• left-quotesWe had one of our employees steal data from the company and gave it to one of our competitors...”

  • left-quotesAn employee leaked a confidential recording of one of our shareholder meetings, causing a public relations disaster...”

  • left-quotesSomeone on Twitter falsely accused me and my business of all kinds of illicit acts, damaging the company’s reputation and I wanted to know who was behind the Twitter profile to pursue legal action...”

  • left-quotesSomeone in our company deliberately deleted sensitive data, and we needed to identify what was deleted, when and by whom...”
  • left-quotesOur systems administrator used the datacenter servers to mine cryptocurrency over a period of several months, and we needed to have his devices investigated to pursue legal action...”

Forensic Data Recovery

Forensic data recovery from all types of digital storage device including Server, NAS, SAN, RAID volumes, PC, laptop USB hard drives, CCTV storage, mobile devices and memory sticks where specialized data recovery tools, equipment, software and skills are required to extract potential digital evidence.

Whether your storage device is suffering from an electro-mechanical failure, firmware corruption, hidden data in the service areas or password-protection our team of professionals will do all that is in our power to help you recover any potential evidence.

Typical Forensic Recovery And Investigation Scenarios:

  • Extraction of potential evidence from faulty as well as physically damaged storage devices including dropped, power surge, fire and water damaged devices.
  • Extraction of service area data (firmware), using factory access mode, that may be used to store data, malware, spyware etc.
  • Extraction of other non-addressable areas, using factory access mode, for example, media cache, that may contain data no longer available on the storage device.
  • Removal of BIOS and storage device passwords.
  • Password discovery and decrypting of firmware (hardware) encrypted storage devices.

We Recover And Investigate Data From Most File Systems And Partition Types, Including:

  • 12-bit FAT (FAT12) - All versions of DOS
  • 16-Bit FAT (FAT 16) - All versions of DOS and Microsoft Windows
  • 32 Bit FAT (FAT 32) - DOS v7 and higher, Windows 98, ME, 2000, XP, Windows 2003 Server, Windows Vista, Windows 7
  • Extensible File Allocation Table (exFAT) - Windows CE 6.0, Windows Vista, Windows 7, WinXP, Windows 10, Mac, Linux
  • New Technology File System (NTFS) - Windows server 2000, 2003, 2008, 2013, 2016, Windows 10, 8, 7, Vista, NT, XP
  • New Technology File System version 5 (NTFS 5) - Windows server 2000, 2003, 2008, 2013, 2016, Windows 10, 8, 7, Vista, NT, XP
  • Microsoft Live File System - Universal Disk Format (UDF) - CD/DVD media
  • Resilient File System (ReFS) - Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012
  • Second, third and fourth extended file system (EXT2, EXT3 and EXT4) - Linux
  • Reiser File System (ReiserFS) - Linux
  • B-tree file system (Btrfs) - Linux
  • Macintosh File System (MFS), Hierarchical File System (HFS), Mac OS Extended (HFS+), HPFS, Apple file system (APFS)
  • UNIX File System (UFS1 and UFS2) - Mac, Unix
  • Journaled File System (legacy JFS) and Enhanced Journaled File System (JFS2) - IBM AIX and Linux
  • Virtual drives - VMware (VMFS), DD, IMG, BIN, VHD, VHDX, E01, ESX(i) volumes
  • Novell Storage Services (NSS) and NetWare File System (NWFS)
  • HP-UX VxFS version 6 and below
  • Symantec Storage Foundation
  • SUN/Oracle ZFS
  • OpenVMS
  • ISO 9660 - CD-ROM
  • LYNX OS (LynxFS)
  • High-Performance File System (HPFS) - OS2
  • Yet Another Flash File System - Yaffs2

We Recover And Investigate Data From All Hard Disk Media Types, Including:

  • Personal computer (PC) 3.5" hard disk drives - SSD, IDE, EIDE, PATA, Fiber Channel, SATA, M.2 SATA, M.2 PCIe NVMe/AHCI, PCIe x16
  • Laptop 2.5"/1.8" hard disk drives - Solid State Drive (SSD), IDE, SATA, ZIF, LIF, Fiber Channel and Micro SATA (mSATA), M.2 SATA, M.2 PCIe NVMe/AHCI, PCIe x16 and Apple MacBook
  • External 3.5"/2.5" hard disk drives - USB 1.0, USB 2.0, USB 3.0, Firewire and eSATA
  • Server, RAID, NAS, SAN
  • SCSI and SAS hard drives (including, multi-boot, spanned, striped (RAID 0), mirrored (RAID 1), JBOD, RAID 2, RAID3, RAID4, RAID 5, RAID 6, RAID 10 and all other nested RAID configurations
  • All types of virtual machines and volumes
  • RLL, MFM, ST hard disk
  • ESDI
  • PCMCIA
  • Microdrive

We Recover And Investigate Data From These And All Other Crashed Drive Symptoms And Error Messages:

Some common situations and error messages which would suggest that your drive might be suffering from one or more failures or other potential data loss scenarios:

  • Hard drive no longer recognized by the operating system or BIOS.
  • Hard drive detected by the BIOS / operating system but reporting as unreadable.
  • Hard drive making strange/funny sounds when power is applied.
  • Hard disk drive not spinning despite power being applied.
  • Primary hard disk failure / Secondary hard disk failure.
  • Cannot read from the source file or disk
  • Inaccessible boot device.
  • Unable to access drive "X".
  • Disk error, press any key.
  • Device not ready, reading drive "X".
  • Operating system not found / missing operating system.
  • The BIOS recognizes the drive but with garbage parameters.
  • The BIOS recognizes the drive but the data is inaccessible.
  • The drive reports bad sectors.
  • NTLDR is missing, Press any key to restart.
  • Replace disk and press any key to continue.
  • The drive reads some data but reports cyclic redundancy checking (crc) errors.

See Also
Data Recovery vs Forensic Data Recovery vs Forensic Investigation?
Why do storage devices fail and other causes of data loss?

Tags: Digital Forensics Computer Forensics Data Forensics Electronic Forensics Digital Search And Seizure Digital Evidence Digital Forensic Investigation Data Message Forensics Electronic Evidence Forensic Duplicates Data Recovery Hard Drive Recovery Hard Disk Recovery