Deleted-File Forensics and Timelines

Deletion disputes turn on two things: what the file was, and how it came to leave. A Windows volume normally keeps enough to answer both, and the second answer is often the one that matters. The bin index, the change journal, the shadow copies and the security log each describe the same afternoon from a different angle, and putting them side by side is what produces a timeline rather than an assertion. Instructed by employers, solicitors and private clients throughout Berkshire, Surrey and the London boroughs.

Footing first, bench afterwards. An investigation with its full written report is £800 + VAT; a verified image with deleted-file extraction and no report written is £400 + VAT, the same point as a recorder disk. The diagnostic is free and the scope goes in writing first. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Ordinary recovery bands are published on the data recovery cost page.

// arguments this settles

When the removal is the dispute

Anything where the hour of a deletion counts for as much as the contents of the file belongs on this page.

Somebody emptied the bin in the fortnight before handing in notice
A shared folder is short of records and no two accounts of it agree
One side maintains the document was never on the machine to begin with
There is reason to think a cleaner or shredder utility has been run
You need to know the hour, not merely that something went missing
An earlier draft is wanted of a file that has since been written over

Deletion comes in grades, and each grade leaves a different mark

Sending a file to the recycle bin creates a small companion record holding the original path, the size and the moment it was moved, and that record habitually outlives the bin being emptied. A shift-delete skips the bin entirely, but all that is surrendered is the index entry: the contents sit where they were until the space is reused. A file overwritten in place is a different animal again. Working out which grade applied, and at what hour, is normally the first job of the examination, and the answer frequently speaks to intention before anybody looks at what the file contained.

Sources that check one another

A timeline is recorded events put in order, and it is only worth having when the sources corroborate each other. The master file table carries created, modified and accessed times for live and deleted entries alike. The change journal logs operations one at a time as they occur — created, renamed, deleted, extended. The transaction log fills in the minutes around an event in finer detail. Security event logs supply the account that was signed in, the type of logon and what it had touched beforehand. Where those four agree, an hour can be stated with confidence. Where they disagree, the report says which one it prefers and why.

The copies nobody remembered to clear out

A Windows machine quietly keeps several versions of its own past. Shadow copies, written for restore points and by backup software, freeze earlier states of the volume — files that were deleted afterwards, drafts from before an edit, folder listings from a fortnight ago. Set one against the live disk and whatever went missing between the two dates falls out of a single comparison. It is the cleanest exhibit this kind of case can have: there on the 3rd, absent on the 10th, with the journal placing the removal on the Wednesday in between. Backup sets, Previous Versions and the bin on a mapped network drive do the same job where they exist.

Testing a claim that a wiping tool was run

Wiping software is not subtle. The search begins with the residue such tools leave: installation and uninstall entries, prefetch records naming the executable and holding up to eight of its run times, the regular pattern that an overwrite lays down across a surface, and the suspicious absence of artefacts that any working machine ought to have. A wipe destroys material and creates evidence in one movement, since the tool, the hour, the account behind it and everything beyond its reach all survive. Runs that were interrupted or aimed at the wrong volume turn up frequently; whatever such a run failed to touch is recovered normally and described as what it is.

Where this does not work, said plainly

Solid-state drives are the honest exception. Where TRIM is active and the volume is not encrypted, the controller can discard the contents of a deleted file within minutes and no software recovers what the flash has already erased — the metadata trail usually survives, so the fact and the hour of the deletion can still be evidenced even when the file cannot be produced. On a spinning disk that has stayed in daily use, unallocated space is consumed week by week. And a file that has been genuinely overwritten is gone, whatever anybody promises. You are told which of those you are in before the quotation is written, not afterwards.

The imaging and custody discipline underneath this page is set out at the forensic recovery hub. Deletions involving sticks and cards carry on at USB device forensics, whole-machine capture at workstation deep imaging, and the non-forensic version of this job — files deleted with nobody in dispute — is ordinary recovery work at the bands on the prices page.

// where the sequence comes from

Six records, cross-checked

No single artefact is trusted on its own. The hour is stated where the six agree, and the disagreement is reported where they do not.

Bin index

Path, size and time of the move, readable long after the bin itself was emptied.

File-table clocks

Creation, modification and access values, for live and deleted entries alike.

Change journal

Every create, rename, delete and extend, logged as it happened, one line each.

Logon context

The account signed in around each event, and the type of logon it used.

Shadow copies

Frozen earlier states of the volume, still carrying what the live disk has lost.

Wipe residue

Tool name, run times, the account that launched it, and everything it left behind.

// paying for it, and being entitled to ask

What it costs, and who may instruct

Two figures, printed rather than hinted at

Start with the part people are least often told: a forensic examination sits outside no fix, no fee. That guarantee belongs to logical recovery work, and the stated exclusions are electronic and mechanical failures, chip-level work, DVR jobs and forensic jobs. An examination is bench time spent answering a question, so it is charged whether the answer helps you or not. What it does have is two published figures, which is two more than most laboratories will put in front of you. An examination that ends in a full written report is £800 + VAT. An examination that stops at the evidence itself — a verified binary image with the deleted material extracted out of it, handed over for somebody else to interpret — is £400 + VAT. That second figure is the same point on the list as a recorder disk or a BitLocker volume, so it adds nothing new to the five bands the rest of the site publishes.

