When copying is suspected, the questions worth asking are specific ones. Which device. At what times it was plugged in. What files it was carrying. Windows can tell us most of those details without being asked, and we read the answers from a verified copy and write them down in order, for employers throughout Norfolk, from mid-county food and agricultural firms to the businesses along the A11.
◇ Scope first, then work. After the free diagnostic and the written scope, forensic casework is payable upfront on acceptance of the fixed price. For all other jobs, in most cases you will only be charged if we recover your data. Full pricing is set out on our data recovery cost page.
Sticks, cards and portable drives turn up in the middle of more disputes than any other exhibit we see.
Windows records information about every removable device it meets. The manufacturer, model and serial number of each stick, card reader or portable drive goes into USBSTOR. The date a device first appeared is fixed to the second by setupapi.dev.log. Further registry entries connect a device to the user profile that mounted it and hold the last time it was seen. Taken from a verified copy, that is a register covering the whole working life of the machine, including hardware nobody mentions until it turns up on the schedule.
A connection will show presence; a case usually needs movement. Jump lists and LNK records show company documents being opened from whatever letter the removable drive was given, along with paths and times. Shellbags hold the folder structure someone browsed on it, long after the device itself has gone. The change journal puts all the activity around it in order, minute by minute. If the stick is produced as well, an image of it finishes off the account: what is on it, when it arrived, and what has been removed since then.
Timestamps are worth close inspection, because copying leaves its own signature. When you copy a file onto another volume, the time it was copied is recorded as the file's creation time, however the modification time stays the same as it travels with the contents. So a document that says it was created at 23:41 but was last modified two years before that is recording the moment it was copied, and not when it was actually written. Put beside the register and the journal entries, that signature dates every transfer, and a cluster of them late at night rarely looks routine.
The work includes much more than just sticks. SD and microSD cards pulled from cameras, dashcams and agricultural drones, CF cards from older equipment, and portable SSDs all go through the same imaging and the same analysis. Memory card forensics works both ways here: documents are traced onto a card, and deleted photos and video are recovered from one. Where a card is the whole case, it is worked alongside the machine which wrote data to it, so that the accounts of each can cross check the other.
Method and custody are set out at the forensic recovery hub. Putting a date on a removal is covered at deleted-file forensics, while the employer casework this feeds into is at employee data theft. The cost of our services can be found on the prices page.
Each finding includes a date, the account it belongs to, and the trace behind it.
Each stick, card and drive the machine has met: make, model and serial number.
When each device first appeared and when it was last seen, down to the second.
Documents opened from the device's letter, with their paths and times.
The folder structure browsed on the device, held in shellbags.
Timestamp patterns that put a date on each transfer onto the device.
The media captured directly, and its deleted files restored.
Each instruction starts with the free diagnostic, which takes 2 working days from the day it arrives at the bench. Forensic casework is paid upfront on acceptance of the fixed quote, before work starts. The fixed price for the full investigation with report is £800 + VAT. The less expensive forensic binary image and deleted-file extraction service without report is £400 + VAT. Both figures also appear on the prices page, and no money will be taken until a written scope has been agreed. Send us the drives, not the machines.
Removable-media work may run on equipment owned by the company, on removable media the company issued, or on a solicitor's written instruction. There are three footings that open the door and there is no fourth: kit the company itself owns; a written instruction from a solicitor, an insurer or the court; or a device that genuinely belongs to the client, which in family matters means their own machine or one owned jointly. We do not hack. Live communications are not intercepted. If the client does not have a right to look inside a device, neither do we.
A stick and the drive from whichever machine wrote to it should be examined together. Please call us on 0800 689 0668 so we can agree the set with you; each item reaches our Cambridge location by tracked, insured post or over the counter, and goes into the custody file as it is signed for.
Is the drive still bolted inside a laptop, desktop, MacBook, iMac, server or CCTV / DVR recorder? Before sending, remove the hard disk drive (HDD) or solid state drive (SSD), as we do not accept whole units. From a DVR or recorder, send just the disk. From a server or RAID, take out the disks and clearly label each disk by bay number. A network attached storage (NAS) device may be sent as its disks if they can be removed; otherwise please send the NAS itself. There is only one type of drive we are unable to accept: storage soldered onto a motherboard (e.g. Apple Silicon Macs, extremely thin laptops). In such cases, if the storage cannot be taken out it cannot be accepted. If you are unsure whether you have a removable drive or not, call us before sending anything.
↓ Print the shipping & booking-in form (PDF)
Please mark the parcel for the attention of Cambridge Data Recovery. It takes about an hour and twenty minutes to travel from Norwich along the A11, then two minutes off the A14 at Junction 32. Otherwise you can post it using a tracked service and we will receive it the following working day. We will contact you as soon as we have your drive and it is booked onto our bench.
If you're unsure of what to include in the box, please call us on 0800 689 0668 before sealing it. Or, for a first view on what we can do, you can use our free online diagnostic.
Do nothing to change the state of the machine, keep hold of the stick, and call the freephone.