The laptop came back suspiciously clean, the leaver started with a rival on Monday, and the company needs to know what happened in the fortnight before the wipe. Forensic recovery is recovery that has to stand up under cross-examination, and we deliver it for Swindon and Wiltshire employers, insurers and solicitors with the documentation to match.
A free diagnostic on every forensic job. You get one fixed quote in writing before any work begins.
In most cases you only pay if we recover your data. Electronic and mechanical failures and chip-level work are 50% upfront, with the balance only if we recover your data, while BitLocker, ransomware, DVR and forensic jobs are paid upfront once you accept the fixed quote. You'll find full pricing on the data recovery cost page.
Every forensic job starts by matching the symptoms to the fault, and these twenty cover almost everything that reaches the bench.
Our most frequent instruction, and both the wipe and the behaviour leading up to it can usually be pieced back together.
Windows logs device serial numbers and connection times; set those against file-access records and the story assembles itself.
Transfers out through a private Gmail, Dropbox or WeTransfer account leave traces in histories, logs and leftover fragments.
Erased documents and mailboxes are recovered by carving, then presented under a defensible, hash-verified method.
Establishing when a file genuinely came into being, was read or was changed, pieced together from file-system records, journal entries and event logs.
Which confidential material moved, when it moved, and under whose account.
Company equipment is examined under company policy, often on instructions agreed by both sides' solicitors.
Files and footage recovered forensically for claims, defences and proceedings.
Neutral, fully documented findings for HR processes, insurers and tribunal hearings.
Examinations are run precisely to the joint directions agreed by the parties' solicitors.
CCleaner, BleachBit and similar tools sign their own work, revealing which tool ran, at what time, and what escaped it.
Sync artefacts from OneDrive and Google Drive map out what left through a personal account.
$I records outlive the emptying of the bin and timestamp every deletion: tiny artefacts with outsized value for the timeline.
Print spools and print history reveal data walking out on paper, which never shows up in a USB log.
Handsets stay outside our remit, but the phone backups and sync folders sitting on a PC are firmly inside it.
Internal metadata, revision history and journal entries give away a file dressed up to look older than it is.
Freelancers and subcontractors who copy drawings on their last day leave the same USB and cloud traces as staff.
Mass deletions from group mailboxes are timed, attributed to an account, and recovered where retention allows.
WhatsApp Desktop, Teams and Slack leave local caches that outlive the apps, and they are often the candid record a dispute needs.
VPN logs, event records and file access show whether an ex-employee's credentials kept working, and what they touched.
The pattern rarely varies. During the notice period, company files migrate to a USB stick, a private inbox or a cloud share, and a wiping tool or factory reset then cleans the machine before it is handed back. It looks empty, but it isn't. The wipe leaves its own evidence: which tool ran and, to the minute, when; which USB serial numbers appeared in the final weeks; which documents were opened just before each connection; what left through webmail; and which deleted files can still be carved back whole. It all goes into a readable report with the technical workings attached.
Nearly every forensic matter we take on falls into one of four moulds, and each has its own detailed page: a departing employee taking company data, where the copying itself must be evidenced; examinations in divorce and family matters, carried out lawfully through the solicitors on each side; disputes between partners and directors over records, access and who did what; and stolen intellectual property, meaning source code, designs and customer lists walking out of the door. The stories differ but the method is the same: write-blocked images, a rebuilt timeline and conclusions that survive scrutiny.
PassMark's OSForensics carries the investigative load: deleted-file recovery, full-drive indexing and search, USN-journal timelines, and artefact harvesting across USB history, browsers, downloads, webmail traces and recent-file lists. Passware Kit Forensic opens password-protected files and BitLocker volumes where the law permits. No examination ever runs on your original media. Everything is done from a hash-verified, write-blocked image that an opposing expert can independently confirm is exact.
The method is the deliverable: write-blockers from the first touch, verification by MD5, SHA-1 and SHA-256, custody documented without gaps, and reports split into readable findings plus a technical appendix so tribunals can rely on them. Joint instructions agreed between solicitors are welcome. The bright line is that a lawful basis must exist: hardware you own, company kit governed by company policy, or matters that come to us through solicitors and insurers. Covert inspection of someone else's private device is refused every single time, whatever the backstory.
The output of forensic recovery is evidence, so the tools and the method carry equal weight:
The investigation platform that does the heavy lifting: deleted-file recovery, sector-by-sector indexing and search, and artefact extraction across hundreds of formats, with OCR.
File times, USN change-journal entries and system logs are woven into a minute-by-minute account of what happened and exactly when.
What connected, when it connected, and which files were opened around each plug-in: the backbone of a data-theft case.
Where the law allows, locked files and BitLocker volumes standing in front of the evidence are opened.
Originals sit behind write-blockers from first contact and are imaged to duplicates whose MD5, SHA-1 and SHA-256 hashes prove them exact.
Custody is recorded without a gap from your hands into ours, and reporting is divided into readable findings and the technical appendix behind them.
One rule comes before every instruction: a lawful basis must exist, whether that's hardware you own, company kit governed by company policy, or a matter arriving through solicitors and insurers. Covertly prying into another person's private device is declined without exception, and forensic engagements are paid upfront once you accept the fixed quote.
Get a quote first, by phone or with the free online diagnostic. The drive has to be taken out of your computer before you send it to us. Not sure how? Phone us on 0800 689 0668, or a local PC repair shop will remove it for a small fee.
Treat the machine as an exhibit from this moment on: keep it powered off, with nobody signing in, nobody 'just checking' and no IT re-image, because every one of those tramples recoverable evidence. Jot down the relevant names and dates, get a quote first on 0800 689 0668 or with the free online diagnostic, then remove and label the drive (a local repair shop can take it out for you). We take the drive only, never the complete machine, and if the storage is soldered to the board, ring us first.
Most customers get a quote first, by phone or with the free online diagnostic, and then post or courier their media to us.
Sending a drive from a computer, laptop, MacBook, iMac, CCTV / DVR or server? Please remove the internal hard drive or SSD and send us just the drive (from a server, every disk, each labelled with its bay), as we don't offer a drive-removal service. We don't recover storage soldered to a motherboard (for example T2 and Apple Silicon Macs and some thin laptops), only drives that can be removed and sent to us. If you're not sure which kind you have, ring us first.
↓ Print the booking-in & shipping form (PDF)
Mark the package for the attention of Oxford Data Recovery and we'll ring you as soon as we've diagnosed your media.
Not sure what to send? Ring 0800 689 0668 first or use the free online diagnostic.
Free diagnostic and a fixed quote, with forensic work paid upfront once you accept it. Start now or call the freephone.