Forensic recovery · evidence, Cardiff
As soon as a recovery might be read by a judge, a tribunal or an insurer, a second reader appears: someone whose job is to find the gap in it. The write blocker, the two hash values and the running log all exist for that reader. Pulling the files off is half of it. Proving their origin, and every step taken since, is the other half.
Speak to us in confidence
0800 6890668
| What shows up | What the evidence tells you | What comes back |
|---|---|---|
| Files missing, by accident or by design | Whether they existed at all, when they went, and how much is retrievable | The recovered files, with the method written up |
| A disk somebody wiped deliberately | What tool was used, at what time, and what it missed | Anything that outlived the wipe, and its location |
| BitLocker, or another encrypted volume | Whether Passware reaches the key, where there is lawful authority | Access to the volume, with the route in on paper |
| An exhibit that is also a dying drive | Imaging a failing disk slowly and carefully, without breaking continuity | The data back, the chain unbroken |
| A dispute about the order of events | Timestamps and system artefacts read together, with their limits stated | A timeline of events, with the caveats spelled out |
It starts with a private conversation, and that costs nothing. Three things shape everything after it: what has happened, where it reaches — which machines, which accounts — and what the evidence needs to establish. Those answers set the scope. The scope sets the single written price, quoted before a device is touched.
The exhibit meets one thing and one thing only: a hardware blocker. What comes off is a full duplicate, sector by sector — E01 by default, because the checksums ride inside the file, or raw dd on request.
MD5 and SHA-256 are taken during acquisition, and taken again from the image once it has been closed. If both pairs agree, the copy matches its source and the point is settled — arithmetic, not an opinion anybody has to accept.
Deleted, damaged and encrypted material is handled inside the image, with the audit trail running the whole time. If the law permits a locked volume to be opened and a key or password is genuinely in reach, Passware gets pointed at it.
A report is only worth what someone else can check, so it never travels alone. Out go the exhibits, the source files, the continuity log, every hash value, and the notes made at the bench. An expert instructed against you can walk it again and reach the same place.
Where the rules actually apply: version two of the Forensic Science Regulator's statutory Code took effect on 2 October 2025 — the Code has been statutory since 2 October 2023 — and its reach stops at criminal work — investigations, and cases before the criminal courts in England and Wales. An instruction arising from a civil claim, a workplace dispute or an insurance loss sits outside that enforcement altogether. We work to the same method on either side of the line, and you will be told plainly where yours sits.
The evening before the laptop went back, a departing employee ran a wiping tool over it. The tool kept logs of its own, and they came through in the image — fixing the fifteen minutes it ran and naming every file it had been aimed at.
Four questions. Is the material unaltered? Was the person handling it competent? Could an outsider trace the route from exhibit to finding? And does it bear on the issue at all? Imaging behind a blocker, hashes proved at each end and notes taken while the work runs demonstrate the first three rather than asserting them.
Because a blocker passes reads to the machine and stops writes in the wiring. That is the difference between telling a court the exhibit was untouched and being able to prove it.
Where you hold lawful authority and a password or key is realistically reachable, yes: Passware does that work, aimed at the image and never at the exhibit, and the method is logged while it runs. Where nothing gets us to a key, sound encryption wins, and you will hear that before you have spent a penny.
On the bench, much of it is identical work. What differs is what the outcome has to withstand later on. A forensic job adds write blocking, hashes proved at both ends, an exhibit record with no gaps, and notes made as it happens — the parts that keep a finding upright when the other side's expert pushes at it.
While that recorder keeps writing, the clip you need is being covered over — and your deadline has not moved. Book it in. The first look is free, and it stays private.