Where copying is suspected, the questions will be focused. What was the device. During which time frame (hours) was the device connected. What was it carrying. The majority of this information can be supplied automatically by Windows. We take that information from a verified copy and place it into an organised format for employers throughout the North East, from processing plants at Peterhead and Fraserburgh to survey operations at Dyce.
◇ Footing first, then the bench time. It all begins with the free diagnostic, which is then followed by a written scope, and forensic fees must be paid before any actual examination can take place. Generally speaking, in most cases you only pay if we recover your data; the exceptions are electronic and mechanical failures, chip-level work, DVR jobs and forensic jobs. Full pricing can be found on the data recovery cost page.
More than just about anything else we receive, sticks, cards and portable drives end up as the subject of dispute as well as argument.
Windows keeps track of all portable devices it has encountered. The USBSTOR key logs the make, model and serial number of every flash memory device, card reader and external hard drive. The setupapi.dev.log file then pins each device's first appearance (first seen) down to the second. Then there are other keys which connect a device to the exact profile used when mounting, and also log when it was last seen. Extracted from a verified copy, this register covers the entire lifetime of a working computer, including hardware no one mentions until it appears on a schedule.
Presence doesn't prove a case. Typically you need some type of movement. LNK records and jump lists record company documents that were opened from whatever letter the portable volume was given (with path and time included). Shellbags keep the folder tree that someone browsed on the volume, and they keep this information even after the device has been removed. The change journal holds the activity that occurred around the files on the drive, minute-by-minute. Provide the stick itself and its own image will complete your story: what is currently on it, when it arrived there and what has been taken away since.
Timestamps are important as they leave their own mark when copied. When you make an exact copy of a file on another volume then both the created timestamp (the time of the copy) and modified timestamp (which stays intact with the copied file's content) will be recorded. Therefore if a document has apparently been "created" at 02:07 but was "last modified" three years earlier, then it is reporting the copy, not the original writing. If you were to put that copy alongside the register and the journal, for example, then every single transfer would have a date associated with it. It can therefore appear unusual to see a run of these transfers taking place outside of normal working hours and could potentially be perceived as something other than routine maintenance.
This forensic work can go far beyond standard flash drives. SD and microSD cards removed from cameras, dash cams and survey drones; CF cards from older devices; external SSDs; all are imaged and analysed with the same methodology. Memory card forensics has two applications in this area. First, documents can be traced onto a memory card. Second, deleted photos and videos can be recovered off a memory card. If the memory card is the whole case, then that card would be worked alongside the hard drive from the computer used to write information to it, so each account helps keep the other honest.
Method and custody both fall under the forensic recovery hub, while for dating deletions you should follow the link to deleted-file forensics. The employer casework this feeds is covered by employee data theft. Costs can be found on our prices page.
Each finding is tagged with a date and the account it belongs to, along with the corresponding supporting artefact.
All sticks, cards and drives that machine has ever seen, as well as who made them, what model they were, and what their serial number is.
Date of first appearance and last time it was seen, for all devices, fixed to the second.
Documents opened off the device letter, with paths and hours attached.
The directory structure walked through on the device, held in shellbags.
How the stamp patterns put a date on each copy made onto the device.
The media itself captured too, with contents that have been deleted restored.
Every instruction starts with the free diagnostic, and you should allow 2 working days from the date a device reaches this bench. Forensic work is not covered by our usual payment terms, where in most cases you only pay if we recover your data. The full forensic investigation with report costs £800 + VAT and must be paid 100% upfront. The less expensive Forensic binary image and deleted-file extraction service (which does not include a report) will cost £400 + VAT. All Forensic services are required to be prepaid. Both figures are repeated on our prices page and we do not take anything until we have agreed upon a scope of works in writing.
Portable-media work is done on your business's devices and portable media you issue to employees, and/or on written instruction from your solicitor. There are three doors in, and we haven't seen a "fourth" door. Kit the business itself owns. A written direction from a solicitor, an insurer or from the court. Or a genuine client owned device (in matrimonial matters this includes a device held jointly with another). Nothing is hacked here. No live traffic will ever be intercepted. If the instructing client does not have a legal right to view what's inside a given device, neither do we.
A stick, plus the hard drive from whatever machine wrote to it, is best viewed as a pair. Call us on 0800 689 0668 for a quote first and we will agree the set with you. We do not offer collection, therefore every item sent to Edinburgh is tracked and insured, or can be handed in across the counter (Monday to Friday, 9am to 5:30pm, no appointment needed), and is signed for when taken into our custody log.
Still attached to a laptop, desktop, MacBook, iMac, server or CCTV/DVR unit? Remove the hard drive or SSD first. The bare drive travels on its own; when removing disks from a server remove all the disks and label each disk by its bay. This lab does not take machines apart. Any storage that has been soldered onto a motherboard (as in T2 and Apple Silicon Macs and a couple of thin laptops) will not be worked on: if it will not unbolt, we cannot work on it. If you're not sure what type of machine you have, ring us first. Phones and tablets are also not taken on.
↓ Print the shipping & booking-in form (PDF)
Your parcel should be addressed to Edinburgh Data Recovery, approximately two and a half hours (and 130 miles) from Aberdeen via the A90; alternatively it can reach us the next working day by tracked post if this journey time / distance is prohibitive to travel. As soon as your drive has been scheduled in we will contact you.
Still unsure about what should be placed inside of the packaging? Please call us first on 0800 689 0668, or use our free online diagnostic tool to assist you in deciding which items belong inside of the packaging before sealing.
Do nothing to move the machine and do not let go of the stick; call the freephone number.