Deleted Files and the Hour They Went

Where a deletion is disputed, the document is rarely the point. The point is the removal: which records went, in which hour, by which of the three quite different acts that all get called deleting, and under whose session. A Windows volume keeps four separate accounts of the same afternoon, written by parts of the system that were not designed to agree with one another, and reading them against each other is what turns an assertion into a timeline.

Dating a removal costs the same whichever way it goes. £800 + VAT examined and reported, £400 + VAT for the verified image and its extracted material alone — the recorder-disk price point, not a sixth band. Free diagnostic, scope agreed in writing. Forensic work is one of the four exclusions from no fix, no fee. Ordinary prices.

Three different acts, one word

Sorting out which kind of deletion happened is usually the first finding, and it often says something about intention before anyone has opened the document. Dragging a file to the bin moves it and writes a small companion record beside it holding the original path, the size and the minute of the move — and that companion record habitually outlives the bin being emptied. Holding shift skips the bin, but all that is surrendered is the directory entry; the contents sit where they were until something else claims the space. Saving over a file in place is a third thing entirely, and it is the one that ends badly. A person who empties a bin on their last afternoon and a person who installs a shredder have not done the same thing, and the volume can tell them apart.

Four clocks, none of them built to agree with the others

A sequence is only worth putting in a report where more than one source stands behind it, and Windows obligingly keeps four that were designed by different people for different purposes. The master file table carries several times against every record it holds, live or removed. The change journal writes one line per operation in the order the volume saw it — created, renamed, extended, deleted. The transaction log adds finer grain across the same handful of minutes. The security log supplies the profile that was signed in and the kind of logon behind it, though auditing of the deletion itself is switched off on most machines unless somebody deliberately enabled it, and it is better to say so than to let a client expect it. Where those four agree, the hour goes in without hedging. Where they do not, the disagreement is itself the finding, and the report explains which record it prefers and on what basis.

The machine keeps older copies of itself

Windows quietly retains earlier states of its own volume. Snapshots are written for restore points and by backup software, and each freezes the disk as it stood on a particular day: files removed afterwards, drafts from before an edit, a directory listing from three weeks ago. Comparing one against the volume as it is now drops out everything that vanished in between, in a single operation, with dates at both ends. There on the Monday, gone by Thursday, with the journal fixing the removal to Wednesday morning is about as clean an exhibit as this work produces. Backup generations, the Previous Versions tab and a bin configured on a network share all serve the same purpose wherever a business happens to have them.

Testing an assertion that a wiping tool was used

Erasure software is not a quiet operation. What gets examined first is not the gap it left but the noise it made getting there: install and uninstall entries, prefetch records naming the executable and holding several of the hours it ran at, the unnaturally even pattern an overwrite leaves across a surface, and the absence of the ordinary junk that any machine in daily use ought to be carrying. That is the awkward property of a wipe — it removes material and creates evidence in one movement, because the name of the tool, the hour, the account that started it and everything it never reached all outlive the run. Half-finished runs and runs aimed at the wrong volume are common, and whatever survived one is recovered in the ordinary way and described as what it is.

Where the answer is no, and you hear it before the invoice

Flash is where this work runs out of road, and it is better said early. On a solid-state drive with TRIM active and no encryption sitting in the way, the controller can clear the contents of a removed file within minutes, and nothing on any bench reads back what the silicon has already let go. Metadata generally outlasts contents, which means the fact of a removal and the hour it happened can still be evidenced when the document itself cannot be produced — and in a contested matter that is often the half that counts. Spinning disks are more forgiving, though a machine left in service works steadily through its own free space. Anything genuinely written over has gone, whatever anyone else is prepared to promise. Which of those situations you are in is established during the free diagnostic.

