Hard disk drives · HDD · deleted data · imaging · best recovery source
Hard disk drive forensics. The traditional hard disk is the examiner's friend: it keeps deleted data long after it is gone from the index.
A traditional spinning hard disk drive is, for a forensic examiner, often the best exhibit of all, because of how it handles deletion. When a file is deleted from a hard disk, the data stays in place until the space is reused, and a hard disk reuses space slowly, so deleted files and the records about them can survive for months or longer. That is in sharp contrast to a solid-state drive, whose TRIM feature erases deleted data quickly. So where a matter turns on recovering what was deleted, a hard disk is the exhibit most likely to yield it. We image it behind a write blocker and examine the image in full.
Rather talk it through? An engineer answers the bench line
0800 6890668
Why a hard disk keeps so much.
A hard disk stores data on spinning platters, and when a file is deleted the system marks its space as free but leaves the data in place until something else is written over it. Because a hard disk with free space reuses it gradually, deleted data can remain recoverable for a long time, which is why a hard disk is so often the exhibit that yields deleted documents, emails and other evidence.
The drive is imaged bit for bit behind a hardware write blocker, capturing not just the live files but the unallocated space where deleted data lives, and hashed so the copy is provably identical. The examination then runs on the image, recovering deleted files with a recoverability indicator and examining the full range of artefacts.
Hard disks also fail mechanically, and a drive that is clicking or will not spin up may need physical recovery before it can be imaged; that is covered on the failed-and-damaged-media page, and the physical work is documented in the report.
What to know for this exhibit.
From the exhibit arriving to the report.
Work we have closed →The first conversation, and the authority check Free
Tell us the situation, who owns the device, and what you need to know. We tell you whether it is a job we can take on, what authority we will need, and whether the standard report answers your questions or an expert report is called for. That conversation is free, and some enquiries end there, because we will not take work we cannot lawfully or honestly do.
Imaging behind a write blocker, and the hashes
When the exhibit arrives, your authority is checked, the device is logged and photographed, and the drive is connected through a hardware write blocker and imaged bit for bit. MD5 and SHA-256 hashes of the source and the image are computed and verified, so the copy is provably identical. Nothing is examined on the original; every later step is done on the verified image.
The examination, on the image
The image is examined for the artefacts your questions turn on: USB device history, files opened from removable media, cloud and webmail activity, deleted files and the Recycle Bin, the USN journal, program execution, email, document metadata, shadow copies, and a timeline. Findings that matter are confirmed in a second tool. The work is scoped to what you asked; material outside the scope is not reproduced.
The report
The standard forensic report sets out the exhibit and its condition, the integrity record, the tools and method, and the findings by category, with a timeline, the limitations, and factual conclusions, as a self-contained report with its chain-of-custody and case-log reports. It is written in plain terms, keeps fact separate from any comment, and is suitable for internal decisions, HR processes, negotiations and solicitors. Where you need opinion evidence for court, an expert report is quoted.
Before you send it
- Stop using the drive immediately; every new file written reduces what can be recovered.
- Stop a clicking or failing drive at once and send it; continued use risks the platters.
- Preserve it as it is; the slow reuse of space is what makes a hard disk such a good source, if it is not disturbed.
A hard disk reuses free space slowly, so deleted files can survive for months or longer, which makes it the best exhibit for recovering deleted evidence.
What helps, and what harms.
Do this much first
- Stop using the device and keep it powered off
- Preserve it as it is; record who has held it
- Gather your proof of ownership or authority
- Tell us the situation and the questions you have
What sets us back
- Letting anyone open it to have a look
- Reinstalling, wiping or running recovery software
- Carrying on using the device
- Sending us a mobile phone; they are not examined
Questions answered before you instruct.
Why is a hard disk better than an SSD for recovering deleted data?
Because a hard disk reuses free space slowly and leaves deleted data in place until it is overwritten, so deleted files can survive for months. An SSD's TRIM feature erases deleted data quickly, so recovery from an SSD is far more limited. For recovering what was deleted, a hard disk is the stronger exhibit.
How long do deleted files survive on a hard disk?
It depends on how much the drive has been used since, because deleted data survives until its space is reused. On a drive that has not been heavily used since the deletion, files can be recoverable months or even years later. The sooner the drive is preserved, the more survives.
My hard disk is clicking. Can it still be examined?
Often, yes, but stop using it at once, because continued use risks the platters. A clicking or failing drive may need physical recovery before it can be imaged, which we document; the failed-and-damaged-media page explains the process.
What does the examination find?
The full range of artefacts your questions call for, with deleted-file recovery being a particular strength on a hard disk. The report is a factual account of what the drive records, with the limits stated.
What does it cost?
The standard forensic report for the one drive is £800 + VAT. The first conversation is free.
Preserve it, and let us image it first.
The first conversation is free. Tell us the exhibit and the situation, and who owns it, and we will tell you what can be examined, what authority we need, and whether we can take it on. Until then, stop using it and preserve it as it is.