A standard recovery will answer only one single question. Is everything that was lost available again? The forensic team's work is assessed after many months. This assessment will be made by someone who has been hired to find an error in that work. So we make a copy of the device, once. We enter the hash values on the record. The findings are then documented in such a manner that they may be lifted from the document by a sheriff. Our clients include energy and engineering companies (at Altens and Tullos), professional and legal offices along Union Street, processor facilities located up at Peterhead and Fraserburgh, and family owned businesses throughout Aberdeenshire and Moray.
◇ Footing first, then the bench time. It all begins with the free diagnostic, which is then followed by a written scope, and forensic fees must be paid before any actual examination can take place. Generally speaking, in most cases you only pay if we recover your data; the exceptions are electronic and mechanical failures, chip-level work, DVR jobs and forensic jobs. Full pricing can be found on the data recovery cost page.
The difference between forensic work and recovering data from a failing drive (or any device) is simply this: lifting files off a dying disk is engineering, and plenty of people can do it. Forensic work adds one thing on top, writing down how each file was recovered while the work happens. It is that documentation, not just the files themselves, that will survive a dispute or court case. We always perform our steps in the same order. Drive connected to a hardware write-blocker. Data copied into an evidence file (E01 container). Hash values for each are generated with SHA-256 hashing and then compared against one another. Exhibit placed in a tamper-evident package, clearly marked as evidence and logged into the custody log, at which time all questions regarding the findings are asked of the E01 copy and not the original. Findings carry a number, a date and the artefact they came out of. That is the whole gap between forensic work and a straight recovery, and it is what the fee buys.
Scotland is a separate legal jurisdiction within itself and therefore operates under its own laws, and this practice works inside them. Documents can be obtained through specification, or through a commission and diligence (where the court gives permission). Proceedings will be raised either in the sheriff courts or in the Court of Session. Tribunals for employment issues operate under the same statutory rules throughout Great Britain but follow Scottish procedures in Scotland. The two areas that are UK-wide and remain unchanged in all ways are the digital evidence principles that were written by ACPO and kept by the NPCC, and the Computer Misuse Act 1990.
Everything here falls into one of three categories. Detection and evidence recovery identifies what took place, whether on a machine, on a memory card, or within a cloud tenancy. Legal work and chain of custody involves the safekeeping of this material after detection: preservation, hashing, storage and log maintenance to ensure integrity during an adversary's analysis. Insider investigation applies the first two areas to a specific person during a set time frame.
Four services aimed at events. When material was destroyed and by what method. Files crossing onto cards and sticks. Departures via mailbox or cloud account. The whole drive lifted in one capture.
Evidence has an evidentiary value that is determined by how it is handled, and by how well that handling can be shown. So in this regard, evidence preservation, hashing, the physical storage of evidence and the custody log become a separate process. Drives from machines that were locked down or wiped out need to go to workstation deep imaging, where we lift BitLocker and FileVault drives while the keys for them are still available (FileVault only from Macs whose drive comes out; T2 and Apple Silicon Macs are not taken on), and then isolate erase runs with a date stamp.
The subject here is a person, not a box. Credentials used improperly, the paper trail a server generates without being asked, and then the four most common instructions we receive, which outnumber all the others put together.
You got here from wherever you were reading, that doesn't matter. The work we do with your evidence will be shown below.
There is a hardware write-blocker located between the original drive you provided and the bench we are working on. Therefore nothing we have done at our end can make changes to the drive you gave us.
When we copy data for use in the examination process, it is written as E01, an open format. This allows the opposing party's examiner to verify what has been found and perform their own analysis.
At the point of capture SHA-256 hashes are created for comparison with those created later on. If an image is changed it will fail the verification process (rather than being allowed to be processed).
Indexing, artefact extraction, recovery of removed material and timeline building are all performed in OSForensics. The exhibit remains sealed throughout.
Locked document files, sealed archive folders or encrypted partitions are opened using Passware if you have rights to view them. Otherwise they remain closed.
Everything about your exhibit, seals, signatures and movements, is recorded from when it arrives in our Edinburgh facility. It continues to be documented for every move until the exhibit is handed back to you.
All instructions start on the free diagnostic. We allow for 2 working days to pass after receipt of your device at this bench. We do not cover forensic casework under our normal payment terms, where in most cases you only pay if we recover your data. Full forensic examination (report included) costs £800 + VAT. This fee needs to be paid 100% upfront, prior to commencement. The lower cost option, the Forensic binary image and deleted-file extraction service (without report), will cost £400 + VAT. For all Forensic work provided, payment is due upfront. CCTV / DVR, BitLocker and ransomware cases fall into the Forensic class and are payable upfront on the same terms. Both costs appear on the prices page. Nothing is taken from you until a written agreement has been made regarding scope.
Most of this work comes directly from employers, HR departments and solicitors. We also take private clients on the same terms. At three doors into our process we've yet to find a fourth. Kit the business itself owns. A written instruction by way of a solicitor, insurer or court; alternatively, it may be a device that actually belongs to the client. In cases where there's a marriage dispute, this will include a device shared by both parties. Absolutely nothing is hacked here. Never are live internet communications intercepted. If the instructing client does not have the right to look inside a device then neither do we.
Don't think of an exhibit as simply something to be delivered; ring us for a quote first on 0800 689 0668, prior to your item being posted (we only need the hard drive from a machine, not the machine itself), and we will agree packaging options and also discuss paperwork and time frames. We do not have a collection service, therefore all items are sent tracked and insured, or handed in at reception at our Edinburgh location during opening hours, Monday to Friday, 9am to 5:30pm. No appointment is needed for this purpose. Custody opens once your item is signed for.
Still attached to a laptop, desktop, MacBook, iMac, server or CCTV/DVR unit? Remove the hard drive or SSD first. The bare drive travels on its own; when removing disks from a server remove all the disks and label each disk by its bay. This lab does not take machines apart. Any storage that has been soldered onto a motherboard (as in T2 and Apple Silicon Macs and a couple of thin laptops) will not be worked on: if it will not unbolt, we cannot work on it. If you're not sure what type of machine you have, ring us first. Phones and tablets are also not taken on.
↓ Print the shipping & booking-in form (PDF)
Your parcel should be addressed to Edinburgh Data Recovery, approximately two and a half hours (and 130 miles) from Aberdeen via the A90; alternatively it can reach us the next working day by tracked post if this journey time / distance is prohibitive to travel. As soon as your drive has been scheduled in we will contact you.
Still unsure about what should be placed inside of the packaging? Please call us first on 0800 689 0668, or use our free online diagnostic tool to assist you in deciding which items belong inside of the packaging before sealing.
We do a free diagnosis and provide a written scope. Our images check out, and if you ring our freephone number we can give you information as to what questions the machine answers and what questions it cannot answer.