Recovery asks what was lost. This asks when, and under whose login

The two jobs read many of the same records and are not the same product. On the recovery bench nobody is arguing: a client wants files back, the output is a file list and a copy on fresh media, and the price is the ordinary band — £300 + VAT for a drive, £250 + VAT for a card or a stick. Here the existence of the files is not in doubt and the removal itself is the subject. That changes the handling from beginning to end: a write-blocked acquisition, a hash that is checked again later, contemporaneous notes, a custody record, and a report which sets out how each conclusion was reached so it can be attacked properly. If nobody is in dispute, deleted file recovery is the cheaper and correct answer and this page is not for you.

How the copy is taken and looked after sits on the forensic practice hub. Where a stick or a card is involved in the removal, USB device forensics takes it on; where the whole endpoint has to be preserved, that is workstation deep imaging. Where the deletion sits inside an employer's wider question about a leaver, the instruction is usually employee data theft.

// disputes this settles

When the removal is the whole argument

This is the page for a matter where the hour of a disappearance carries as much weight as whatever was inside the file.

A notice period in which the recycle bin was emptied more than once
A shared drive short of a folder, and two accounts of why that cannot both be true
A denial that the document was ever held on that computer in the first place
Cleaning software installed on a machine with no reason to have any
A date that has to be fixed to the hour rather than merely established
A draft wanted from before the version everybody is now looking at
// where the sequence comes from

Six records, read against one another

No single record carries a finding by itself. An hour goes into the report where the sources back each other up, and where they pull apart it is the pulling apart that gets written down.

Bin companions

Where the file lived, how big it was, and the minute it was dragged in — surviving the emptying.

Table clocks

Several stamps against each record, kept for live and removed entries without distinction.

Journal order

One line per operation, in the order the volume actually saw them happen.

Session context

Which profile was holding the machine around each event, and how it had signed in.

Earlier states

Snapshots still carrying what the live volume gave up somewhere along the way.

Wiping residue

Tool name, run times, the account that launched it, and everything the run never reached.

// the fee, and who may lawfully ask for it

What it costs, and the authority it stands on

What each of the two figures buys here

On this page the difference between them is unusually easy to describe. £400 + VAT stops at the evidence: the volume copied behind a blocker, the copy verified, the removed material carved out of it and handed over for your solicitor or another examiner to interpret. £800 + VAT is that same acquisition with the questions actually put to it — which records went, in which hour, under which session — and the answers written up in a form a tribunal can be taken through. The £400 is not a band invented for forensic work. It is where a CCTV recorder disk and an encrypted volume already sit, which is why this site still lists five prices and not six.

£800 + VATDating the removals, testing them against every record that touched them, and writing the sequence up so an opponent can follow how each hour was arrived at.
£400 + VATThe image, verified, with the deleted material lifted out. Somebody else reads it. Same price point as a recorder drive or an encrypted volume.

Neither figure is covered by no fix, no fee — investigations are one of the four published exclusions, along with electronic and mechanical failure, chip-level work and DVR jobs — because a deletion dated to Wednesday teatime costs the same hours whether that date rescues you or ruins you. Each covers one machine and one question. A second device or a second question is measured during the free diagnostic, which costs nothing and closes two working days after booking in at Oxford, and quoted in writing before anything starts. Ordinary recovery keeps its published bands.

Whose volume it is, before anything is read

This runs on machines a business issued, on hardware that is yours outright, or on a solicitor's written instruction — those three and nothing else. A court or an insurer instructing in writing counts as the second of them. In a family matter, hardware that is yours means owned by you or owned jointly. What sits outside all of that stays outside it: a password belonging to somebody else is not worked around, monitoring software is not sold, fitted or recommended, and live traffic is not intercepted by anybody here, that power being reserved to the bodies listed in the Investigatory Powers Act 2016. Paying a laboratory does not create a right of access that the client did not already hold. Handsets and tablets are refused whatever the instruction says, because Oxford's shipping form excludes them and an evidential dispute does not change that.

