Sydney · Australia-wide
A computer keeps a record of how it was used.
Which USB devices were plugged in, which files were opened, what was deleted, whether the machine was wiped. We examine computers and drives for those questions, without changing a byte of what we examine, and set the answers in a written report.
Before you do anything else
Protect the only copy.
- 01
Power it down
Every minute a failing drive runs can overwrite the bytes you need.
- 02
Skip consumer scanners
Desktop recovery apps write as they scan. That is the opposite of imaging a dying disk.
- 03
No repair, no format
chkdsk, First Aid and reinstall fix the disk; they do not preserve what was on it.
- 04
Call, then decide
Free triage: lab job, cleanroom referral, or Recovery Studio.
When / stop
If the device matters, stop using it now.
Ordinary use writes, and what it writes lands on top of the records this work reads. Do not let IT “have a look”. Clicking through files rewrites activity records.
Do not run cleanup, antivirus or updates. Power it down. Write down who has had it, and when. Do not hand it back, reissue it or rebuild it.
What we do
Read once, work on the copy.
The device is read through a write blocker. That read produces a complete copy. Every search after that point comes from the image. The original is stored unchanged until it goes back to you.
A SHA-256 hash is computed as the image is made, and again afterwards, so the copy can later be shown to match what the device held on the day it was read.
Custody is documented from the moment the device changes hands: make, model, serial, signed transfers, tracking if it travelled by courier. Authority in writing before anything starts.
What it costs
Published band, then a fixed quote.
Evidence-grade examination and reporting from $195/hr. Free assessment first. Hourly because the hours are the deliverable. Assessment is free. The figure you agree is fixed before recovery starts. Full lab bands and Recovery Studio licences are on Pricing.
What a computer can show
Quiet records, read without changing them.
USB storage
Which devices were connected, often by make, model and serial, with dates and times.
Files opened
Windows keeps lists of opened documents. A record of opening a file often outlives the file itself.
Logons
Which account signed in, when, and whether it happened at the keyboard or over the network.
Deleted files
Recovered with original folder paths and timestamps where the data survives.
Browser and cloud
History, downloads, traces left by OneDrive, Dropbox and Google Drive accounts.
Wipes
A wipe removes data and leaves a shape: an OS installed the week before handback, logs that begin the day after a resignation.
None of this is exotic. The value is reading it without changing it, tying it together, and claiming no more than it supports. Camera footage is a different examination: CCTV and DVR recovery.
Boundary
Technical reports. Not a certification claim.
Reports set out what was asked, what was received, the method, what was found, and what could not be established. Encrypted volumes without keys stay closed. Overwritten data does not come back. A clean result means no trace was found, not a promise that copying never happened.
We do not claim certification, accreditation, membership, licence or expert-witness status. One person does this work, the same person you speak to at the assessment, with more than twenty years in IT and data recovery.
FAQ
Common questions.
Can the report be used in court?
That is a question for your solicitor. The report documents method, custody, hash verification of the working copy, what was found, and what could not be established. A report tendered as expert evidence, with the author available for cross-examination, is a different engagement. Say so at the start: it changes how the work is scoped, and it may be an engagement we decline.
Do you monitor employees or carry out surveillance?
No. Nothing we do is covert. The work is examination of a device after the event, with authority confirmed in writing before anything starts. We do not install monitoring software or recover data for a person who has no right to it.
What does a digital forensic examination cost?
$195 an hour, with a free assessment first. Scope and estimate in writing before billed work. Hourly because the work is investigative: what a device holds cannot be known before it is read.
Can Recovery Studio replace this?
No. Recovery Studio is an honest own-media workstation. Evidence matters that need lab imaging and custody still come here.
Next step
Tell us what failed.
Free assessment. Fixed quote before recovery starts. No recovery, no fee. Sydney drop-off or Australia-wide by tracked post.