Forensic data recovery is the process of recovering data directly from storage devices, which is specialised work that requires detailed knowledge about how the transfer of data happens – from the media through the internal components, and into the controlling computer. S2|DATA has specialised knowledge in many areas of magnetically recorded and solid-state media.  Equally important in the field of forensic data recovery is detailed knowledge of the storage medias recording equipment and even more important may be the ability of software engineers to control these peripheral devices in ways that the originating environment did not intend but are useful when attempting different forensic data recovery techniques. Your particular forensic data recovery requirement is very likely unique and best discussed with one of our experts, but our areas of specialty are:

Tape

We have seen all types of recoveries required from tape, many of them simple but sometimes less so. We have seen extremes of temperature take its toll in the Arabian desert, and Hurricane Floyd flooding a data center, but the typical issues are:

• Physical
  • Cartridge casing repair
    • Typically of the cartridge has been dropped
  • Tape leader replacement
    •  Stretched, broken or dislodged
  • Loose debris removal 
    • Preventing the read head getting close enough to the tape surface
• Logical
  • Searching for data past end of data marks
    • Such as inadvertently overwritten tapes
  • Skipping Blocks or FMs (Filemarks)
    • When target data is otherwise unreachable because of IO errors earlier in the tape

Storage Drives – Hard Disk, , Solid State & Thumb Drives

When internal or external drives have exhibited failure to read resulting from things like Hard Drive crashing, reformatting, file system corruption, lost passwords, data deletion, encryption, power spikes and more. Our digital forensic engineers use a plethora of various tools both proprietary and industry known and apply techniques to recover your data. Typical methodologies employed are:

• Use of donor disk drive when the disk platter has become damaged
• Replacement of drive heads or controller boards
• Physical forensic interrogation of all parts of the disk platter which often performs better than computer applications talking to the disk drives, especially in the cases or recovering inadvertently deleted files or folders

RAID arrays

RAID arrays that have become corrupted often because of file system corruption can sometimes be recovered by our software engineers carving data slices from the individual platters and recompiling the data without the use of the original file system.  Because data in RAID configured systems are spread across multiple drives, specialized processes are required to reassemble data back to its original form.