Forensic imaging of drives, recovery of deleted and damaged files, extraction of phone backups, and live investigation of computers you suspect are compromised, using a toolkit we built ourselves.
A sector-by-sector copy of the drive is made first, and all analysis is done on the copy, so the original is never changed.
Files are recovered from the file system's own records where they survive, and by their content where they do not.
Data is extracted from phones and their backups with the owner's cooperation.
Files already deleted from a modern phone's internal storage usually cannot be recovered without specialist hardware access, and we will tell you plainly when that is the case.
When a computer may be compromised, we examine it while it is still running, before evidence in memory is lost.
Our case reports list the source examined, the settings used, the hash of the forensic image and every file recovered, so the work can be checked and repeated.
Important files deleted, a memory card formatted, or a drive that no longer opens.
Strange behaviour, unknown programs or a ransomware note: what got in, what it did and how to clean up.
Questions about misuse of company computers, examined fairly and documented carefully.
Stop using an affected drive or phone as soon as you notice a problem. Every new file written to it can overwrite the data you want back.
Describe the device, what was lost or what you noticed, and when. We will tell you honestly what is likely to be recoverable before any work begins.