Digital forensics & forensically sound recovery · owner-only · UK-wide, by post
A departing employee and a USB stick, a business partner and a mass deletion the morning after a demand letter, a divorce and the financial records on your own laptop, an insurance claim for a drowned computer, a late parent's accounts, a night of CCTV the recorder is about to overwrite: in each of these the device holds a detailed record of what happened, and the value of that record depends on how it is recovered. We image the exhibit bit for bit behind a hardware write blocker, hash and verify the image, examine only the verified copy, and record every step, so the findings can be tested and repeated. The standard forensic report for a one-disk system is £800 + VAT: a factual examination with its chain-of-custody and case-log reports, suitable for an employer, a solicitor, an insurer or a negotiation. Court expert reports are quoted, in the thousands. We examine a device only for the person or organisation with lawful authority over it, we ask for proof before we start, we say plainly what the evidence cannot prove, and we refuse covert work. We do not examine mobile phones. The first conversation is free.
Talk it through with an examiner first
0800 6890668
What is the situation?
Choose the closest match. You get an honest read of what we can do, the authority we will need, and the one thing to do tonight.
Before anything else
Every examination starts with one question: who is entitled to have this device examined. The owner is; an employer is, for its own device on a lawful basis; a solicitor or a court order can give authority; an executor can, with the grant of probate. Someone else's device, without their consent or an order, is not something we will touch, whatever the reason given.
Proof of ownership for your own device; for a company device, a letter from a director or HR confirming ownership, the lawful basis and the IT policy staff were given; a solicitor's instruction; a court order; or the grant of probate. With photo identification, before any work begins. A device without it is returned unexamined.
The authority we ask for →We will not access another adult's device or accounts without their consent or a court order, install monitoring software, bypass someone else's security, or help with covert surveillance. In a family matter, the lawful route to the other side's records is disclosure through the court. We say so plainly, and we point to the help that is there.
What we will not do →Imaged behind a write blocker on the employer's written authority. The standard report set out two removable drives first connected in the final four days, client and pricing folders opened from them, a personal cloud client installed and used to upload about 1.8 GB, and 412 deletions on the last afternoon, 58 files recovered. It stated that the artefacts did not establish who was at the keyboard.
Illustrative example — replace with a genuine caseHer own device, with her declaration of ownership. The report recovered 79 of 86 deleted financial documents intact with their metadata, 212 relevant emails including 23 deleted ones, and four earlier versions of the household budget from shadow copies. No other device was examined.
Illustrative example — replace with a genuine caseBoth drives imaged on the board's authority. The report set out 6,318 deletions across three company folders the morning after the solicitor's demand letter, a cleaning tool installed and run with overwriting enabled that same morning, and two mail rules forwarding company mail created two days earlier. 1,944 files were recovered intact.
Illustrative example — replace with a genuine caseThe condition was photographed on receipt; the drive's corroded connector was cleaned and the intervention recorded; 99.98 per cent of sectors were imaged. The report set out 612 GB of recovered data, the business records substantially intact to the date of the incident, and 118 files unrecoverable.
Illustrative example — replace with a genuine caseTwo kinds of report
Most matters turn on what the device shows, as fact, so that you, your solicitor, HR or an insurer can act on it. That is the standard forensic report. A smaller number reach a point where a court needs an expert's opinion, written to the rules that govern expert evidence. We tell you which you need at the first conversation, and the standard report is often where an expert report later begins.
The exhibit and its condition, the integrity record, the tools and method, and the findings by category, with a timeline, the limitations and factual conclusions, produced with OSForensics as a self-contained report with chain-of-custody and case-log reports, and key findings confirmed in a second tool. Suitable for internal decisions, HR processes, negotiations, solicitors and insurers. Its author can give evidence of fact.
Written for the court, addressed to the court, with the expert's qualifications, the instructions, the range of opinion and the reasons, the declaration and statement of truth, and the expert's overriding duty to the court, with attendance where needed. Quoted on the questions, the material and the timetable, and in the thousands.
Tell us the situation, who owns the device and what you need to know. We tell you whether we can take it on, what authority we need, and which report fits. It is free, and some enquiries end there, because we will not take work we cannot lawfully or honestly do.
Stop using it, keep it powered off, and do not let anyone have a look. Every use overwrites the artefacts an examination relies on. If proceedings are contemplated, the duty to preserve has already begun.
The posting address, the nearest of ten drop-off points and a booking sheet arrive by email. Send the drive, or the laptop or recorder where it is the exhibit, with the authority documents. A case number is issued when the parcel is logged.
Your authority is checked and the exhibit photographed and logged; the drive is imaged behind a write blocker and hashed; the examination runs on the verified image, scoped to your questions, with key findings confirmed in a second tool.
The standard report arrives as a self-contained HTML or PDF report with its chain-of-custody and case-log reports, usually within 5–10 working days of the exhibit arriving. The exhibit goes back, or is retained under seal if you prefer.
The first conversation is free. Tell us the situation and who owns the device, and you will get an honest answer: whether we can take it on, the authority we need, and whether the standard report at £800 + VAT or an expert report fits. Until then, stop using the device and keep it as it is.