At times, this task may not simply be recovering data; instead you may need to demonstrate, later and under challenge, specifically what data existed, where it was located and whether there has been any modification. This is the distinction between recovery and forensic data acquisition; both require similar technical skills, but the discipline associated with forensics can be utilised within the context of the courtroom. Our data capture service exists for solicitors, employers, insurers and private individuals in Glasgow who will require sufficient evidence to withstand scrutiny as opposed to merely having files recovered.
Each and every exhibit received into our possession is captured via a hardware write blocker, which renders it impossible to modify the original medium during the capture process, prior to being fully imaged (including deleted areas). Each image received is subsequently hash-verified, an additional layer of security provided through the creation of a digital fingerprint at the time of capture which establishes an immutable relationship that confirms the working copy matches the source media bit for bit. All subsequent examination and analysis occurs from a verified working copy of the source media. All examinations and analysis of exhibits occur in accordance with a chain of custody, providing documented proof of who had what and when, at each and every stage from arrival to return. All exhibits are stored sealed and secure.
Once this data, live file(s), deleted file(s) or fragment(s), has been recovered, it is documented with its pedigree: what was recovered as well as where on the media it was located and how.
The most important thing for forensic investigators is authority, not equipment. That means using your own devices, using devices owned by your company with a solid plan/policy behind them, using media provided under direction from a solicitor, or collecting evidence with the permission of the item's owner. Anything that appears to be accessed secretly (including a partner's phone, a former employee's personal computer/laptop) should be denied immediately. Denying will help protect both sides; evidence collected outside of legitimate reason tends not to survive when it arrives at court where it would have been expected to prevail.
Not sure which category your case falls into? Ask: the answer will be provided to you for nothing and in good faith. If we can substantiate the basis of this then this will form part of the documentation with your file.
A former employee's company computer needs to be preserved prior to being reissued by an employer. Deleted e-mails are required to be retrieved and reported as evidence in a commercial dispute on behalf of a solicitor. Evidence from the condition and contents of a drive may be needed by an insurer when there has been a loss. A deceased family member's photos need to be recovered with the estate's authority, while maintaining their dignity and respect. Each case results in three things: verified data; a clear, easy-to-read report that is understandable to a non-technical individual; and an engineer who can vouch for the work he or she completed should they be called upon.
Because every job is so different, we quote an individual price, in writing after you have had the complimentary assessment, prior to beginning any paid services. Every job has a free diagnostic, the figure will go in writing prior to performing any paid service and, generally speaking, if we don't recover your data, you owe us nothing. There is no time clock running. There is no evaluation charge. And there is never a percentage of what your records or other information may be worth.
The cost of forensic recovery is based on additional documentation required to prove that the recoverable evidence is in a state of integrity, and it is quoted per instruction. Standard recovery is aimed at getting your data back; forensic recovery provides verified integrity of recovered information through write-blocked capture, hashing, custody logs and reporting, so the findings survive challenge. If the client has assurance that their results are unchallengeable (no one is going to question them), they should select standard recovery as it is less expensive, and we'll say so.
No, there is no legal reason for us to look at another adult's devices without their consent, whatever the suspicion. If they do give their consent, or if a solicitor instructs us during proceedings, then we will conduct the search as per our usual methods with all details of how we conducted the search being recorded. We'd rather lose the job than hand you evidence that collapses.
Everything. Do nothing: Don't reissue the laptop, don't allow IT to "look" at it, do not reset the accounts yet. Power the machine off and record who has had access to the machine. Forensic value decays with every well-meant login; a machine that is preserved in its state (if done correctly) can allow for the display of activity (including copying/deletion/exfiltration) by showing clean timelines.
It's built for one. The method of investigation, the verification process (hash), an account of all those involved in the handling of the device, findings expressed in everyday language and exhibits referred to throughout: all are expected by solicitors and tribunals. When there is need for further oral evidence or clarification then the engineer responsible for doing that work will be available. Please tell us what type of hearing you want this report for when you instruct and we shall tailor it accordingly.
Before you drop your device off or post it, please get a quote from us by phone or using the form first. Then there are two honest routes for dropping off and delivery. No vans. Hand in the device at Tay House, 300 Bath Street (right at Charing Cross, two minutes off the M8) Monday to Friday, 9am–5:30pm, without need of an appointment. Or wrap the device well and send by insured, tracked post from anywhere in the UK. All work is done in-house by our own engineers. We have documentation of the complete chain of custody and your data never leaves the UK.
The worst evidence you can have is the best intentioned: messed with, booted, and hopelessly altered. The cost of forensic work starts from £800 + VAT and will be agreed on a written quotation once we complete your free review. Forensic data recovery and data capture for Glasgow: the data will be write-blocked, hash-verified, logged into custody logs and reported so that it has legal standing.