Forensic Examination of Deleted or Inaccessible Data

Often not. Deleting a file usually does not physically destroy the data; the system simply marks that space as free, and the content may remain recoverable until it is overwritten.

Deletion itself leaves a trace. What was deleted, when and by what method is often the most important finding in a case.

• Detection of deleted files and folders
• Scanning of file slack and unallocated space
• Extraction of deletion traces from file system records
• Search for deleted messaging and app data
• Assessment of traces of bulk deletion and data-wiping tools
• Technical assessment of recoverability
• Analysis aimed at establishing the time of deletion
• Reporting of findings

This service focuses on deletion as evidence; if you only need your files back, our data recovery services are a better fit. Recoverability depends on the device, the file system, whether data has been overwritten and the device's current condition.

1. Intake and custody: we confirm the requester's legal authority, sign a non-disclosure agreement and receive the material with a signed evidence handover record. The chain of custody is documented from this point on.
2. Forensic imaging and verification: a bit-for-bit forensic image is acquired through a hardware write blocker, and its hash value is calculated and recorded to verify that it matches the original.
3. Analysis: file system records, unallocated space and file slack are scanned together, and the deletion method and approximate time of deletion are assessed.
4. Reporting and return: findings are reported together with the scope and limitations of the work. The material is returned against a signed record and working copies are either not retained at all or kept for 3 or 6 months, as the client prefers, and then securely destroyed.

Duration varies from case to case depending on the type of device or material, the data volume and the scope of the examination. We share an estimated timeframe after the initial assessment.

Organisations running internal investigations, parties to commercial and legal disputes, and individuals who have lost data.