Evidence certification · Hard drives and computers
Forensic analysis of hard drives, computers and memory devices
We clone the storage medium with a write blocker, calculate its hash and analyse the copy — never the original — to recover deleted files, reconstruct activity and establish what happened and when.
- Write blocker
- The clone is analysed, never the original
- Expert no. 02714
Updated on 26 September 2026
What we analyse
What a drive retains
The original is sealed and preserved. All analysis is carried out on a clone verified by its SHA-256 hash.
Recovery of deleted files and remnants in free space.
Logins, programs used, documents opened.
USB sticks and external drives, with dates.
History, downloads and mailboxes stored on the computer.
Inconsistencies between system timestamps.
SHA-256 hash of the original medium and of the clone.
Common cases
When it is needed
- An employee taking information before leaving
- Data wiped before a dismissal or before handing back equipment
- Sabotage and intrusions
- Intellectual property and unfair competition
- Counter-expert report on an analysis submitted by the other side
How it works
From the first message to the signed report
-
01
Triage
Which computer, what needs to be established and whether it can be switched off. Guidance so that the evidence is not altered.
-
02
Cloning
Bit-for-bit copy with a write blocker, at the laboratory or at your company, with a signed record and SHA-256 hash.
-
03
Analysis of the clone
Recovery, timeline and search for what matters to the case.
-
04
Report
Signed report, with availability to confirm it in court.
What you receive
A report your lawyer can file without changes
- Expert report signed by court expert no. 02714
- Cloning record and SHA-256 hash annex
- Timeline of the relevant activity
- Original medium sealed and forensic copy kept in custody
Frequently asked questions
Before you instruct us
Do you work on the original drive?
No. The original is cloned with a write blocker, sealed and preserved; the analysis is done on the verified copy, so that the evidence does not change.
Can you tell whether someone copied information to a USB stick?
Often, yes: the system records which devices were connected and when, and sometimes which files were opened from them. The report explains what can and cannot be stated.
Does the company's computer or server have to be stopped?
For as little time as possible. We can clone outside working hours, or live when the system cannot be shut down, and document it in the record.
Do you also analyse cloud accounts?
Yes, with authorised access to the account: the content is downloaded with a signed record and hash, just like a physical medium.
We serve Elche, Alicante, Murcia, Valencia and the whole of Spain.
Carrer Santiago Ramon y Cajal, 41 · Modulo 1, planta 1, local 13
03203 Elche · +34 965 56 38 00
WhatsApp, email, phones, drives, social media and websites: extraction, hash and signed expert report.
View page Signed by IT expert witnessAccreditation no. 02714, methodology and courtroom experience.
View page
