The two most important things you need to know about a file that has gone are: what it was; and how it went. A disk normally keeps enough information to answer both of these questions. Between them, bin records, journal entries and volume snapshots show what was on a machine, how it was used, and when and by what method something was removed from it. For Norfolk employers, solicitors and private clients with a removal in dispute.
◇ Scope first, then work. After the free diagnostic and the written scope, forensic casework is payable upfront on acceptance of the fixed price. For all other jobs, in most cases you will only be charged if we recover your data. Full pricing is set out on our data recovery cost page.
The work can be used for any matter where what went, and when it went, carries weight.
Deletion happens at different levels, and each one leaves its own mark. Send a file to the recycle bin and a small record is created alongside it, with the path it was taken from, its size, and the moment it went. That record will normally last longer than emptying the bin. Deleting permanently skips the bin entirely, but all that is lost is the entry in the index; the contents sit where they are until there's a need for the space. Which level was used, and when, is usually the first thing established, and it often gives some indication of intent.
A timeline is simply recorded events written down in order, from sources which cross check each other. The $MFT holds the creation time, modification time and last access time for every file. $UsnJrnl keeps a record of each operation as it happens: made, renamed, deleted. $LogFile provides fine detail around the minutes you are looking at. Event logs show who was signed in and what they opened or changed before that. When compared to the time a file was created, the time it was deleted answers the question worth asking: was it housekeeping, or was it timing?
A workstation will store more than one version of its own history. Volume Shadow Copies, made for restore points and backups, keep earlier states of the disk, including files deleted afterwards and drafts from before an edit. Put a snapshot beside the live volume and what has been removed between those two dates shows clearly. This is often the tidiest evidence a removal case can offer: there on the 3rd, gone by the 10th, with the journal showing removal on the 7th.
Wiping software is not a quiet visitor. Detection begins with what the tools themselves leave behind. This includes installer records and prefetch entries carrying the program's name and when it was run, the signature left across the disk by overwriting, and the noticeable absence of traces that should be there. A wipe destroys data and creates evidence in the same pass: the utility, the time of day, the account behind it, and anything it missed. Incomplete or interrupted wipes are common, and whatever survives one can be retrieved through standard recovery methods.
The imaging and custody discipline behind this page is outlined at the forensic recovery hub. Removals involving sticks and cards are covered on USB device forensics, and whole-machine capture on workstation deep imaging. Prices are listed on the prices page.
Every source is compared with the others, and the timeline rests on where they agree.
Original path, size and the time of removal, lasting long after the bin is emptied.
Creation, modification and access times for live and deleted files alike.
Files created, renamed and removed, one operation at a time.
The account signed in around each removal, from the system logs.
Earlier states of the disk, holding what has disappeared since.
Which utility ran, the hour, the account, and what it left behind.
Each instruction starts with the free diagnostic, which takes 2 working days from the day it arrives at the bench. Forensic casework is paid upfront on acceptance of the fixed quote, before work starts. The fixed price for the full investigation with report is £800 + VAT. The less expensive forensic binary image and deleted-file extraction service without report is £400 + VAT. Both figures also appear on the prices page, and no money will be taken until a written scope has been agreed. Send us the drives, not the machines.
Removal work runs on company machines, on devices of your own, or at the direction of a solicitor. There are three footings that open the door, and there is no fourth. The first is kit the company itself owns. The second is a written instruction from a solicitor, an insurer or the court. The third is a device that genuinely belongs to the client, which in a family matter means their own machine or one owned jointly. We do not hack. We do not intercept live communications. If a client has no right to look inside a device, then neither do we.
Ordinary use costs a removal case a little every day, so take the machine out of use and call us on 0800 689 0668. We do not offer collection: the drive, not the machine, reaches our Cambridge location by tracked, insured post or over the counter, and joins the custody file at the signature.
Is the drive still bolted inside a laptop, desktop, MacBook, iMac, server or CCTV / DVR recorder? Before sending, remove the hard disk drive (HDD) or solid state drive (SSD), as we do not accept whole units. From a DVR or recorder, send just the disk. From a server or RAID, take out the disks and clearly label each disk by bay number. A network attached storage (NAS) device may be sent as its disks if they can be removed; otherwise please send the NAS itself. There is only one type of drive we are unable to accept: storage soldered onto a motherboard (e.g. Apple Silicon Macs, extremely thin laptops). In such cases, if the storage cannot be taken out it cannot be accepted. If you are unsure whether you have a removable drive or not, call us before sending anything.
↓ Print the shipping & booking-in form (PDF)
Please mark the parcel for the attention of Cambridge Data Recovery. It takes about an hour and twenty minutes to travel from Norwich along the A11, then two minutes off the A14 at Junction 32. Otherwise you can post it using a tracked service and we will receive it the following working day. We will contact you as soon as we have your drive and it is booked onto our bench.
If you're unsure of what to include in the box, please call us on 0800 689 0668 before sealing it. Or, for a first view on what we can do, you can use our free online diagnostic.
Take the machine out of use, ring the freephone, and let the sequence speak for itself.