Laptops, Desktops, Servers and the Drives Inside Them

Computer and Hard Drive Imaging, Recovery and Analysis

The laptop everyone is arguing about still holds the record of what was opened, copied, plugged in and deleted. Global Digital Forensics images computers and drives behind hardware write blockers, verifies every copy by hash and turns what we recover into a report built for cross examination.

Get a Free Consultation Call (800) 868-8189

Bagged hard drive beside a forensic write blocker.

Acquisition Planned Around the Drive in Front of Us

Two clocks start the moment a laptop becomes evidence: the drive keeps overwriting the records you need, and opposing counsel starts building the argument that whatever you find was handled carelessly. Before anything is copied we scope the media, the controller or array behind it, the encryption and the keys available, the condition of the hardware and everything already done to it. That acquisition decision is written down once, with any unreadable regions and any change to the source, and it follows the evidence into the timeline and the report.

A hash value proves the bytes we acquired are the bytes we analyzed. We pair it with a record of the source condition and the coverage of the copy, because that is where a challenge aims first. Every finding then names the original record, its path or offset on the drive, our interpretation and the alternatives we tested.

Our acquisition and analysis follow NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response, and the examiner who images the drive is the examiner who explains it.

Before anyone copies the drive, have a senior examiner review the scoping questions with you. The call is free, and it often changes what gets collected.

Get a Free Consultation

Deleted Data and User Activity Beneath the Visible Files

The documents a user can see are the smallest part of what a drive remembers. Operating system records, application histories, storage metadata and the traces of every device ever connected sit underneath, and we read them together to explain how a file was created, used, moved and deleted. The result is a timeline and a report you can evaluate, every entry tied to the record that supports it.

Global Digital Forensics has done this work since 1992. Robert Knudsen, a Certified Computer Examiner, has conducted hundreds of computer and mobile device examinations supporting matters in federal and state courts, and our founder Joseph Caruso’s metadata analysis in COMLAB v. Kal Tire led a federal court to find fabrication and spoliation. We bring that experience to disputed transfers, suspected wiping before a litigation hold, event chronologies and forensic images supplied by another party.

Ask on the first call who would sign the report and take the stand; the examiners’ credentials and court experience are set out on the About page.

Physical, Logical or Targeted: Matching Acquisition to Source

A physical image copies the full storage address space the source exposes. A logical collection gathers selected files or structures through the file system. A targeted collection narrows to defined sources or categories. Each is right for some matters and wrong for others, and the wrong choice at the start leaves gaps nobody can fill once the source has changed.

Encryption, a running system, folders synchronized with cloud storage and failing hardware all change the decision. A mounted encrypted volume on a live machine may give up content that stays locked in an offline image, and a cloud stub file can show a name and a date while the content never left the server. We record those conditions so the material is read for what it is.

We acquire through hardware write blockers and work only from verified copies, leaving the original untouched. When a live collection is required, we document every change it causes. The hash record stays separate from the conclusions drawn from the data, which is exactly where an examiner wants it when the method is challenged.

Not sure whether your source needs a physical image or a targeted collection? Call (800) 868-8189, describe the device, and we will tell you which acquisition fits and why.

Backups and Snapshots Often Hold What the Drive Lost

A drive in service keeps writing, and how long deleted data survives depends on the source, its power state and its activity. That is why the call should come before IT reassigns the machine or wipes it for the next employee.

Storage arrays, virtual disks, backups and snapshots often hold material already gone from the primary device. A nightly backup can preserve the state before a deletion, and a virtual disk may need its full chain of snapshot files to read correctly. We map those relationships, including snapshots retained on a hypervisor, so the acquisition captures the parts that answer the question.

If the device is scheduled to be wiped or reassigned, stop that step first, then tell us where the backups and snapshots live so preservation covers them too.

File Activity Proven by Corroborating Records

A Windows shortcut file records a relationship to a document, and the NTFS change journal records creation, modification and deletion. Browser history, application logs and synchronization client records fill in what a person actually did. We line the artifacts up, normalize the timestamps and keep the original time context wherever it changes the meaning.

We then test the sequence of events against the combined record. A USB connection paired with jump list entries, file system timestamps and a matching volume serial number tells a far stronger story than any one of them alone, and documenting each supporting trace is what lets another qualified examiner follow the reasoning to the same place. You see the strength of the account before the other side does.

