Where copying is suspected, the questions worth asking are narrow ones. Which device. Plugged in at what hours. Carrying which files. Windows answers most of that without being asked, and we read the answers off a verified copy and set them down in order — for employers across Norfolk, from mid-county food and agricultural firms to the businesses along the A11.
◇ Scope first, then work. The free diagnostic comes at the start and the written scope follows it; forensic fees are paid in full before an examination begins. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Full pricing is on the data recovery cost page.
Sticks, cards and portable drives turn up at the middle of more arguments than any other exhibit we see.
Windows notes each removable device it meets. Manufacturer, model and serial number for every stick, card reader and portable drive go into USBSTOR. The date one first appeared is fixed to the second by setupapi.dev.log. Further registry entries link a device to the profile that mounted it and hold the last time it was seen. Extracted from a verified copy, that is a register covering the whole working life of the machine, hardware included that nobody mentions until it turns up on the schedule.
A connection establishes presence; a case usually needs movement. Jump lists and LNK records catch company documents being opened from whatever letter the removable volume was given, paths and times attached. Shellbags hold the folder structure somebody browsed on it, long after the device has gone. The change journal puts the surrounding activity in order, minute by minute. Where the stick is produced as well, its own image rounds the account off: what is on it, when it arrived, and what has been taken off since.
Timestamps repay a careful eye, since copying leaves a signature of its own. Copy a file onto another volume and its creation time is stamped with the moment of the copy, while its modification time comes along unchanged with the contents. A document that appears to have been created at 23:41, yet was last modified two years before that, is therefore reporting the moment of the copy rather than the moment of writing. Put beside the register and the journal entries, the signature dates every transfer — and a cluster of them after hours rarely looks routine.
The discipline covers rather more than sticks. SD and microSD cards out of cameras, dashcams and agricultural drones, CF cards from older equipment, portable SSDs — all go through the same imaging and the same analysis. Memory card forensics runs both ways here: documents are traced onto a card, and deleted photographs and video are brought back off one. Where a card is the whole case, it is worked alongside whichever machine wrote to it, so that each account keeps the other honest.
Method and custody are set out at the forensic recovery hub. Putting a date on a removal carries on at deleted-file forensics, while the employer casework this work feeds sits at employee data theft. Costs are on the prices page.
Every finding carries a date, an account it belongs to, and the trace behind it.
Each stick, card and drive the machine has met: manufacturer, model, serial.
When each device first appeared and when it was last seen, to the second.
Documents opened from the device's letter, with their paths and hours.
The directory structure explored on the device, held in shellbags.
Timestamp patterns putting a date on each transfer onto the device.
The media captured in its own right, and its deleted contents restored.
Each instruction opens with the free diagnostic, which takes 2 working days from the day a device reaches the bench. Forensic casework itself falls outside no fix, no fee. The full forensic investigation with report is £800 + VAT, payable 100% upfront. The less expensive Forensic binary image and deleted-file extraction service, without the report, is £400 + VAT. Any Forensic work required will be payable upfront. Both figures also appear on the prices page, and no money is taken until a written scope has been agreed.
Removable-media work runs on company machines and on media the company issued, or on a solicitor's written instruction. Three footings open the door and there is no fourth: kit the company itself owns; a written instruction from solicitors, an insurer or the court; or a device that is genuinely the client's, which in a family matter means their own machine or one owned jointly. We do not hack. Live communications are not intercepted. Where a client has no right to look inside a device, neither have we.
A stick and whichever machine wrote to it are best looked at together. Call 0800 689 0668 and we will agree the set; each item reaches our Cambridge location by tracked, insured post or over the counter, and goes into the custody file as it is signed for.
Is the drive still bolted inside a laptop, desktop, MacBook, iMac, server or CCTV / DVR recorder? The hard drive or SSD needs to come out first, and only the bare drive travels — taking drives out of machines is not something we do here. Storage soldered to a motherboard (Apple Silicon Macs, one or two very thin laptops) is the single thing beyond us: if it will not come out, it cannot come in.
↓ Print the shipping & booking-in form (PDF)
Mark the parcel for the attention of Cambridge Data Recovery. From Norwich it is about an hour and twenty down the A11, then two minutes off the A14 at Junction 32 — or next working day by tracked post. You hear from us as soon as it is booked onto the bench.
Unsure what to put in the box? Ring 0800 689 0668 before you seal it, or run the free online diagnostic.
Leave the machine as it stands, hold on to the stick, and ring the freephone.