Illustrative — synthetic data · Insurance claim · liquid damage · recovery recorded · what existed and when
Sample report: a damaged laptop for an insurance claim. The condition, the recovery and the data, each on the record.
A sole trader's laptop was damaged by a spilled drink and would not start. With the insurer's claim reference, he instructed an examination to document the damage, recover the data and report what business records existed and what was lost. This illustrative report shows how a physical recovery is recorded inside a forensic report.
Rather talk it through? An engineer answers the bench line
0800 6890668
1. Scope and the questions asked.
The questions were: (a) the condition of the device on receipt; (b) whether the drive's data could be recovered, and how; (c) what user data existed, with date ranges; (d) whether that data was intact.
2. Authority and lawful basis.
The laptop is the instructing party's own, receipt supplied; the insurer's claim reference is recorded on the case. The examination concerns his own data, for his claim.
3. Exhibit and integrity.
| Item | As recorded |
|---|---|
| Condition on receipt | Corrosion on the mainboard near the keyboard connector; sticky residue; photographs at Appendix F |
| Power | Did not power on |
| Drive | 1 TB SATA hard disk, removed; PCB connector corroded; platters unaffected |
| Intervention | Connector cleaned; PCB tested; recorded in full at section 5.1 |
| Imaging | Hardware imager, controlled retries; 99.98% of sectors read |
| SHA-256 of image (placeholder) | 72a9…0bd1 |
| Integrity note | Unread sectors mean the source cannot be re-hashed to match; the image hash is the reference |
| Re-verified | Image hash re-verified before issue |
4. Tools and method.
A hardware imager for acquisition, with its sector map of unread areas at Appendix A; OSForensics for the file system browser, file metadata, User Activity, the Timeline and the case report. Times are UTC.
5.1 The recovery intervention.
The drive did not respond until its corroded connector was cleaned and its circuit board tested, after which it spun up and was imaged. This intervention altered the drive's physical state, by cleaning, but not the user data on the platters. It is recorded here because it is a departure from leaving the exhibit untouched; the examiner is competent to carry it out and to explain its effect, in line with the second ACPO principle.
5.2 The data that existed.
Windows 10 Home with one user account. The user data comprises about 184,000 files, 612 GB, including a Business folder of about 41,000 files: invoices, quotes and photographs of completed work.
Table 5.2: The data that existed
| Category | Files | Date range (modified) | Opened and verified |
|---|---|---|---|
| Business: invoices and quotes | 11,420 | Jan 2019 – 2 Jun 2026 | 99.8% |
| Business: job photographs | 28,960 | Mar 2019 – 1 Jun 2026 | 99.7% |
| Business: accounts spreadsheets | 620 | Apr 2019 – 30 May 2026 | 99.5% |
| Personal and system | about 143,000 | 2018 – 2026 | Not in scope |
5.3 The last activity.
The most recent user file was saved at 17:48 UTC on 2 June 2026, the date of the incident. The System log records a clean shutdown at 18:03 UTC that day and no later boot. One hundred and eighteen files in the Business folder lie on sectors that could not be read and are reported as unrecovered; they are listed at Appendix C.
6. Timeline extract.
| Time (UTC) | Event | Source |
|---|---|---|
| Jan 2019 | Earliest Business file | File system |
| 02 Jun 2026 17:48 | Last user file saved | File system, metadata |
| 02 Jun 2026 18:03 | Clean shutdown; no later boot | System log |
| On receipt | Condition photographed; would not power on | Appendix F |
| At the bench | Connector cleaned; drive imaged, 99.98% read | Imager log |
7. Limitations.
The report records what was on the drive and when it was saved. It does not value the data, verify the business records' contents, or establish how the damage happened, beyond the device's condition on receipt.
8. Conclusions, as fact.
The laptop had suffered liquid damage and would not power on. After the drive's connector was cleaned, the drive was imaged with 99.98 per cent of sectors read; 612 GB of user data was recovered, the business records substantially intact to the date of the incident, with 118 files unrecoverable.
9. Exhibits and appendices.
Exhibits: E1 laptop, returned; E1/IMG1 image, retained encrypted; recovered data supplied on new media. Appendices: A imager log and sector map; B tool versions; C unrecovered files; D data summary; E glossary; F photographs on receipt.
The service this report illustrates.
This is what the standard report looks like.
The standard forensic report for a one-disk system is £800 + VAT. Tell us the situation and who owns the device, and the first conversation will tell you whether it answers your questions.