An ordinary recovery is measured by whether or not the files come back. A forensic recovery however is measured, months after, by whether the account of how they came back will stand up to someone paid to doubt it. Therefore the device is copied once, the hash values are recorded and the findings are written in terms that a tribunal can follow, for insurance and legal offices in the city centre, HR teams at food and agricultural firms throughout mid-Norfolk, and engineers in the offshore wind supply chain working out of Great Yarmouth.
◇ Scope first, then work. After the free diagnostic and the written scope, forensic casework is payable upfront on acceptance of the fixed price. For all other jobs, in most cases you will only be charged if we recover your data. Full pricing is set out on our data recovery cost page.
Any competent engineer could get files off a failing disk. What forensic work adds is the part that survives an argument: a record, written at the time, of how those files were obtained. The order here never changes. The drive is read through a hardware write-blocker and copied into E01 evidence files. The copy is checked against the original using SHA-256. The exhibit is sealed, labelled and entered into the custody file, and from then on all questions are directed at the copy. Each finding gets a number and a date along with a reference to the trace it is based on. That discipline is the whole of what digital forensics offers over a simple recovery.
The pages below are divided into three headings. Detection and evidence recovery is the finding work: what happened on a machine, on a card, or inside a cloud tenancy. Legal and chain of custody is the keeping work: how you preserve, hash and store, and create a file that can withstand close reading. Insider investigation is where both of those are aimed at a named dispute and a set of dates.
Four services that show what really took place: what was deleted and when; how files were moved on to sticks and cards; exits by way of a mailbox or cloud account; and the whole machine taken down in one capture.
Evidence is only worth what its handling can prove, so preserving, hashing, storing and keeping the custody file is a job in its own right. Machines that have been locked or wiped are dealt with under workstation deep imaging: BitLocker and FileVault devices copied while their keys can still be reached, and erase runs picked up and given dates.
When the subject is a person instead of a box: logins put to the wrong use, the data kept by a server, and then the four most common instructions we receive.
Whatever page brought you here, this is what the underlying work looks like.
A hardware write-blocker sits between the exhibit and the bench, so that nothing done at this end can affect the drive it came from.
The drive is copied into E01 files, which other examiners can open, check and work through again for themselves.
A SHA-256 hash is calculated when the copy is made and again later, so if the image has been altered in some way it will not pass unnoticed.
All of the analysis (indexing, artefact extraction, deleted item recovery and timeline building) happens on the copy.
Passware can unlock password protected documents, sealed archives and whole encrypted volumes, but only where the client has a right to what is inside.
Every signature, seal and movement of the evidence is logged, from receipt at our Cambridge location to the exhibit going home.
Each of our instructions begins with the free diagnostic, which takes 2 working days from the day the device reaches the bench. All forensic casework is paid upfront once you accept our fixed quote. The cost for a full forensic investigation including the report is £800 + VAT, and this needs to be paid 100% upfront. The less expensive forensic binary image and deleted-file extraction service, without the report, is £400 + VAT. All forensic work will need to be paid for upfront. CCTV/DVR, BitLocker and ransomware cases are classed as forensic and will also require payment upfront on the same terms. Both prices can also be found on the prices page, and no money is taken until a written scope has been agreed.
The majority of this work comes from employers, HR departments and solicitors; a private client is treated the same way. There are three footings for access and there is no fourth: equipment which is owned by the company; a written instruction from solicitors, an insurer or the court; or a device that is genuinely the client's, which in a family matter means their own machine or one owned jointly. We do not hack into anything. Live communications are not intercepted. If the client has no right to look inside a device then neither do we.
An exhibit is not an ordinary parcel. Ring 0800 689 0668 before it moves and we will settle the packing, paperwork, timing and a fixed quote with you. Please send the drives only, not the machines. Collection is not offered, so they come by tracked, insured post or are handed in at reception at our Cambridge location, Monday to Friday, 9am to 5:30pm, where the custody file opens at the signature.
Is the drive still bolted inside a laptop, desktop, MacBook, iMac, server or CCTV / DVR recorder? Before sending, remove the hard disk drive (HDD) or solid state drive (SSD), as we do not accept whole units. From a DVR or recorder, send just the disk. From a server or RAID, take out the disks and clearly label each disk by bay number. A network attached storage (NAS) device may be sent as its disks if they can be removed; otherwise please send the NAS itself. There is only one type of drive we are unable to accept: storage soldered onto a motherboard (e.g. Apple Silicon Macs, extremely thin laptops). In such cases, if the storage cannot be taken out it cannot be accepted. If you are unsure whether you have a removable drive or not, call us before sending anything.
↓ Print the shipping & booking-in form (PDF)
Please mark the parcel for the attention of Cambridge Data Recovery. It takes about an hour and twenty minutes to travel from Norwich along the A11, then two minutes off the A14 at Junction 32. Otherwise you can post it using a tracked service and we will receive it the following working day. We will contact you as soon as we have your drive and it is booked onto our bench.
If you're unsure of what to include in the box, please call us on 0800 689 0668 before sealing it. Or, for a first view on what we can do, you can use our free online diagnostic.
We provide a free diagnostic, a scope in writing, and images that verify. Ring the freephone and we will tell you what the machine can and cannot settle.