// deleted files — before you commit

What people ask about a deletion

Two separate chances, usually. The companion record the bin writes tends to outlive the emptying and shows what went in and at what minute. The contents are an entirely different question and sit in free space until Windows finds a use for it. Both are wearing away while the machine stays in service, which is the case for stopping today rather than on Friday. On an SSD with TRIM active, work on the basis that the contents have gone and build the argument out of the metadata, which in a dispute is frequently the more useful half in any event.
Dating it is the whole exercise here, and where something is contested the date usually matters more than the document does. Four records keep clocks that were never designed to corroborate one another, so a finding all of them support goes in firmly. Set that against when the file was first created and what else the same profile was doing either side of it, and the sequence tends to carry the argument without much assistance.
What a volume establishes is an account and a session — which profile held the machine, how it signed in, where the connection came from, and the second the operation ran. Getting from that to a named person is done with rotas, door-access records and witness evidence, none of which come off a disk. The report states that boundary explicitly, because a report that quietly steps over it falls apart the first time anybody leans on it.
Late and too late are different things. Continued use consumes free space, so the odds on recovering contents drop the longer it runs, but metadata is far more durable than file contents and snapshots are often the most durable of the lot. Take the machine out of circulation today and the free diagnostic will tell you what is genuinely there before you spend anything.
Probably not, and saying so costs us a job and saves you money. Where nobody is going to argue about the answer, evidential handling is expense with no return on it. That is ordinary deleted file recovery at £300 + VAT for a drive or £250 + VAT for a card or a stick. The examination is worth buying at the point where the removal itself is what somebody intends to dispute.
// getting your media to Oxford

Posting a device in — what goes in the box

A deletion case loses something every day the machine stays in service, so take it out of circulation and then ring 0800 689 0668, in that order. Coventry has no counter and nothing is collected anywhere in this network: the drive goes to Oxford by tracked, insured post, or across the counter there during office hours, and the custody file opens as it is booked in.

As a rule the storage comes out and the machine stays where it is. That applies to a laptop, a tower, an iMac and to the recorder sitting under a counter. Taking equipment apart is not something this bench does, and a repair shop will free a drive in a few minutes. Two things go the other way: an external drive stays sealed inside its own case, and a NAS travels as a complete unit with its disks still in their bays. A Fusion Mac is a third case — both of its drives come out and travel together, each one labelled. The single situation nobody can work around is memory soldered flat onto a mainboard, which is how Apple Silicon Macs and a good many slim laptops are built: if the storage will not unbolt, there is no parcel to send.

  • Use a box or padded mailer with some rigidity to it, and pack around the drive until nothing shifts when the parcel is tilted. Mains adaptors, docks and leads are not wanted at this end.
  • Sending a RAID or a server? Only the member disks travel — not the chassis, not the controller — and each one wants its bay number written on it. Take a photograph of the front of the unit before anything is pulled; it costs nothing and now and again it saves a day.
  • Print the shipping and booking-in form (PDF), add a name, a number you will answer and a sentence on how the trouble began, and drop it in beside the media.
  • Most people use Special Delivery, which is tracked and covered; a courier of your own does the same job. You can also bring it: the Oxford reception takes devices over the counter, Mon–Fri 9:00am–5:30pm. Neither a Coventry counter nor a collection round exists.
// write this on the label

Oxford Data Recovery

John Eccles House
Oxford Science Park
Robert Robinson Avenue
Littlemore, Oxford, OX4 4GP

↓ Print the shipping & booking-in form (PDF)

Put Oxford Data Recovery on the label. From Coventry it is roughly fifty-five miles straight down the M40, about an hour if you would rather drive it in than post it. Either way you are told the moment it is logged, and the free diagnostic finishes two working days later.

Unsure what ought to go in the box? Ring 0800 689 0668 before you seal it, or work through the free online diagnostic and let it do the asking.

Gone is an assertion. The volume kept its own note.

Pull the machine out of circulation, ring the freephone, and let four records that were never meant to agree settle the hour between them.