Taking instructions now — the first conversation is freeExhibits posted in from anywhere in the UK, or handed in at ten drop-off pointsQuicker still, give us a ring:0800 6890668
FDRForensic Data Recovery 0800 6890668 Price my job
FDR / What we examine

Computers · drives · SSDs · USB and cards · NAS and RAID · recorders · encrypted · damaged

What we examine. The method is the same for every exhibit; the detail is what differs, and what matters.

We examine the storage that holds the evidence: the computers people work on, the drives inside them, the external media they plug in, the recorders that keep footage, and the encrypted and damaged media that need special handling. Whatever the exhibit, the method is the same and it is what makes the work defensible: the storage is imaged bit for bit behind a hardware write blocker, the image is hashed and verified, and every examination is done on the verified image, never the original. What differs is the detail, a solid-state drive's TRIM feature limits what deleted data survives; a RAID needs its members reassembled; a CCTV recorder keeps a loop that overwrites itself; a damaged drive may need physical recovery before it can be read, which we document. One thing we do not examine is mobile phones; that is a specialist field with its own tools, and it is not part of this service. Find the exhibit below. Each page explains how it is examined and what that means for the evidence it holds.

Owner-only, authority requiredImaged behind a write blockerStandard report £800 + VATMobile phones: not examined

Rather talk it through? An engineer answers the bench line
0800 6890668

Before anything else: stop using the device, and do not let anyone have a look at it. Every time a computer is switched on and used, the very artefacts an examination relies on, the timeline, the recently-opened lists, the deleted-file space, are overwritten a little more. Do not reinstall, do not run recovery software, do not let IT open it to check, and keep it powered off. Preserve it as it is, record who has held it, and send it with the authority documents we ask for. If proceedings are contemplated, the duty to preserve evidence has already begun.

What stays the same, and what changes.

Imaged first, alwaysWhatever the exhibit, nothing is examined on the original. The storage is connected through a hardware write blocker, imaged bit for bit, and hashed, and all work is done on the verified image. That is the foundation of a defensible examination, and it does not vary by device.
The drive type changes what survivesA traditional hard disk retains deleted data for a long time; a solid-state drive's TRIM feature erases it quickly, so recovery from an SSD is far more limited. We identify the drive type and are clear about what it means for your matter; the SSD and TRIM page explains it.
Some exhibits need reassembly or repairA RAID must have its members reassembled before the data can be read; a CCTV recorder uses a non-standard file system and a self-overwriting loop; a failed or damaged drive may need physical recovery before it can be imaged, which we document openly. The method adapts without losing its integrity.
Mobile phones are not examinedPhone forensics is a distinct field with its own tools and licensing, and it is not part of this service. We examine computers, drives, external media and recorders. We say so plainly rather than take a phone we are not equipped to examine to the right standard.

The exhibits we examine.

Describe yours → →
Laptops and desktopsThe commonest exhibit: Windows, macOS or Linux, the drive imaged and examined. Send the drive, or the whole machine if it is soldered in.Hard disk drivesThe examiner's friend: a traditional hard disk keeps deleted data for months, long after an SSD would have erased it.SSDs, NVMe and TRIMWhat TRIM means for evidence: an SSD erases deleted data quickly, so recovery is limited, though the live data and records of deletion are examined fully.USB sticks and memory cardsRemovable media as evidence: imaged and examined for its files and deleted data, and matched to a computer by its serial.NAS and RAIDShared company storage, reassembled from its member drives in software before the data is examined. Quoted on the configuration.CCTV, DVR and NVR recordersA recorder is a computer with a loop that overwrites itself; stop it recording at once, and we recover the footage that survives.Encrypted drivesBitLocker, FileVault, VeraCrypt: examined like any drive once open, with the key or a memory capture, and honestly beyond reach without one.Failed and damaged mediaA clicking, dead or damaged drive recovered properly and then examined forensically, with the physical work documented. The combination this service is built on.Dashcams and body camerasA dashcam loops like a CCTV recorder; take the card out at once, and we recover the footage that survives, with the clock checked.Mobile phones: not examinedNot part of this service: phone forensics is a specialist field of its own. We examine computers, drives, external media and recorders.

The questions that come up first.

Do you examine mobile phones?

No. Mobile phone forensics is a specialist field with its own tools and licensing, and it is not part of this service. We examine computers, hard drives, SSDs, USB sticks and memory cards, NAS and RAID, and CCTV, DVR and dashcam recorders.

Do you examine the original device?

No. Every exhibit is imaged bit for bit behind a hardware write blocker, and all examination is done on the verified image. The original is not altered, save where a damaged drive needs a physical recovery intervention to be read, which we document in the report.

Can you examine a drive that has failed?

Often, yes. A failed or damaged drive may need physical recovery, cleaning a corroded connector, a repair, before it can be imaged, and we record that intervention openly; it alters the device's physical state, not the user data. The failed-and-damaged-media page explains how.

Does it matter whether the drive is an SSD?

Yes, for deleted data. A solid-state drive's TRIM feature erases deleted data quickly, so recovery from an SSD is far more limited than from a traditional hard disk. We identify the drive type and explain what it means for your matter honestly.

Find the exhibit, and preserve it.

Each page explains how an exhibit is examined and what it means for the evidence. Tell us what you have and the situation, and the first conversation will tell you honestly what can be done.

0800 6890668

Price my jobPacking and posting