When a document is lost (or deleted), there are generally two issues that need answering. First, what information was in the document? Second, how did it leave? Generally, a disk can provide sufficient details on these issues. It does so through a combination of volume snapshots, journal operations and bin records. These three things together detail what a machine held, how it was used, when something was removed from the system and how it was removed. Written primarily for employers, solicitors and private clients within the North East whose case involves a disputed deletion.
◇ Footing first, then the bench time. It all begins with the free diagnostic, which is then followed by a written scope, and forensic fees must be paid before any actual examination can take place. Generally speaking, in most cases you only pay if we recover your data; the exceptions are electronic and mechanical failures, chip-level work, DVR jobs and forensic jobs. Full pricing can be found on the data recovery cost page.
This category is anything where what was removed, and when it was removed, are both relevant.
There are different levels of deletion, with each level marking the disk differently. When you delete files to the recycle bin, Windows makes a small entry that has information, for example, what directory it was located in (the "path"), its size and when you deleted the item. These records frequently outlive the emptying of the bin. When you delete files permanently, they do not go through the recycle bin process. However, if you have a mechanical hard drive (i.e., not SSD), when you delete a file permanently, only the reference point to where the data is stored is removed. The data itself remains there, until something else writes over the area. Working out which level of deletion was used, and when, is the first job, and it often says a good deal about intent.
A timeline is simply all events documented in chronological order based on evidence from multiple sources that back each other up. The $MFT provides created, modified and accessed stamps. The $UsnJrnl (the change journal) records events as they happen so you can see the operation to rename or delete occurred when it did. The $LogFile will provide fine detail around those critical minutes. The event logs tell us which account was logged in and what it touched before the deletion. When compared to a file's date of birth, the hour of death helps answer the important question. Was this housekeeping, or was it timing?
A single workstation has numerous previous versions of itself. Volume Shadow Copies, made to help with restore points and backup, keep older versions of the disk (including files deleted after that time) along with various draft versions of files prior to being edited. Line a snapshot up against the live volume and the difference between two dates will show you what went missing. This is typically one of the neatest exhibits a deletion case can produce. It was there on the 4th. It was gone by the 12th. The journal shows it was removed on the 9th.
A wiping tool doesn't work in stealth mode. Detection starts with the things left behind by these programs. Installer logs and prefetch entries with the name of the wiping program; run times of the wiping program; the "signature" that overwriting spreads across a disk; and the conspicuous lack of trace data that should have existed. A wipe removes the content from the media and creates an evidentiary trail during the same single operation: what tool was used, at what time, under which account credentials, and what part of the disk it never reached. It is common for a wiping program to only partially complete its task, and whatever a half-finished run leaves behind is recovered as normal.
Rules for imaging and custody can be found at the forensic recovery hub, USB device forensics for sticks and cards, workstation deep imaging for full-drive capture, and figures on the prices page.
Each source is compared with all other sources and the sequence will follow wherever there is agreement.
Original file path; original file size; exact date and/or time of deletion; still there even after the recycle bin is emptied.
Created, modified and accessed times, for live and removed files alike.
Creations, renames and removals, taken one operation at a time.
Which user ID was used to sign into the computer as each deletion occurred, based upon system logs.
Earlier states of the disk, still holding what has gone since.
Utility name; hour it ran; user ID of the operator; anything else that the utility was unable to delete or remove.
Every instruction starts with the free diagnostic, and you should allow 2 working days from the date a device reaches this bench. Forensic work is not covered by our usual payment terms, where in most cases you only pay if we recover your data. The full forensic investigation with report costs £800 + VAT and must be paid 100% upfront. The less expensive Forensic binary image and deleted-file extraction service (which does not include a report) will cost £400 + VAT. All Forensic services are required to be prepaid. Both figures are repeated on our prices page and we do not take anything until we have agreed upon a scope of works in writing.
Deletion investigations are carried out on a machine owned by the company, on the client's own equipment, or with the permission of a solicitor. There are three doors in, and we can find no door number four. Kit the business itself owns. A written instruction, either as a letter from a solicitor, an insurance company or a court. Or otherwise a piece of kit belonging to the client, and where the clients are in a matrimonial situation this includes something they both jointly possess. No hacking occurs here. We do not intercept live traffic. When the client who gave the instruction does not have a legal entitlement to see into a device we do not either.
Everyday use of the machine will cost a deletion case a little more each day, so pull the equipment out of use and get a quote first by calling us on 0800 689 0668. No collection service is provided. We only need the hard drive, not the machine: take the drive out and send it to Edinburgh via tracked and insured post, or hand it in over the counter, Monday to Friday, 9am to 5:30pm, with no appointment needed, and it joins the custody log the moment it is signed for.
Still attached to a laptop, desktop, MacBook, iMac, server or CCTV/DVR unit? Remove the hard drive or SSD first. The bare drive travels on its own; when removing disks from a server remove all the disks and label each disk by its bay. This lab does not take machines apart. Any storage that has been soldered onto a motherboard (as in T2 and Apple Silicon Macs and a couple of thin laptops) will not be worked on: if it will not unbolt, we cannot work on it. If you're not sure what type of machine you have, ring us first. Phones and tablets are also not taken on.
↓ Print the shipping & booking-in form (PDF)
Your parcel should be addressed to Edinburgh Data Recovery, approximately two and a half hours (and 130 miles) from Aberdeen via the A90; alternatively it can reach us the next working day by tracked post if this journey time / distance is prohibitive to travel. As soon as your drive has been scheduled in we will contact you.
Still unsure about what should be placed inside of the packaging? Please call us first on 0800 689 0668, or use our free online diagnostic tool to assist you in deciding which items belong inside of the packaging before sealing.
Remove the computer from service, call our freephone number and allow the series of events to define itself.