Every file has two histories: one for its life and one for how it died. Usually both can be recovered. From recycle-bin records to journal entries and shadow copies, we establish what existed on a machine, how it was used, and exactly when (and by what means) it was deleted. For York employers, solicitors and private clients with a deletion in dispute.
◇ Speed after method. The free assessment and a written scope of works come first. Forensic fees are paid upfront in full once you accept the fixed quote, before we start examining anything. On other work, in most cases you only pay if we recover your data, and electronic, mechanical and chip-level work is 50% upfront, with the balance only if we recover your data. All of our prices are shown on our data recovery cost page.
We examine any matter where what was removed, and when, carries weight.
Deletions come in levels, and each level leaves a different record. A file sent to the Recycle Bin gains a small piece of metadata holding its original path, its size and the exact moment of deletion, and this metadata routinely survives the emptying of the bin. A permanent deletion skips the bin altogether, but it only releases the file's entry in the file system index, leaving the content on disk until other data overwrites it. Which level of deletion occurred, and when, is usually one of the examiner's first findings, and it may say something about intent.
In digital forensics, timeline reconstruction is the act of placing every recorded event into one dated order, from sources that cross-check each other. The NTFS Master File Table tracks created, modified and accessed times for each file. The change journal documents operations such as create, rename and delete as they occurred. The file system's transaction log adds fine detail around the moments that matter. The Windows event logs show who was signed in, and what was opened or modified, in the hours before a deletion. Read against creation dates, a deletion timestamp answers the useful question: was this routine housekeeping, or was it timed?
Workstations quietly keep more than one past. Volume Shadow Copy snapshots, created for restore points and backups, hold earlier states of the disk, complete with files that were later deleted and versions from before an edit. Compare a snapshot with the current volume and you see exactly which files disappeared between two dates, which is often the cleanest exhibit a deletion case can produce: the file present on the 3rd, absent on the 10th, and the journal recording its removal on the 7th.
Wiping software is not quiet. The anti-forensics detection techniques we apply start from the traces the tools themselves leave: installation records and prefetch entries naming the program, execution timestamps, the overwrite patterns left on disk, and the absence of expected artefacts. As such, a wipe destroys content but creates evidence (the tool used, when it ran, under whose account, and what it missed). Many wipes are partial or interrupted runs, and what survives them is recovered through standard means.
Information related to acquiring digital images of computers and preserving the integrity of those images during processing can be found at the forensic recovery hub. Deleted data associated with removable devices continues on USB device forensics. Whole machine capture is discussed in workstation deep imaging and fees for services can be located on our prices page.
Each source corroborates the others; the timeline stands because they agree.
The original file path, file size and date and time of deletion, which survive an emptied recycle bin.
All time stamps (created, modified, accessed) for both existing and deleted files.
Creations, renames and removals, in operation-by-operation order.
Sign-in activity and access around each removal, as reported by the system's own logs.
Previous states of the volume including files deleted since then.
Which utility was run, when, under which account, and what it missed.
The free diagnostic that opens every case is completed within two working days of arrival; forensic casework itself is paid upfront once you accept the fixed quote. Our standard fee for a full forensic investigation including report is £800 plus VAT, payable 100% upfront. The cheaper forensic binary image and deleted-file extraction service, without the report, is £400 plus VAT. Both figures are itemised on our prices page, and the written scope is agreed before payment is taken.
Deletion casework is done on company-owned computers, your own devices, or on a solicitor's instruction. We accept instructions on three footings only: equipment the company itself owns; the instruction of a solicitor, insurer or court; or a computer which is genuinely your own, including one jointly owned in family law cases. We will never hack into a computer. We will never intercept live communications. And we will never examine a device that you have no right to examine.
Every day of normal use costs a deletion case something. So please take the computer out of use immediately and call 0800 689 0668 today to get a quote. Once you've got that quote, the hard drive (not the computer) is sent to our Leeds lab by tracked next-day post, or handed in at the Leeds lab's reception, Monday to Friday, 9am to 5:30pm. No appointment is required. On arrival, the drive is signed into the custody record.
Is the hard drive or SSD still inside a machine, such as a laptop, MacBook, iMac, CCTV/DVR system or server? Please remove the hard drive or SSD from the machine first and then post just the bare drive by itself; we do not provide a service for removing drives from devices. For a server or RAID, send every disk, each clearly marked with its bay. For a NAS, send its disks labelled by bay if you can remove them, otherwise send the NAS itself. We cannot work on storage soldered to the motherboard (e.g. Apple Silicon Macs, T2 Macs and certain slim laptops): if it doesn't come out, it can't come in. If you are unsure whether your storage is removable, call us before sending.
↓ Print the booking-in & shipping form (PDF)
Once you have your quote, send your package addressed to Leeds Data Recovery (about a 40 minute drive from York on the A64 & A1(M) or next working day if you want to send it using trackable post). We will contact you as soon as we have taken delivery of your package and put it in line to be worked upon.
Can't figure out what to pack? Ring 0800 689 0668 first, or try our free online diagnostic tool.
Stop using the machine, call the freephone number, and let the timeline speak for itself.