Evidence · forensic recovery, Birmingham
The moment a recovery might end up in front of a judge, a tribunal or an insurer, the job picks up a second audience: somebody paid to find the hole in it. That audience is who the write blocker, the pair of hash values and the log kept as the work runs are for. Getting the files out matters, and so does being able to show where they came from and what was done to them.
Call us, in confidence
0800 6890668
| What you see | What the evidence can show | What you get back |
|---|---|---|
| Files gone, whether by mistake or on purpose | Whether they ever existed, when they disappeared, and how much can be pulled back | The files themselves, plus the method in writing |
| A drive that has been wiped on purpose | Which tool ran, when it ran, and what it left behind | Whatever survived the wipe, and where it sat |
| A BitLocker or other locked volume | Whether Passware can get to the key, given lawful authority to try | The volume open, with the way in written down |
| An exhibit that happens to be failing | The slow, patient imaging a sick drive needs, without stepping outside continuity | The data recovered, the chain intact |
| An argument about what happened when | Timestamps and system artefacts compared, with the limits spelled out | A sequenced account of events, with the caveats attached |
Nothing begins until we have talked it through privately. Tell us what happened, which devices and accounts it reaches, and what the evidence has to prove; those three answers fix the scope, and the scope fixes the one written price you receive before anyone examines a device. That conversation is free.
A hardware blocker is the only thing the exhibit gets connected to, and what comes off it is a sector-by-sector duplicate: E01 as standard, since the checksums travel inside it, or raw if you prefer.
MD5 and SHA-256 values are taken while the image is being written, and taken a second time from the finished file. Where both pairs match, the copy is identical to its source and there is nothing left to argue about — arithmetic, not judgement.
Deleted, damaged and encrypted material is dealt with inside the image, with the audit trail still running throughout. Where opening a locked volume is lawful and a password or key is genuinely reachable, Passware takes it on.
Everything goes across: the report, the exhibits, the source files, hash values, the continuity log and the notes written at the bench. An opposing expert, or the tribunal itself, can repeat every step and end up with the same answer.
Which rules actually bite: the Forensic Science Regulator's statutory Code — statutory since 2 October 2023 — moved to its second version on 2 October 2025, and its reach is criminal: investigation work, and the criminal courts of England and Wales. Instructions that grow out of a civil dispute, an employment row or an insurance claim sit outside enforcement altogether. Our method is the same on both sides of that line, and we will say plainly which side your instruction sits on.
The night before he handed the laptop in, a leaver ran a wiping tool over it. The tool's own logs came through into the image, fixing the fifteen minutes it was working and listing the files it had been pointed at.
Four tests: the material is unchanged, whoever handled it was competent, there is a path from exhibit to finding a stranger could follow, and it bears on the issue. Write-blocked imaging, hashes checked at both ends and notes taken at the bench demonstrate the first three rather than assert them.
Because a piece of hardware that lets reads through and electrically refuses writes is the one way to demonstrate, not merely claim, that the exhibit went out in the state it came in.
If the authority to open it is lawful and there is a realistic route to a password or key, yes — Passware handles that, run against the image and never the exhibit, with the method recorded as we go. Where no key is within reach, decent encryption holds, and you will hear that from us before you spend anything.
At the bench a good deal of it is the same work. The difference is what the result has to survive afterwards. A forensic instruction brings write blocking, hashes verified both ends, an exhibit record with no breaks, and notes written as it happens — the things that keep a finding standing when an opposing expert leans on it.
Every hour the recorder runs, more of what you need is gone, and the deadline stays where it is. Book it in now: the diagnosis is free and stays confidential.