External Drive and Storage Device Forensic Examination

High-capacity external drives can be used both for bulk data theft and for hiding evidence. Hidden partitions, encrypted areas or renamed files are not visible at first glance.

File activity, concealment and deletion traces on these devices can reveal how an incident unfolded and how far it reached.

• Write-protected imaging verified by hash value
• Examination of the existing file and folder structure
• Analysis of created, modified and accessed timestamps
• Detection of deleted and hidden files
• Search for hidden disk partitions and encrypted areas
• File metadata analysis
• Assessment of traces showing which computers the device was connected to
• Structured reporting of findings

With external drives the aim is to look beyond the visible files. Alongside file system records we scan the partition table, unallocated space and file slack for hidden or deleted data.

1. Intake and custody: we confirm the requester's legal authority, sign a non-disclosure agreement and receive the material with a signed evidence handover record. The chain of custody is documented from this point on.
2. Forensic imaging and verification: a bit-for-bit forensic image is acquired through a hardware write blocker, and its hash value is calculated and recorded to verify that it matches the original.
3. Analysis: the partition table, unallocated space and file slack are scanned; files with altered extensions are identified through signature analysis, and findings are correlated with records from the relevant computers.
4. Reporting and return: findings are reported together with the scope and limitations of the work. The material is returned against a signed record and working copies are either not retained at all or kept for 3 or 6 months, as the client prefers, and then securely destroyed.

Duration varies from case to case depending on the type of device or material, the data volume and the scope of the examination. We share an estimated timeframe after the initial assessment.

Organisations with a suspected data leak or internal misconduct, and parties to commercial disputes.