Two questions usually matter about a missing file: what it was, and how it left. A disk normally retains enough to answer both. Between them, bin records, journal entries and volume snapshots show what a machine held, how it was used, and the hour and the method by which something was taken off it. For employers, solicitors and private clients across Merseyside with a deletion in dispute.
◇ Scope first, then work. Diagnosis is free and comes at the beginning; the written scope follows, and the forensic fee is paid in full before an examiner opens the image. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. The whole price list sits on the data recovery cost page.
This suits any matter in which what went, and the hour it went, carries as much weight as the file.
Deletion is not one act but several, and each leaves a different mark. A file sent to the recycle bin gets a small companion record holding its original path, its size and the instant it was moved; that record routinely survives the bin being emptied. A permanent deletion skips the bin, but all that is given up is the index entry — the contents remain in place until the space is needed for something else. Establishing which grade applied, and when, is normally the first task, and the answer often speaks to intention.
A timeline is simply recorded events placed in order, drawn from sources that corroborate one another. The $MFT holds creation, modification and access times for every file. $UsnJrnl records the operations as they happen: created, renamed, deleted. $LogFile fills in detail around the minutes that matter. Event logs supply the account signed in at the time and what it had opened or altered beforehand. Read against the date the file was made, the hour of its disappearance answers the only question that counts: housekeeping, or timing?
A workstation keeps several versions of its own history. Volume Shadow Copies, written for restore points and backups, hold earlier states of the disk, including files deleted afterwards and drafts from before an edit. Place a snapshot beside the live volume and whatever vanished between two dates is visible at a glance. It makes the neatest exhibit a deletion case can have: present on the 3rd, absent on the 10th, and the journal timing the removal at the 7th.
Wiping software arrives noisily. Detection begins with what the tools leave behind: installation records and prefetch entries carrying the program name, the times it ran, the characteristic pattern overwriting leaves across the disk, and the conspicuous absence of artefacts that ought to be there. A wipe destroys content and manufactures evidence in the same operation — the utility, the hour, the account responsible, and everything it failed to reach. Partial and interrupted runs are common, and whatever survives one is recovered in the ordinary way.
The imaging and custody discipline beneath this page is set out at the forensic recovery hub. Deletions involving sticks and cards continue at USB device forensics, and whole-machine capture at workstation deep imaging. The two fees sit on the prices page.
Each source is read against the others, and the timeline stands where they agree.
Original path, size and the moment of deletion, outliving the emptied bin.
Created, modified and accessed times for live and deleted entries alike.
Creation, renaming and deletion, recorded one operation at a time.
Which account was signed in around each deletion, from the system's own logs.
Earlier states of the volume, still holding what has since disappeared.
The utility, the hour, the account behind it, and what it missed.
Diagnosis is free and takes 2 working days from the morning the parcel is opened. Nothing forensic runs under no fix, no fee. A forensic investigation ending in a written report is £800 + VAT, settled in full before the examination opens. Where no report is wanted, the binary image with deleted-file extraction stands on its own at £400 + VAT. Forensic work is paid for in advance, without exception. The same two figures appear on the prices page, and you are asked for nothing until the written scope has been agreed.
Deletion work runs on company machines, on devices you own, or under a solicitor's instruction. Only three routes reach an examination and there is no fourth. Hardware the business itself bought. A written instruction from solicitors, from an insurer or from the court. Or a device belonging to the client, which in a family matter extends to a machine the couple own between them. Nothing is broken into on this bench. Live traffic is never intercepted: that power belongs to the agencies named in the Investigatory Powers Act 2016 and nowhere else. If a client may not lawfully look inside a device, the answer here is the same one.
Every day of ordinary use costs a deletion case something, so withdraw the machine and ring 0800 689 0668. Nothing is collected and there is no counter in Liverpool: the drive goes by tracked, insured post to the Manchester laboratory and joins the custody record at booking-in.
Still screwed inside a laptop, tower, MacBook, iMac, server or a CCTV recorder? Take the drive out and post that on its own. We do not strip machines here, and any computer shop will do it in a few minutes. The one job nobody can take on is flash soldered straight to a logic board, as on Apple Silicon Macs and a handful of very slim laptops: if the storage will not unbolt, there is nothing to send.
↓ Print the shipping & booking-in form (PDF)
Address it to Manchester Data Recovery. It is roughly 35 miles from Liverpool along the M62 if you fancy the run, and next working day by tracked post if you do not. We ring or email the moment it is booked in, and the free diagnostic closes 2 working days after that.
Not sure what belongs in the parcel? Call 0800 689 0668 before you tape it shut, or step through the free online diagnostic first.
Take it out of service, ring the freephone, and let the sequence answer.