Forensic recovery (as opposed to simply recovering data) requires not just that your results be correct but that they be believable. We work for solicitors around the Minster quarter, HR departments in Clifton Moor and Monks Cross, and technology firms out at Heslington. We create evidence from computer systems and storage media that are imaged once, hashed for verification, and then detailed so as to provide an audit trail which enables tribunals to see each step taken during the process.
◇ Speed after method. The free assessment and a written scope of works come first. Forensic fees are paid upfront in full once you accept the fixed quote, before we start examining anything. On other work, in most cases you only pay if we recover your data, and electronic, mechanical and chip-level work is 50% upfront, with the balance only if we recover your data. All of our prices are shown on our data recovery cost page.
Not the tools: the record. Standard recovery only needs to know if the files were recovered successfully; however, forensic recovery must also detail exactly how it was done since at some point there will likely be someone whose job is to raise doubts about the answers. Therefore the steps involved always remain the same here: the device is imaged behind a hardware write blocker into E01 evidence files, the image is checked using SHA-256 for integrity and accuracy, the original device is sealed and recorded, and any questions asked subsequently are directed towards the copy. All findings are assigned a unique number and date with reference to the artefact(s) used to support them.
The practices listed below are grouped in three categories. "Detection & Evidence Recovery" describes identifying what occurred on a system or within a cloud-based account. "Legal & Chain of Custody" outlines keeping the evidence found usable. "Insider Investigation" covers the instructions themselves (leavers, partners, intellectual property, family matters etc.) where these first two disciplines are applied to a named dispute.
We offer four services that identify what occurred: deleted material along with its timeline, removable media movement, email and cloud exits, and the deep image of the workstation itself.
The evidence that you collect is only as good as how you handle it. Therefore preserving, hashing, storing and keeping track of custody records are services by themselves. Encrypted or wiped devices are handled within workstation deep imaging: BitLocker and FileVault machines are captured before the keys change, and secure-erase runs are detected and dated.
If the question is about a person rather than a device, the answers lie in credential misuse and server-side evidence, followed by the four case files we are most often instructed on.
Regardless of which page led you here, the same six disciplines exist under the work described at that page.
Hardware write blockers act as barriers between every original drive and the bench. Any software we may use cannot modify an original exhibit.
Each device is captured into E01 evidence file containers. Those files contain the entire dataset from that particular device. It is a common format used throughout the global forensic community, who are able to open, verify and further examine those files.
All acquisition and working copies (of all data) are hashed and rehashed. Therefore, if there were ever changes made to your evidence after it was created, those changes would reveal themselves as they are identified by hashing.
All indexing, artefact harvesting, deleted-file recovery and timeline creation occur using OSForensics against the image (of the device), not against the original.
When we have a lawful entitlement to access password protected documents or archives or encrypted files/volumes, then these can be accessed using Passware.
Each time an exhibit is moved for sealing, hand-over or storage purposes this is documented, from the signature on receipt at our Leeds location until the exhibit is returned.
The preliminary assessment to open a case is provided at no charge to you and is completed within two (2) working days after receipt. Once we have your acceptance of the fixed quote for the forensic services, we collect the fee for those services upfront. The total cost of the full forensic investigation including final report is £800 plus VAT. Payment for this service is collected as one hundred percent (100%) upfront. If you require only a forensic binary image and deleted file extraction but do not need the accompanying report then it can be purchased for £400 plus VAT. All fees for forensic services will be collected from you prior to such services being conducted. CCTV/DVR, BitLocker and ransomware cases are considered forensic-class and are therefore also paid upfront on the same terms. Please note both figures are listed on our pricing page, and the written scope is agreed before payment is taken.
Instructions most frequently come from employers, their HR departments and solicitors. Private matters receive the same treatment. Only three types of instruction are accepted: equipment which the company itself owns; the instruction of a solicitor, insurer or court; or devices genuinely belonging to the client, including jointly owned equipment in matrimonial disputes. We do not hack; we do not intercept live communications; we do not examine a device that the instructing client does not have the legal right to inspect.
You will be able to get a quote and discuss how to pack your exhibits, what documentation you'll need, and when they can arrive by calling us on 0800 689 0668. Once we've discussed all of this, please send the drive(s)/media (and not the machine itself) by tracked next-day post from anywhere within North Yorkshire. Alternatively, you can hand the drives/media in at our Leeds lab's reception (Monday to Friday, 9am to 5:30pm, no appointment needed), where the custody record will open with your signature.
Is the hard drive or SSD still inside a machine, such as a laptop, MacBook, iMac, CCTV/DVR system or server? Please remove the hard drive or SSD from the machine first and then post just the bare drive by itself; we do not provide a service for removing drives from devices. For a server or RAID, send every disk, each clearly marked with its bay. For a NAS, send its disks labelled by bay if you can remove them, otherwise send the NAS itself. We cannot work on storage soldered to the motherboard (e.g. Apple Silicon Macs, T2 Macs and certain slim laptops): if it doesn't come out, it can't come in. If you are unsure whether your storage is removable, call us before sending.
↓ Print the booking-in & shipping form (PDF)
Once you have your quote, send your package addressed to Leeds Data Recovery (about a 40 minute drive from York on the A64 & A1(M) or next working day if you want to send it using trackable post). We will contact you as soon as we have taken delivery of your package and put it in line to be worked upon.
Can't figure out what to pack? Ring 0800 689 0668 first, or try our free online diagnostic tool.
Free assessment, written scope, verified images: ring the freephone and ask your question.