Phone, computer and hard drive forensics in Barcelona
I image, analyse and document what is on a device, including deleted data when it is technically possible, without ever altering the original.
Member of AEPEJU (no. 1556). Barcelona and across Spain.
Indicative fee: from €450. See prices
First, do not touch it
Switching the device on, searching for files or connecting it to another computer changes dates and can overwrite exactly the deleted data you need. If it is a phone, put it in flight mode. If it is a computer, switch it off and put it away. Then write to me.
Do not take it to a repair shop either: any intervention without a chain of custody gives the other side grounds to challenge whatever is found later.
What I do
- Bit-by-bit forensic imaging of disks and memory with a write blocker, and a SHA-256 hash of the original and the copy.
- Logical and backup extraction from Android phones and iPhones.
- Recovery of deleted files, when it is technically possible.
- A timeline of activity: what was done, when and by which user (USB drives connected, files opened or deleted, browsing history).
- Searches for documents, emails, conversations and patterns such as bank account numbers, phone numbers or email addresses.
Typical cases
- Recovering deleted files, photos or conversations for proceedings.
- A timeline of what was done on a computer: USB drives connected, files opened or deleted.
- Devices in inheritance or separation cases, always with lawful access.
- Data leaks, data deletion or sabotage when an employee leaves: explained on the employment cases page.
Honest limits
Full encryption without the key, secure wiping, SSDs with TRIM or a factory reset reduce or prevent recovery. I tell you before starting.
I do not bypass encryption or locks. I work with lawful access: the device owner, the company that owns the equipment with the appropriate legal basis, or a court order.
Chain of custody
I draw up a collection record, seal the device, calculate the hashes and always work on a copy. The original stays intact, so the other side can request its own analysis and obtain the same results. Methodology: UNE 71506, ISO/IEC 27037 and RFC 3227.
Frequently asked questions
Common questions about this kind of report.
Can you recover deleted WhatsApp messages or photos from a phone?
Sometimes. It depends on the model, the system, the backups and the time elapsed. I assess it before quoting.
How long will I be without the device?
Imaging takes hours, depending on capacity. Then the original comes back to you and the analysis is done on the copy.
What if the drive is damaged?
Physical damage needs a clean-room recovery laboratory. I tell you and coordinate custody so the evidence is not lost along the way.
Can you analyse a locked or encrypted phone?
Only with lawful access: with the code provided by its owner or by court order. I do not bypass locks or encryption.
Related articles
To understand this kind of case better.
You may also be interested in
Related expert reports.
Tell me about your case
Free 30-minute consultation and a free quote within 24 working hours.