Forensic data recovery is the process of recovering data directly from storage devices, which is specialized work that requires detailed knowledge about how the transfer of data happens – from the media through the internal components, and into the controlling computer. S2|DATA has specialized knowledge in many areas of magnetically recorded and solid-state media. Equally important in the field of forensic data recovery is detailed knowledge of the storage medias recording equipment and even more important may be the ability of software engineers to control these peripheral devices in ways that the originating environment did not intend but are useful when attempting different forensic data recovery techniques. Your particular forensic data recovery requirement is very likely unique and best discussed with one of our experts, but our areas of specialty are:
Tape
We have seen all types of recoveries required from tape, many of them simple but sometimes less so. We have seen extremes of temperature take its toll in the Arabian desert, and Hurricane Floyd flooding a data center, but the typical issues are:
Physical
Cartridge casing repair
Typically of the cartridge has been dropped
Tape leader replacement
Stretched, broken or dislodged
Loose debris removal
Preventing the read head getting close enough to the tape surface
Logical
Searching for data past end of data marks
Such as inadvertently overwritten tapes
Skipping Blocks or FMs (Filemarks)
When target data is otherwise unreachable because of IO errors earlier in the tape
Storage Drives – Hard Disk, Solid State & Thumb Drives
When internal or external drives have exhibited failure to read resulting from things like Hard Drive crashing, reformatting, file system corruption, lost passwords, data deletion, encryption, power spikes and more. Our digital forensic engineers use a plethora of various tools both proprietary and industry known and apply techniques to recover your data. Typical methodologies employed are:
Use of donor disk drive when the disk platter has become damaged
Replacement of drive heads or controller boards
Physical forensic interrogation of all parts of the disk platter which often performs better than computer applications talking to the disk drives, especially in the cases or recovering inadvertently deleted files or folders
RAID arrays
RAID arrays that have become corrupted often because of file system corruption can sometimes be recovered by our software engineers carving data slices from the individual platters and recompiling the data without the use of the original file system. Because data in RAID configured systems are spread across multiple drives, specialized processes are required to reassemble data back to its original form.