Mobile Phone and Tablet Data Recovery (Including Chip-Off)

Phones now hold more personal and business data than any other device; a phone that won't start can mean losing years of photos and messages.

Mobile data is usually stored encrypted, and the methods available vary by make, model and OS version. Results therefore depend on the device, and a preliminary review is needed first.

As soon as you notice data loss, stop using the device. Every further use increases the chance that deleted data is overwritten.

Do not try off-the-shelf recovery software, do not open the device yourself and do not hand it to a repair shop before speaking to us.

If the phone has been in water, do not charge it, switch it on or try to dry it out.

• Assessment of the device's make, model, OS and physical condition
• Selection of the appropriate extraction method
• Recovery of photos, videos, messages, contacts and app data
• Recoverability assessment for deleted data
• Data retrieval after repair of water- or impact-damaged devices
• Data retrieval directly from the memory chip using chip-off
• Analysis of the recovered data
• Reporting of findings in line with forensic practice

We try the least intrusive methods first. If they do not succeed and the device's condition allows, chip-off is considered. Chip-off requires specialist skills and equipment, may permanently damage the device and is applied only with your written consent.

1. Intake and custody: we confirm the requester's legal authority, sign a non-disclosure agreement and receive the material with a signed evidence handover record. The chain of custody is documented from this point on.
2. Preliminary review: the device is assessed, and the likelihood of recovery, the available methods and the risks are shared in writing.
3. Recovery and verification: data is retrieved using the approved method and the hash value of the recovered dataset is recorded.
4. Reporting and return: findings are reported together with the scope and limitations of the work. The material is returned against a signed record and working copies are either not retained at all or kept for 3 or 6 months, as the client prefers, and then securely destroyed.

Duration varies from case to case depending on the type of device or material, the data volume and the scope of the examination. We share an estimated timeframe after the initial assessment.

Individuals and organisations that have lost data, parties to legal proceedings and organisations running internal investigations.