An employee left under a dispute and returned a company laptop that had been factory-reset — seemingly wiped clean the day before it came back. The company, through its solicitors, needed to know what had been on it and what the reset destroyed. We forensically imaged it, recovered what a ‘quick’ reset leaves behind, and — just as importantly — reported honestly on what was, and wasn’t, recoverable.
A company laptop was returned by a departing employee amid an employment dispute, and IT found it had been factory-reset — apparently the day before it was handed back. The business, acting through its solicitors, needed to establish what had been stored on the device, whether anything had been removed, and what the reset had destroyed. As before, this was a legitimate instruction: the laptop was company property and the examination came through the proper legal channel. Our answer up front was an honest one — a reset doesn’t always erase as much as people assume, but how much survives depends entirely on the type of drive and the type of wipe, so the first job was to find out which we were dealing with.
“Reset this PC” in Windows reinstalls the operating system and offers two options that matter enormously here. “Just remove my files” is a quick operation: it deletes the user data and reinstalls Windows, but — like any deletion — it doesn’t actually overwrite the old data, it simply marks the space as free. Much of it remains on the drive until something writes over it. “Fully clean the drive” is different: it deliberately overwrites the drive, which is designed to make data unrecoverable. Most people, in a hurry, choose the quick option — and a fresh Windows install writes relatively little over the old data — so a ‘wiped’ machine is frequently far from empty. Establishing which reset was used is the difference between a promising recovery and a dead end.
The drive technology matters even more than the reset option, and this is where honesty is essential. On a traditional hard drive, deleted and quick-reset data persists until it’s physically overwritten, so a great deal is usually recoverable. On a modern SSD, a feature called TRIM changes everything: when files are deleted, the operating system tells the SSD which blocks are no longer needed, and the SSD’s controller proactively erases them in the background (garbage collection) to stay fast — often within minutes, and irreversibly. On a TRIM-enabled SSD, data deleted or removed by a reset is frequently gone for good, beyond any lab’s ability to recover. We say this plainly because it’s true, and because anyone promising guaranteed recovery from a reset SSD isn’t being straight. This laptop had a hard drive with a quick reset — the favourable case — which is what made a meaningful recovery possible.
The work followed the same forensic standards as any evidential case. The drive was imaged behind a write blocker to a bit-for-bit forensic image, with a SHA-256 hash taken and verified to prove the copy was identical and unaltered, and a chain of custody documented throughout. Working on the image, we recovered what the quick reset had left: substantial user data was carved back from the free space — documents, spreadsheets and images whose file records were gone but whose contents survived — along with fragments of the previous Windows installation. We also recovered forensic artifacts that outlived the reset in places it didn’t reach, and, tellingly, evidence establishing that a reset had been performed and when — itself a relevant fact in a dispute about a returned device.
The findings went into a formal forensic report for the solicitors: the recovered material, the evidence of the reset and its timing, the methodology, and — critically — a clear statement of the limits, setting out what a quick reset on this hard drive left recoverable versus what could not be determined, and noting how different the outcome would have been on an SSD. That candour matters: an evidential report is only useful if it’s honest about what the evidence does and doesn’t show, and overclaiming would undermine the very credibility it’s meant to carry. The recovered data and report were delivered securely, giving the company a factual footing for their case. The wider point we make to any business: if a device may be needed for a dispute, preserve it as-is and don’t let it be reset or reused — the sooner it’s imaged, the more survives.
Write-blocked forensic imaging with SHA-256 hash verification · chain of custody · free-space carving and fragment recovery after a quick reset · artifact analysis and reset-event evidence · honest evidential report including recoverability limits (HDD vs SSD/TRIM). Confidential handling, all work in-house at our Belfast lab.
A reset often leaves more behind than people think — especially on a hard drive. For legitimate, authorised investigations we forensically image the device, recover what survives, and report honestly on what can and can’t be established, to court standards with full chain of custody. Preserve the device as-is and get in touch for a confidential, no-obligation discussion. Forensic work across the UK.
Often, yes — but it depends on the drive and the reset. A ‘quick’ reset that just removes files doesn’t overwrite the old data, so on a hard drive a lot is usually recoverable. On an SSD, the TRIM feature typically erases deleted data within minutes, so a reset SSD is frequently unrecoverable. We assess which case applies and tell you honestly what’s possible before any work.
Frequently, yes. Even when data is removed, a reset or wipe tends to leave artifacts and traces, and it’s often possible to establish that a reset was carried out and when — which can itself be significant evidence in a dispute. Any such findings are documented forensically so they can be relied on.
Because it wouldn’t be honest. How much survives a reset depends on the drive type and wipe method — sometimes a great deal, sometimes almost nothing (as on a TRIM-enabled SSD). We assess the specific device and report candidly on what was recovered and what couldn’t be, which is exactly what makes a forensic report credible and usable.