An employee leaves, a laptop comes back suspiciously empty, and the business needs to know what happened before it was wiped. Forensic recovery is data recovery with the burden of proof attached, and it is some of the most important work we do.
Free diagnostic on every forensic job. You get one fixed price, quoted in writing before any work starts.
On most jobs, you only pay if we recover your data. For electronic, mechanical and chip-level work, we'll take half up front and the rest only if we're able to recover your data. Jobs involving BitLocker, ransomware, forensic or CCTV/DVR work are paid upfront once you accept the fixed quote. Complete pricing can be found on the data recovery cost page.
Every forensic job starts by comparing the signs on a computer with the possible faults, and these ten cover almost all of the jobs brought into the lab.
This is the case we handle most often: traces of the wipe, the tool used and the activity before the wipe can usually be reconstructed.
Windows keeps a record of which USB devices were attached and at what time; coupled with an examination of file access, it can show which files may have been copied.
Uploads to webmail, Dropbox, Google Drive or WeTransfer leave traces that can be found in history, logs and file remnants.
Deleted documents and emails are carved back and presented using a defensible method that uses hashes for verification.
When a file was actually created, opened or changed, rebuilt from the file system, the USN journal and logs.
Identifying which confidential material was accessed, copied or removed, as well as the account used to do so.
Evidence-grade investigation of company equipment, carried out under company policy and often through solicitors.
Forensic recovery of footage and device data to support a claim or a case.
Documented, impartial findings that support internal HR processes, insurers and tribunals.
Forensic examinations are carried out to directions agreed between the legal teams of the parties involved.
This is one of the most common stories we deal with for employers. An employee copies company data off their work laptop onto a personal USB stick, sends it to a personal email account or uploads it to a cloud drive. Then they wipe or reset the laptop before handing it back, hoping all trace of what they did will be erased. The employer is left with a laptop that looks empty and a strong suspicion that something left with the person. This is exactly what forensic recovery is built for. Even though the laptop appears to have been wiped clean, a great deal survives: which wiping tool was used and exactly when it was run, which USB devices were connected in those final weeks and what was opened just before they were, what was uploaded to webmail or cloud storage, and deleted files carved back from the drive. We turn those traces into a detailed, plain-English forensic report you can act on.
The forensic bench runs OSForensics (the PassMark investigation suite) for the heavy lifting: finding deleted files; indexing and searching across an entire drive; building a minute-by-minute timeline of user activity from file-system timestamps and the Windows USN journal; and extracting the artefacts that matter, such as connected-USB history, browser and download histories, webmail traces, Wi-Fi connections and recently used files. Alongside OSForensics, the bench also runs Passware Kit Forensic to open password-protected or encrypted files and BitLocker volumes that stand in the way, where doing so is lawful. All operations are carried out on a hardware write-blocked, hash-verified image of the source media, so no alterations are made to the original and anyone can verify that the copy is exact.
The forensic element of our recovery process comes from the procedure applied at each stage: originals are write-blocked from first contact; each image is verified with a cryptographic hash (MD5, SHA-1, SHA-256); a documented chain of custody runs from you to us; and reporting is split into two sections, clear findings and a technical appendix, so it can withstand scrutiny in a tribunal or court. We are happy to work to directions agreed between solicitors. There is one boundary, and we state it plainly: forensic work needs a lawful basis, meaning your own devices, company equipment under company policy, or matters instructed through solicitors and insurers. We don't provide covert access to someone else's private device, however strong the suspicion, but where there is a legitimate route, we'll take it properly.
Forensic work is evidence, not just data, so it needs procedural and technical accuracy at every step:
Our core investigation suite covers deleted file recovery, whole-drive indexing and search, and artefact extraction across hundreds of file types, including optical character recognition (OCR).
A minute-by-minute reconstruction of file and system activity based on timestamps, the USN change journal and system logs: what happened, and exactly when.
The main focus when investigating data theft is which outside devices were plugged in and at what time, and what was accessed at around the same time.
Where it's lawful, we open password-protected and encrypted files, along with BitLocker volumes, that stand between the investigation and the evidence.
Every original is write-blocked from first connection and then imaged to create a hash-verified copy of its content (using MD5, SHA-1 and SHA-256). Any party involved can use the hashes to prove the copy is identical to the original.
Custody is documented from the moment the device leaves your hands to the moment it reaches ours. Reports come in two parts: findings in plain English, and a technical appendix built to stand up in a tribunal or court.
One boundary, stated plainly: forensic work needs a lawful basis. Our investigations are limited to your own devices, company-owned equipment under company policy, or matters instructed through solicitors or insurers. We never offer any form of covert access to someone else's private device.
Get a quote first with the free online diagnostic or by phone, then remove the drive from your computer before sending it to us. Unsure? Call 0800 689 0668 for help, or have a local PC repair shop remove the drive for a small charge.
If you have a forensic case involving a device, leave it just as it was (turned off) and do not allow anyone to log in, 'take a look' or re-image it, since all of these actions will overwrite evidence that could potentially be recovered. Record the dates and names associated with the inquiry. First get a quote by calling 0800 689 0668 or completing the free online diagnostic, then pull out the drive and post it to us labelled (we take the drives, not the computers). If the entire computer needs to be preserved as evidence, call 0800 689 0668 first to arrange handling under a documented chain of custody.
Our customers get a quote first, before sending their media to us, either by telephone on 0800 689 0668 or by completing our free online diagnostic. Once a customer has their quote, they post their media to us, tracked and insured.
Sending a drive from a computer, laptop, MacBook, iMac, CCTV / DVR or server? Please remove the hard drive or SSD from your machine and send us just the drive; we do not offer an internal drive-removal service. If you have a server or RAID system, please send us every disk, each clearly labelled with its bay. We cannot recover data from storage that is soldered directly onto the motherboard (for example Apple Silicon Macs and some thin laptops), so we need removable drives to be sent to us. If you are unsure which kind you have, ring us first.
↓ Print the booking-in & shipping form (PDF)
Mark your package for the attention of Leeds Data Recovery and we will contact you as soon as we have diagnosed your media.
Unsure about what to send? Call us first on 0800 689 0668 or complete our free online diagnostic.
Receive a free, no-obligation diagnostic and a fixed price quote for your forensic case. The price is taken upfront when you agree to proceed. Get started now or call our freephone.