The laptop returned clean, the former employee began new employment at a competitor last Monday & the business needs to know exactly what occurred prior to the wipe. Forensic recovery is data recovery which must survive cross-examination, handled for solicitors and companies in Swansea along with paperwork to support.
Diagnostic free of charge on every forensic job. One fixed quote provided in writing prior to commencement of any work.
Forensic work is paid upfront once you accept the fixed quote. On our other services, in most cases you only pay if we recover your data. This is true of all of them except for failure of electrical/mechanical components, chip level repairs, DVRs and forensic analysis. Our full price list can be seen at the cost of data recovery page.
Each and every forensic job begins by relating the symptoms to the fault; these fifteen cover virtually everything which arrives at the bench.
The most common instruction we are given, and usually both the wipe itself as well as what led up to the wipe can be put back together.
Serial numbers of devices connected to Windows computers are recorded along with time stamps of when they were connected. These two items are then cross referenced with the files accessed on the computer. The picture begins to form.
Any uploads to a personal Gmail account or Dropbox accounts will have history, logs and other residual evidence remaining after upload is completed. A similar situation exists when using WeTransfer.
A bulk deletion case typically includes deleted documents, emails etc. that are carved out (i.e. pulled) and presented in a manner that provides a hash verified defensible format.
When each file was really created, read or modified: reconstructed from file system records, the USN journal, and event logs.
Identifying which confidential materials were taken, when they left, and by what account.
Investigations into company equipment according to company policies; frequently at the joint direction of solicitors.
Forensically recovered footage and files to support claims and proceedings.
Impartial and recorded conclusions to facilitate both internal actions/investigations and communications with insurers and tribunals.
Carried out precisely as per the joint directions of both parties' solicitors.
CCleaner and BleachBit (among others) also leave behind records of the activities they performed on the computer including what was run, when it was run and what remained after the program had finished cleaning.
Files synced to OneDrive or Google Drive using a personal account will be seen as artefacts of file transfer.
$I metadata remains even after the recycle bin has been emptied and will provide a specific date for when something was deleted. This provides a small, yet decisive piece of information regarding timeline.
Spool files and print logs (and even printer usage) will show you if someone took printed copies out of the office. Even a USB log wouldn't show this.
Although we do not look at phones themselves, if they have been backed up or synchronised with computers which are within the scope of our forensic investigation, then those backup files and synchronisation folder(s) are fully included as well.
At employers everywhere there is a pattern that repeats during the final two weeks prior to the return of laptops: company files are moved to a USB drive, a personal email inbox, or to a cloud-based storage solution; and finally a wipe utility (or factory reset) is used to delete everything on the laptop. The laptop appears "clean" after this process has been completed. But in reality there will still remain traces of the original data being erased. These include information such as the wipe software or utility that was run and at what minute it was run, what USB serial numbers were plugged into the computer during the last weeks of use, what had been opened in the last few minutes before each one was plugged in, what outgoing emails were sent using webmail, and which deleted documents can still be recovered whole by carving them directly from the hard disk. Each of these items will be included within a plain English report along with the technical evidence supporting it.
There are four major areas in which nearly everything we are instructed on will fit, and all four have their own separate guides: employee data theft, when a leaving employee's data copying needs to be proved; divorce and matrimonial investigations, these are always run legally through the solicitors involved; partnership and director disputes over disputed company documents and system access; and lastly theft of intellectual property: the designs, source codes, and customer lists that were taken. Underneath all four is one constant process: write blocked images, a reconstructed timeline, evidence that stands.
The investigation bench integrates OSForensics, PassMark's suite of tools to recover deleted files, index entire drives, create timelines based on the USN journal and extract artefacts such as USB history, browser & download records, webmail traces, recent file lists etc., with Passware Kit Forensic, which lawfully unlocks password protected files and BitLocker volumes restricting access. No work is performed directly against your source media. All analysis is done off a write blocked, hash verified image that opposing experts may also verify independently.
The procedure is the product: write blockers at first contact to preserve integrity; MD5, SHA-1 & SHA-256 verification, an unbroken documented chain of custody and reports separated into findings and technical appendix so tribunals can rely on them. We take joint instructions agreed between solicitors. One bright line: there must be a lawful basis (your own equipment, company machines under company policy or matters routed through solicitors and insurers). Covert examination of another person's private device is refused every time regardless of how compelling the story may be.
The forensic process is to extract evidence. It is not just about producing data, as such both the tools used in the process and the procedure itself need to be given equal weight:
PassMark's forensic tool will manage all of our investigations: it can recover deleted files, search through every sector on the drive and index them for searching, pull out artefacts from hundreds of different file types including OCR.
The timestamps, the USN change journal and the log files on the machine are all merged to create a minute-by-minute record of what occurred with respect to timing (i.e. when something happened). This allows an investigator to determine what occurred and exactly when it did.
Devices that connected (and when) and what was viewed/accessed around each connection is the foundation for any data theft investigation.
Password protected files or encrypted BitLocker volumes that block our path to evidence will be accessed if we have legal authority to do so.
The originals are immediately placed in a write blocker, then copied to an identical file that is hashed (MD5, SHA-1, SHA-256): it's verifiably correct for anyone checking.
There is no break in chain of custody of these items from you to us. The reports are provided in both readable form upfront and as a technical appendix behind them, an arrangement that tribunals can rely upon.
The first rule prior to issuing an instruction is that there has to be a lawful basis: either personal equipment owned by you (hardware), business equipment examined in accordance with company policy, or a matter that has been passed on through lawyers/solicitors or insurance companies. Covert access to another person's private device will never occur, without exception. All forensic services require payment upon receipt of a quote prior to commencement of service.
You get a quote first; then you have to pull the drive out of your PC before sending it to us. Not sure? Call us on 0800 689 0668 or visit a local PC repair shop that can do this job for a small fee.
Now treat the device as an exhibit. Turn it off immediately. Let no one access the device by logging in (or) having a "quick look" at the data, or re-imaging it. Each of these will destroy recoverable forensic evidence. Write down the important people and dates. Remove and label the drive, then after obtaining your quote send us just the hard drive; we do not require the machine. If you are unsure about safely removing the drive to avoid contaminating the evidence, call 0800 689 0668 and we can guide you through proper documented chain-of-custody procedures to handle the drive.
First get a quote over the telephone or use our free on-line diagnostic. The majority of customers then have their media sent to us via post, this is tracked and insured.
Do you want to send a drive from your computer, laptop, MacBook, iMac, CCTV / DVR or server? Please do not send the complete unit of computer or device with a hard disk drive (HDD) or solid state drive (SSD) inside. Please remove it and only send the drive itself. For a server, please remove all disks and label them by their bay. We will also not perform removal of internal drives from devices in order to access data. Also, we will not extract data from devices where storage is soldered onto the motherboard (such as T2 and Apple Silicon Macs and some thin laptops). Additionally, we do not recover data from phones and tablets, only drives that can be removed and sent to us. If you're not sure which kind you have, ring us first.
↓ Print the booking-in & shipping form (PDF)
Clearly mark the parcel with the name Bristol Data Recovery, and when your media has been diagnosed we will call you immediately.
If unsure about what to post, please call us first on 0800 689 0668 (the free phone number), or complete a free online diagnostic.
Diagnostic provided at no charge. Fixed quote, and as this is forensic-class work it is paid upfront. Start now or call the freephone.