A returned laptop has only one forensic opportunity, between being handed back and being rebuilt. If the image is taken within this time frame, by reading data from the laptop's drive through a write blocker, placing the data into an E01 container and checking it against SHA-256 hash values, it can answer many questions for several years after. Once it is placed back into use, the number of answers it will provide decreases each week. For employers running rotating crews out of Dyce and the heliport, the rule can be stated as follows: questions keep, images do not.
◇ Footing first, then the bench time. It all begins with the free diagnostic, which is then followed by a written scope, and forensic fees must be paid before any actual examination can take place. Generally speaking, in most cases you only pay if we recover your data; the exceptions are electronic and mechanical failures, chip-level work, DVR jobs and forensic jobs. Full pricing can be found on the data recovery cost page.
Any one of these will put a machine on the list, well ahead of the rebuild queue.
The sums here are unbalanced. Think about how much it costs to take the hard drive from this computer behind a write-blocker, put it in an evidence container (E01) and check its SHA-256 hash, when compared to how much that same material will be worth after a dispute exists and the company wants to use it as part of their case. After the hardware is used for evidence collection it gets immediately returned to service because the evidence stops existing on that piece of equipment. Do not capture the image, allow someone else to use your laptop, and you'll have layers of the new user's daily usage layered over the old user's residual activity. Companies that make leaver captures routine are never the ones having to explain a gap.
There is far more than the documents. Browsing history, cache and cookies piece the research and the uploads back together. Temporary folder locations are where draft versions and copies that nobody ever chose to save are kept. Whatever sat in memory was left behind as fragments; some may be an open document or chat window, sometimes a credential; these survive within the page file and the hibernation file. Conversations from local Teams and Slack cache files are retained even after deletion from within each application. VPN and network connectivity logs will provide information on what networks were used by the computer and at what time. This can be completely removed using a complete rebuild. However, if you want to keep everything, you would need to create a capture.
Encryption provides benefits to those that can move quickly. An image of an encrypted drive (BitLocker, or FileVault on a Mac whose drive comes out; T2 and Apple Silicon Macs are not taken on) should be captured while the keys are still held in escrow and when passwords have yet to be changed. This typically occurs prior to closing out the leaver's user account; cleaning up directories; and/or rebuilding the computer, thus clearing the TPM. If a Windows volume is currently "live" and "unlocked", there is another way to proceed: by capturing Volume Shadow Copies from a running operating system. Volume Shadow Copies will bypass the encryption issue since the volume is already "open" for you. All work on encrypted drives is considered Forensic and, as with the rest of this page, payable upfront as soon as our agreement regarding your project scope is complete.
Claims of completely wiping are always scrutinised rather than accepted at face value. The boot tools and erase utilities (DBAN among them) all produce evidence that can be traced. Boot records. The specific signatures that exist for each utility. And whatever overwriting pattern it has created on those disks. How long it took, which may provide a way to compare against what else was going on during that time frame. It's also common that attempts to completely erase a disk will stop mid-stream leaving large portions of data still recoverable. On the other hand, if a hardware erase command was issued, this would show up in the internal log of the hard drive. If we determine that a disk was actually wiped completely, then we'll note that and include the date, as erasing a disk intentionally with proceedings coming is another piece of evidence.
Verification and custody are handled by the forensic recovery hub. Deletion evidence on a copy (see deleted-file forensics), the duty to preserve (legal hold and chain of custody) and pricing (the prices page) are all found on this website.
Taken once, verified once, and available for as long as required for whatever the disputed matter asks later.
All data on the entire disk in a format any other examiner can read and check.
SHA-256 hash value proving each image has not been altered, including each copy made from that original image.
History, cache and cookies, which rebuild research and uploads.
Pagefile and hibernation contents: documents, chats, credentials.
Local Slack and Teams stores, with removed conversations returned.
VPN traces and network tracing data to identify that the machine was in use on a given network at a given time.
Each of the services starts at the point of the no-charge diagnostic. We allow 2 working days for it from the date a device has arrived. Forensic casework does not fall within our typical payment structure, where in most cases you only pay if we recover your data. The full forensic examination and associated report is £800 + VAT, payable 100% upfront. The lower cost Forensic binary image and deleted-file extraction service (without the report) is £400 + VAT. Any Forensic work undertaken will be payable upfront. In particular encrypted volumes (BitLocker etc.) are considered as Forensic-classed work and would also be subject to the same terms, payable upfront. Both prices appear on the prices page and we do not charge for anything until a written scope of works is agreed.
Imaging occurs on computers owned by the company, on hardware you own yourself, or under an instruction from a solicitor. There are three doors in, and we've never seen a "fourth". Kit the business itself owns. A written direction from a solicitor, an insurance company, or the court. Or else the device actually belongs to the client, which in matrimonial matters includes a device held jointly by both parties. No hacking takes place at this bench. We do not intercept live traffic. Where the instructing client has no authority to view what's contained within a device, neither does our firm.
Ring 0800 689 0668 to let us know how many machines you have and where you stand on encryption. The capture then gets scoped in writing. There is no collection service. Once you have your quote, drives are tracked and insured when they travel, or you can bring them in to the counter at Edinburgh (Monday to Friday, 9am to 5:30pm), and please note that no appointment is needed. Custody runs from the signature.
Still attached to a laptop, desktop, MacBook, iMac, server or CCTV/DVR unit? Remove the hard drive or SSD first. The bare drive travels on its own; when removing disks from a server remove all the disks and label each disk by its bay. This lab does not take machines apart. Any storage that has been soldered onto a motherboard (as in T2 and Apple Silicon Macs and a couple of thin laptops) will not be worked on: if it will not unbolt, we cannot work on it. If you're not sure what type of machine you have, ring us first. Phones and tablets are also not taken on.
↓ Print the shipping & booking-in form (PDF)
Your parcel should be addressed to Edinburgh Data Recovery, approximately two and a half hours (and 130 miles) from Aberdeen via the A90; alternatively it can reach us the next working day by tracked post if this journey time / distance is prohibitive to travel. As soon as your drive has been scheduled in we will contact you.
Still unsure about what should be placed inside of the packaging? Please call us first on 0800 689 0668, or use our free online diagnostic tool to assist you in deciding which items belong inside of the packaging before sealing.
There is only one capture needed to get every answer left out of that machine. Call the freephone number.