confidence
0203 0868633
| What is going on | What an examination shows | What is handed over |
|---|---|---|
| Files lost, whether intentionally or unintentionally | When they left (if they ever existed) and how much of them can be restored | The files (as well as the path that was utilised to acquire access to them), documented in writing |
| A disk wiped deliberately | The tool used, the date/time used, and what was avoided by said tool | Whatever the erase utility failed to remove, and where it is located on the disk |
| Locked volumes, such as a BitLocker volume | Whether Passware obtains access to the encryption key, if authorised to attempt | The volume opened, and the record shows the way in |
| An exhibit already failing | Slowly imaging a failing disk while maintaining a continuous chain of custody | The data returned, continuity whole |
| Disagreement over the order of events | Reading timestamps relative to system artefacts, with the limitations stated for those items | A timeline, every caveat marked |
Our forensic charges start at £800 + VAT. The amount charged depends upon the size of the task at hand, and that is determined in the course of our first telephone conversation: dates and events in dispute; machines and accounts involved; what needs to be demonstrated. There is no charge made for the initial telephone call. Furthermore, nothing that you would be billed for commences until a written fee quotation has been delivered to you.
There is only one entity touching your physical evidence (the blocker). On the other end of it, the entire disk is copied one sector at a time. Unless instructed otherwise, Expert Witness format is utilised (case details and checksums are stored in the file itself), and where plain dd is specifically requested, plain dd is provided.
One set of hash values is generated during the creation of the image file. Upon completion of creating the file, a second set of hash values is retrieved from the completed file. Matching values indicate that the source and the copy contain identical content. It is not an opinion but a calculation that can be repeated by anyone.
All activity related to the image occurs on the image: deleted data, damaged data, encrypted data, with the log running throughout. Passware will be directed at the duplicate copy, and only when authorisation has been granted and a legitimate encryption key or password can be obtained.
Hand the opposite side a finding they have no way to verify, and the argument is theirs. So the bundle contains everything: each exhibit numbered, the hash values for each, dated and countersigned handovers, the images used for the conclusions reached, and the bench notes created whilst the work was ongoing. Repeat the steps and the result does not change.
Where your instruction sits against the Code: the statutory Code set by the Regulator has remained at version 2 since 2 October 2025. This is a criminal regime: investigating crimes in England and Wales, and providing evidence to be used in a criminal trial. DIG 100, data taken from digital storage, is one of the types of activity it lists under this regime, and ISO/IEC 17025 is the applicable standard for it. We don't hold anything like that here. If the instruction derives from a civil claim, an employment dispute or a policy claim, then this regime will never apply to the instruction. Nothing on the bench changes between those two scenarios, but your declaration does, and you will be aware which type of declaration yours takes prior to a single step being made.
A company laptop was due to be returned the next morning, and the employee who was working their notice placed a wipe tool on it during the evening. One thing that the tool did not tell anyone was that it created a log. That log survived into the image, locked the run to a fifteen-minute window, and showed which files were targeted by the wipe tool.
There are four things to determine, and they decide everything: has the physical material changed? Was anyone who touched it competent to do so? Is the path from the physical evidence to your conclusion transparent to a stranger? Does the physical evidence address your case at all? In order for assertions to be proven in relation to the first three, you need very little, i.e. a blocker placed during acquisition, two identical hash values and records taken during the process itself.
Reads pass through it; writes won't make it past the blocker. Saying an item wasn't touched during an examination is easy to say, but proving it is something else again, and the blocker is just that barrier between saying and showing.
Sometimes. Two things have to be true at the same time. The person who had the authority to allow an examination must actually have allowed the examination. There must also be some type of access (key/password) available. Passware works against the copy of the exhibit and never directly against the exhibit itself. Each and every effort made by Passware will appear on the log of all activity performed, as it happens. If no key or password is found, encryption has done exactly what it was designed to do, and in most cases you only pay if we recover your data.
The same general tasks, the same equipment on the same bench. What makes it different is the framework surrounding the tasks. A forensic analyst places a blocker in front of the original exhibit, proves both hash values again, maintains a complete and unbroken exhibit record, and writes notes down throughout the examination. These four elements keep conclusions stable when the examiner on the other side begins to apply pressure to them.
Regardless of what contains the evidence, turn off electrical power to it before doing anything else: a recorder still operating overwrites its oldest evidence every hour. Once power is removed, secure a price quotation (either by phone or through submitting a form), then post us just the disk or drive (do not include the recorder or computer), or drop it off at our Guildford intake lab, Monday to Friday, 9am to 5:30pm (no appointment needed). Evaluation costs nothing; work on recorders costs £400 + VAT and forensic analysis starts at £800 + VAT, both prices agreed to in writing beforehand. What sits on that disk stays here.