When you suspect copying has occurred, your questions will be very specific: Which devices were used? At what time(s) were they connected? What files were transferred? Windows stores most of this information without being asked. We extract that data from an image we have verified and organise the relevant details into a logical sequence (for our employer clients from Clifton Moor through to the distribution centres located along the A64).
◇ Speed after method. The free assessment and a written scope of works come first. Forensic fees are paid upfront in full once you accept the fixed quote, before we start examining anything. On other work, in most cases you only pay if we recover your data, and electronic, mechanical and chip-level work is 50% upfront, with the balance only if we recover your data. All of our prices are shown on our data recovery cost page.
More cases revolve around a stick, a memory card or a portable hard drive than any other type of evidence.
Windows keeps a record of all removable devices which connect to the machine. The USBSTOR registry key contains information on the manufacturer, model and serial number of all sticks (USB flash drives), card readers and portable drives. Further, setupapi.dev.log records when each device was first introduced into the system, down to the second. Additionally, other registry records show when each device was last connected and which user profile mounted it. These records are collected from a previously-verified image and create an entire record of devices that have been connected to the machine throughout its operational history, including hardware nobody mentions until it appears in the schedule.
A connection proves presence, but most cases require movement. The link files and jump lists demonstrate company documents were opened from the removable media using the removable drive’s letter. This provides a path of how the document was accessed along with the time stamp of when the document was opened. Shellbags show you what folders were viewed or used on the removable storage device. Even though the removable storage device may have been removed, the shellbag shows the folder tree structure that was viewed. The change journal will show all of the surrounding file activity in order of time, down to minute-by-minute detail. Where the stick itself is produced, we can also image it, which shows its files, their timestamps and a list of everything deleted from it since.
Careful reading of file timestamps will show when files were copied. When a file is copied to another volume (drive), its creation date is set to the moment of copying, but its modification date travels with the content; therefore if one finds a document created at 23:41 and last modified over 2 years prior, it was copied then, not written. Set against the device register and the journal, this signature dates each file transfer, and late-night clusters of transfers rarely look routine.
The same discipline covers more than just sticks. SD and microSD cards from cameras, dashcams and drones, CF cards from older kit, and portable SSDs go through the exact same forensic imaging and analysis, and as memory card forensics specialists we find deleted photos and videos on the card itself as readily as we trace documents onto it. If the memory card is the entire case, then both the memory card and the computer that wrote to it are analysed, so each account verifies the other.
Methodology and chain of custody reside at our forensic recovery hub. Deletion dating continues on deleted file forensics, and the employer cases this feeds sit on employee data theft. Pricing is on our prices page.
Each piece of evidence will include a date, the account it is attributed to, and the artefact that generated it.
Each stick, card and drive the machine has seen will be identified: maker, model and serial number.
The first and last appearance of every device, dated to the second.
Documents opened from a device's drive letter, with their paths and times.
The directory hierarchy explored on the device, preserved through shellbags.
Time-based patterns used to date when transfers were made onto a device.
The media itself imaged and the deleted content recovered from it.
The free diagnostic that opens every case is completed within two working days of arrival; forensic casework itself is paid upfront once you accept the fixed quote. Our standard fee for a full forensic investigation including report is £800 plus VAT, payable 100% upfront. The cheaper forensic binary image and deleted-file extraction service, without the report, is £400 plus VAT. Both figures are itemised on our prices page, and the written scope is agreed before payment is taken.
Casework related to removable media will proceed on company computers or company issued media, or as per the direction of a solicitor. Directions can be received on three bases only: equipment owned by the company; direction of a solicitor, insurance company or court; or devices that are truly the client's own, including joint ownership of machines in matrimonial cases. We do not hack, we do not intercept live communications, and we do not access a device that the instructing client does not have the right to access.
Sticks, cards and the drives from the PCs that wrote to them are best sent in together so they can be forensically analysed as one complete set. Please call us on 0800 689 0668 for your quote and to agree which items to send before posting anything. Each item will be signed for upon receipt at our Leeds location and entered on the custody record once received.
Is the hard drive or SSD still inside a machine, such as a laptop, MacBook, iMac, CCTV/DVR system or server? Please remove the hard drive or SSD from the machine first and then post just the bare drive by itself; we do not provide a service for removing drives from devices. For a server or RAID, send every disk, each clearly marked with its bay. For a NAS, send its disks labelled by bay if you can remove them, otherwise send the NAS itself. We cannot work on storage soldered to the motherboard (e.g. Apple Silicon Macs, T2 Macs and certain slim laptops): if it doesn't come out, it can't come in. If you are unsure whether your storage is removable, call us before sending.
↓ Print the booking-in & shipping form (PDF)
Once you have your quote, send your package addressed to Leeds Data Recovery (about a 40 minute drive from York on the A64 & A1(M) or next working day if you want to send it using trackable post). We will contact you as soon as we have taken delivery of your package and put it in line to be worked upon.
Can't figure out what to pack? Ring 0800 689 0668 first, or try our free online diagnostic tool.
Preserve the machine as it is; hold onto the stick if you can. And ring the freephone to get help.