When a file has gone, two questions tend to matter. What was in it, and how did it leave. A disk usually retains enough to settle both. Volume snapshots, journal operations and bin records will between them show what a machine held, the way it got used, and the hour and the method by which something was taken off. Written for employers, solicitors and private clients across the North East who have a deletion in dispute.
◇ Footing first. Bench time after. The free diagnostic opens the job, a written scope follows it, and forensic fees clear ahead of any examination. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Full pricing is on the data recovery cost page.
Any matter in which the thing removed, and the hour of removal, both carry weight belongs here.
Deletion comes in grades, and each grade marks the disk differently. Drop a file into the recycle bin and a small record gets written alongside, holding the original path, the size and the instant of the drop. That record frequently outlives the emptying. Delete permanently and the bin is bypassed, but on a mechanical disk the only thing surrendered is the index entry; contents stay put until something else claims the space. Establishing which grade applied, and when, is the first job, and it often says a good deal about intention.
A timeline is just recorded events, arranged in sequence, out of sources that corroborate each other. Created, modified and accessed stamps come from the $MFT. $UsnJrnl logs the operations as they occur, so a rename or a removal appears at the moment it happened. $LogFile supplies fine grain around the minutes that count. Event logs name the account signed in and what it touched beforehand. Weighed against a file's creation date, the hour of its disappearance answers the useful question. Housekeeping, or timing?
One workstation holds several versions of its own past. Volume Shadow Copies, written for restore points and backups, retain earlier states of the disk, including material removed since and drafts from before an edit. Line a snapshot up against the live volume and whatever vanished between two dates is simply visible. That is often the neatest exhibit a deletion case can produce. Present on the 4th. Gone by the 12th. Journal puts the removal at the 9th.
Wiping software does not creep about quietly. Detection begins with what the tools leave lying around. Installer records and prefetch entries naming the program. Run times. The signature that overwriting spreads across a disk. And the conspicuous absence of traces that ought to be there. A wipe destroys content and manufactures evidence in the same pass: which utility, at what hour, under which account, and what it never reached. Half-finished runs are common, and whatever one of those leaves behind is recovered as normal.
The imaging and custody rules beneath this page live at the forensic recovery hub. Where sticks and cards are involved, carry on to USB device forensics. Whole-machine capture is workstation deep imaging. Figures are on the prices page.
Each source gets read against the rest, and the sequence stands on where they agree.
Original path, size and the instant of the drop, outliving an emptied bin.
Created, modified and accessed times, for live and removed files alike.
Creations, renames and removals, taken one operation at a time.
Which account was signed in around each removal, out of the system's logs.
Earlier states of the disk, still holding what has gone since.
The utility, the hour, the account, and everything it failed to reach.
Each instruction opens on the free diagnostic. Allow 2 working days from the date a device reaches this bench. Forensic casework sits outside no fix, no fee. The full forensic investigation with report is £800 + VAT, payable 100% upfront. The less expensive Forensic binary image and deleted-file extraction service, without the report, is £400 + VAT. Any Forensic work required will be payable upfront. You will find both figures repeated on the prices page, and we take nothing until a scope is agreed in writing.
Deletion instructions run on company machines, on hardware of your own, or on the say-so of a solicitor. Three doors in, and we have never found a fourth. Kit the business itself owns. A written instruction out of a solicitor, an insurer or from the court. Or else a device that genuinely belongs to the client, which in a matrimonial matter takes in one held between the two of them. Nothing gets hacked at this bench. Live traffic is never intercepted. Where the instructing client holds no right to look inside a device, we hold none either.
Everyday use costs a deletion case a little each day, so pull the machine and ring 0800 689 0668. No collection service is offered. It comes to Edinburgh tracked and insured, or across the counter, and joins the custody log the moment it is signed for.
Still bolted into a laptop, desktop, MacBook, iMac, server or CCTV / DVR box? Get the hard drive or SSD out first. The bare drive travels on its own. Stripping machines down is not a job this lab takes on. Flash soldered to a motherboard, as on Apple Silicon Macs and a couple of very thin laptops, is our one flat no: if it will not unbolt, it cannot be worked on.
↓ Print the shipping & booking-in form (PDF)
Address it for the attention of Edinburgh Data Recovery. From Aberdeen that is roughly 130 miles and two and a half hours down the A90, or next working day by tracked post if you would rather not make the run. You get a call the moment it is booked onto the bench.
Not sure what belongs in the box? Ring 0800 689 0668 before you tape it shut, or work through the free online diagnostic.
Take it out of service, ring the freephone, and let the sequence speak for itself.