Failed media · damaged drives · physical recovery · documented · forensic handling
Failed and damaged media forensics. A drive that has failed is not beyond evidence; it is recovered properly first, and the recovery is part of the record.
A drive that is clicking, dead or damaged, dropped, flooded, burnt, is not beyond forensic examination; it needs recovering first, and this is where a recovery lab that also works to evidential standards has an advantage most forensic boutiques do not. We recover the failed drive, cleaning a corroded connector, repairing a board, addressing a mechanical fault, and we document that intervention openly, because it alters the device's physical state while leaving the user data untouched, and the examiner is competent to explain its effect. Once a clean image is obtained, the examination proceeds as it would on any drive, with the full integrity record. Recovering a failed drive and then examining it forensically, each done properly, is the combination this service is built on.
Rather talk it through? An engineer answers the bench line
0800 6890668
How a failed drive becomes evidence.
A failed or damaged drive first needs physical recovery. Depending on the fault, that may mean cleaning a corroded connector, repairing or replacing a circuit board, or addressing a mechanical failure of the heads or motor. This work alters the drive's physical state, a cleaning, a repair, but it does not alter the user data, and the examiner is competent to carry it out and to explain its effect.
The key, for a forensic matter, is that the intervention is documented openly: what was done, that it altered the physical device and not the data, and how much of the drive could then be read. This is the position of the second ACPO principle, that a person who must access original data must be competent and able to explain the implications of their actions. A recovery done and recorded this way withstands scrutiny; one done without that record can be challenged.
Once a clean image is obtained and hashed, the examination proceeds exactly as on any drive, for the artefacts and files the matter requires. The combination, a proper recovery and a proper examination, is what distinguishes this service from a forensic lab that would send a failed drive away, or a recovery lab that would not document to evidential standards.
What to know for this exhibit.
From the exhibit arriving to the report.
Work we have closed →The first conversation, and the authority check Free
Tell us the situation, who owns the device, and what you need to know. We tell you whether it is a job we can take on, what authority we will need, and whether the standard report answers your questions or an expert report is called for. That conversation is free, and some enquiries end there, because we will not take work we cannot lawfully or honestly do.
Imaging behind a write blocker, and the hashes
When the exhibit arrives, your authority is checked, the device is logged and photographed, and the drive is connected through a hardware write blocker and imaged bit for bit. MD5 and SHA-256 hashes of the source and the image are computed and verified, so the copy is provably identical. Nothing is examined on the original; every later step is done on the verified image.
The examination, on the image
The image is examined for the artefacts your questions turn on: USB device history, files opened from removable media, cloud and webmail activity, deleted files and the Recycle Bin, the USN journal, program execution, email, document metadata, shadow copies, and a timeline. Findings that matter are confirmed in a second tool. The work is scoped to what you asked; material outside the scope is not reproduced.
The report
The standard forensic report sets out the exhibit and its condition, the integrity record, the tools and method, and the findings by category, with a timeline, the limitations, and factual conclusions, as a self-contained report with its chain-of-custody and case-log reports. It is written in plain terms, keeps fact separate from any comment, and is suitable for internal decisions, HR processes, negotiations and solicitors. Where you need opinion evidence for court, an expert report is quoted.
Before you send it
- Do not power a liquid- or fire-damaged drive on, and do not open it; both can turn a recoverable loss into a total one.
- Stop a clicking drive at once and send it; continued use risks the platters.
- Send it as it is; we document the condition and the recovery before any examination.
The second ACPO principle: a person who accesses original data must be competent and able to explain the implications, which is how a physical recovery is documented.
What helps, and what harms.
Do this much first
- Stop using the device and keep it powered off
- Preserve it as it is; record who has held it
- Gather your proof of ownership or authority
- Tell us the situation and the questions you have
What sets us back
- Letting anyone open it to have a look
- Reinstalling, wiping or running recovery software
- Carrying on using the device
- Sending us a mobile phone; they are not examined
Questions answered before you instruct.
Can a failed drive still be examined forensically?
Often, yes. The drive is recovered first, cleaning a connector, repairing a board, addressing a mechanical fault, and that intervention is documented openly: it alters the device's physical state, not the user data. Once a clean image is obtained, the examination proceeds as on any drive, with the full integrity record.
Does recovering the drive affect the evidence?
The physical recovery alters the drive's physical state, a cleaning or a repair, but not the user data, and we record exactly what was done and its effect, in line with the second ACPO principle that the person must be competent and able to explain the implications. That open record is what keeps the evidence credible.
Why is a recovery lab that also does forensics better for this?
Because a failed drive needs both a proper recovery and a proper forensic examination, and most forensic boutiques would send a failed drive away to a recovery lab, while most recovery labs would not document their work to evidential standards. Doing both, properly and under one record, is the combination this service is built on.
My drive is clicking or dead. Can you help?
Often, yes, but stop using it at once; continued use risks the data. Send it as it is, and we document the condition, recover it with the intervention recorded, and examine the result. Do not open a damaged drive or power a liquid-damaged one on.
What does it cost?
The standard forensic report is £800 + VAT for a one-disk system; where significant physical recovery is involved, that is reflected in the quote. The first conversation is free.
Preserve it, and let us image it first.
The first conversation is free. Tell us the exhibit and the situation, and who owns it, and we will tell you what can be examined, what authority we need, and whether we can take it on. Until then, stop using it and preserve it as it is.