Methodology

How We Preserve and Examine Drive Evidence

Define the computer activity in question

The disputed activity, the dates, the people, the systems and the readers of the report, settled before collection.
Preserve the drive evidence

Write blocked acquisition of the best available evidence, with hash verification and custody documentation from the first byte.
Correlate file, system and account records

File system, operating system, application, account and network artifacts on one timeline, each tested against the others.
Explain the forensic findings

Observation kept apart from interpretation, with workpapers another qualified examiner can review and test.

Evidence commonly examined

Send the question and the sources you know about, and we will map the examination with you.

Computer and Storage Evidence We Examine

Laptops, desktops, servers, external drives and removable media hold the local records and the storage context around them. Forensic images and verified working copies preserve that material while the original stays untouched. Operating system and application artifacts reconstruct activity, account, network and cloud records corroborate or challenge what the machine shows, and backups, snapshots and recovery media can hold earlier states of the disputed files.

What you can expect

Findings, Timeline and Acquisition Records

The acquisition and source condition record identifies the method, the material obtained and its handling. Artifact schedules and timelines connect each material event to its source record, the technical findings set out the observations and the interpretation, and agreed reports, declarations and testimony carry the analysis into deposition and trial. Each deliverable is named in the proposal before work begins.

Talk it through with a senior examiner at (800) 868-8189, or send the details for a free consultation.

Have the Drive Imaged Before It Changes Again

Tell us the question, the sources and the deadline. A senior examiner will walk you through the acquisition, the examination and the report your matter needs, and will check conflicts and relevant experience before engagement. The initial consultation is free.

Our database and computer forensics work in Rogers v. BNSF Railway, the first class action under the Illinois Biometric Information Privacy Act to reach a jury trial, shows how an examination of system records reaches a courtroom.

Get a Free Consultation

Storage types and reporting detail

Where Drive Evidence Lives and How We Document It

Solid state drives complicate recovery because wear leveling, TRIM and garbage collection erase deleted data on their own schedule and break assumptions about sector locations. RAID examination records the member condition, the controller metadata, the stripe order and the parity. Virtual disks need their snapshot relationships, and encrypted sources need a supported key or a documented decision about live access.

The acquisition record identifies the source condition, the storage coverage, the method, any unreadable areas, any source changes and the integrity checks. The report adds tool versions, search logic, artifact locations, original and normalized time context, exhibits and workpapers.

A senior examiner can walk through the facts of your matter on a free call.

When the Question Reaches Beyond the Drive

A drive often answers half the question and points to the rest: the mailbox the files were sent from, the cloud folder they synchronized to, the failed disk that needs recovery before anyone can read it. The same examiners carry the work across those sources so the timeline stays in one hand.

Frequently asked

What to Know Before a Drive Is Imaged

Should we turn the computer off?

Call before you change anything. The right answer depends on the power state, the encryption, the safety of the location and the evidence you need, and a blanket instruction to power off or leave it running can lose exactly the records that matter.

Can you analyze a forensic image from another provider?

Yes. We review the collection documentation, verify the image against its hash values or the source where available, and tell you which questions that image can answer before anyone relies on it.

Can you recover a deleted file?

Often. We assess recovery from the storage type, the encryption and the other copies that may exist, and when the contents are gone, the surrounding records frequently still establish the file name, an earlier version or the activity around it.

What should we define before a computer or drive examination?

The media type, its condition, the encryption in place and whether you need imaging, recovery or an analysis of user activity. If you are not sure, tell us what happened and we will translate it into those terms.

What should we provide for the first discussion?

The question, the sources, the dates and your deadline. Keep the originals intact, and we arrange a secure transfer and a custody record before anything moves.

Can the examination focus on a specific issue?

Yes. A focused scope puts the work on the devices, dates and questions that bear on the dispute, which keeps the cost proportionate while preserving what a later challenge would require.

Can we review the proposed examiner’s qualifications?

Yes. Ask for a current CV, relevant experience and availability. Our examiners’ credentials and their federal and state court experience are on the About page, and conflicts and expert disclosure requirements are cleared before engagement.

Free consultation

Tell Us About the Drive

On the first call a senior examiner asks what the device is, what has already been done to it and what you need to prove, tells you how to hold it today and recommends the acquisition, the examination and a timeline.

Drive examinations since 1992, with a national hotline answered 24/7.

GDF does not accept pro se litigation cases, and GDF may decline matrimonial or family law cases at our discretion.

Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed November 3, 2026.