Legacy Data Access

Data Recovery

When the media itself is the problem

What data recovery involves

Forensic data recovery is the process of recovering data directly from storage devices. It is specialized work that requires detailed knowledge about how the transfer of data happens, from the media, through the internal components, and into the controlling computer. S2|DATA has specialized knowledge in many areas of magnetically recorded and solid-state media.

Equally important is a detailed knowledge of the recording equipment itself, and, more important again, the ability of software engineers to control these peripheral devices in ways the originating environment did not intend, but which are useful when attempting different recovery techniques.

Your particular data recovery requirement is very likely unique and is best discussed with one of our experts.

Recovery is not restoration

The two terms are often used interchangeably, and they describe different work. Restoration reads data that is intact but locked inside a proprietary format, backup application or environment. Recovery gets data off media that is damaged, degraded, corrupted or failing, before anything can be read from it at all.

Most legacy data projects are restoration work. Recovery is what we do when the media itself is the problem, and the two are sometimes used together on the same project.

If the media is sound and the format is the obstacle, see Tape & Legacy Data Restoration.

Tape

We have seen all types of recoveries required from tape, many of them simple but sometimes less so. We have seen extremes of temperature take their toll in the Arabian desert, and Hurricane Floyd flooding a data center. The typical issues are:

Physical

Cartridge casing repair, typically where the cartridge has been dropped
Tape leader replacement, where it is stretched, broken or dislodged
Loose debris removal, where debris prevents the read head getting close enough to the tape surface

Logical

Searching for data past end of data marks, such as on inadvertently overwritten tapes
Skipping blocks or filemarks, where target data is otherwise unreachable because of I/O errors earlier in the tape

Storage drives: hard disk, solid state and thumb drives

Internal or external drives can fail to read as a result of a hard drive crash, reformatting, file system corruption, lost passwords, data deletion, encryption, power spikes and more. Our digital forensic engineers use proprietary and industry known tools, and apply techniques to recover your data. Typical methodologies employed are:

Use of a donor disk drive where the electronics or alignment of disk platters has rendered the complete unit inoperable
Replacement of drive heads or controller boards
Physical forensic interrogation of all parts of the disk platter, which often performs better than computer applications talking to the disk drives, especially when recovering inadvertently deleted files or folders

RAID ARRAYS

RAID arrays that have become corrupted, often because of file system corruption, can sometimes be recovered by our software engineers carving data slices from the individual platters and recompiling the data without the use of the original file system. Because data in RAID configured systems is spread across multiple drives, specialized processes are required to reassemble data back to its original form.