£800 + VAT

The examination and the full written report that comes out of it, produced so an expert acting against you can follow every step and test it.

£400 + VAT

The verified binary image with deleted files extracted from it, and no report written. The same figure a recorder disk or an encrypted volume carries, not an extra band.

Both figures assume one machine and one question put to it. Nine laptops, a file server and a tenancy export is a larger exercise, so anything spanning several devices is measured after the free diagnostic and written down before you agree to it. Diagnosis still costs nothing and still closes 2 working days after the device is booked in, and the fee is settled before an examiner opens the image rather than after. Everything that is not forensic keeps its published band on the prices page.

The footing an examination needs

Deletion work is done on company machines, on hardware you own yourself, or on written instruction from a solicitor. Three routes reach this bench and there has never been a fourth. Equipment the business itself bought and issued. A written instruction from a solicitor, an insurer or the court. Or a device that genuinely belongs to the person asking, which in a family matter means one owned outright or owned jointly. Nothing is broken into here. We do not work out somebody else's password, we do not put monitoring software on a device the client does not own, and live traffic is never intercepted — interception belongs to the bodies named in the Investigatory Powers Act 2016 and to nobody else. Where a client has no lawful right to look inside a device, instructing us does not create one. Handsets and tablets fall outside the practice altogether.

// getting the media to the bench

Booking a device in — what actually has to happen

Ordinary use costs a deletion case something every day it continues, so take the machine out of service before you ring 0800 689 0668 rather than after. There is no collection anywhere in this network and no Bracknell counter: send the drive to Guildford by tracked, insured post, or hand it in at the Guildford counter during office hours. Custody starts at booking-in.

Is the storage still bolted into a machine — laptop, tower, iMac, MacBook, rack server, a DVR under the till? Free it first and send the bare unit. Stripping hardware is not something this lab does, though it is ten minutes' work for any repair shop on your high street. There is a single case with no way round it: memory chips soldered flat onto the mainboard, which is how Apple Silicon machines and certain ultrabooks are built. Where the storage cannot be unbolted, there is no parcel to make up.

  • Pick packaging that holds its shape — a rigid carton or a heavy padded mailer — and pack round the unit so it cannot shift in transit. Leave the caddy, the mains adaptor and the leads at home; none of them are wanted at this end.
  • Print the shipping and booking-in form (PDF), put your name and mobile on it along with a sentence describing how the fault started, and slip it in alongside the media.
  • Send it Special Delivery through the Post Office and it travels tracked and covered. A courier account of your own works just as well. The only thing that matters is that somebody signs for it at this end.
  • If you would sooner deliver it by hand, the Guildford reception on the address card takes devices over the counter, Mon–Fri 9:00am–5:30pm. Neither a Bracknell shopfront nor a pickup van exists — those are the two things we cannot offer.
// write this on the label

Guildford Data Recovery

Building 2, Ground Floor
Guildford Business Park
Guildford, GU2 8XH

↓ Print the shipping & booking-in form (PDF)

The name on the parcel wants to be Guildford Data Recovery. Driving it over from Bracknell is roughly forty minutes on the A322 then the A3; posting it costs you a stamp and a day. Either way, a message goes out to you as soon as it is logged onto the system, and two working days later the diagnostic is finished.

Unsure whether something should go in the box? Ring 0800 689 0668 while the lid is still open, or work through the free online diagnostic and let it tell you.

// deleted files — before you commit

What people ask about a deletion

There are normally two separate chances rather than one. The index entries that the bin keeps tend to outlive the emptying and will show what was thrown away and at what time. Separately, the file contents remain in unallocated space until Windows needs the room for something else. Both wear away with use, which is the argument for stopping today. On an SSD running TRIM, assume the contents half has already gone and work from the metadata.
Putting an hour on it is the main event, and in a dispute it is usually worth more than the document. The bin index, the journal and the security log each keep their own clock; where three independent clocks line up, the finding is stated firmly. Set that against when the file was made and what else the account was doing that afternoon, and the timing tends to argue the case on its own.
We can say which account and which session — the profile that was logged on, where the connection came from, and the second the operation ran. Tying an account to a particular person is the wider case's job, and it runs on rotas, door-entry records and witness evidence rather than on disk artefacts. The report marks that boundary explicitly. Reports that blur it are the ones that come apart under questioning.
Later than ideal, but not automatically too late. Everyday use eats into unallocated space, so the chance of recovering contents drops week by week, while the journal, the bin index and the shadow copies frequently ride it out. Take it out of service now and the free diagnostic will tell you honestly what is left before you commit to anything.

Gone is a claim. The volume has its own view.

Withdraw the machine, ring the freephone, and let six independent records answer the question between them.