Forensic Data Recovery

Forensic data recovery from all types of digital storage device including Server, NAS, SAN, RAID volumes, PC, laptop USB hard drives, CCTV storage, mobile devices and memory sticks where specialized data recovery tools, equipment, software and skills are required to extract potential digital evidence.

Whether your storage device is suffering from an electro-mechanical failure, firmware corruption, hidden data in the service areas or password-protection our team of professionals will do all that is in our power to help you recover any potential evidence.

Typical Forensic Recovery And Investigation Scenarios:

  • Removal of BIOS and storage device passwords.
  • Password discovery and decrypting of firmware (hardware) encrypted storage devices.
  • Extraction of potential evidence from device media cache.
  • Extraction of potential evidence from physically faulty or damaged storage devices including fire and water damage.

We Recover And Investigate Data From Most File Systems And Partition Types, Including:

  • 12-bit FAT (FAT12) - All versions of DOS
  • 16-Bit FAT (FAT 16) - All versions of DOS and Microsoft Windows
  • 32 Bit FAT (FAT 32) - DOS v7 and higher, Windows 98, ME, 2000, XP, Windows 2003 Server, Windows Vista, Windows 7
  • Extensible File Allocation Table (exFAT) - Windows CE 6.0, Windows Vista, Windows 7, WinXP, Windows 10, Mac, Linux
  • New Technology File System (NTFS) - Windows server 2000, 2003, 2008, 2013, 2016, Windows 10, 8, 7, Vista, NT, XP
  • New Technology File System version 5 (NTFS 5) - Windows server 2000, 2003, 2008, 2013, 2016, Windows 10, 8, 7, Vista, NT, XP
  • Microsoft Live File System - Universal Disk Format (UDF) - CD/DVD media
  • Resilient File System (ReFS) - Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012
  • Second, third and fourth extended file system (EXT2, EXT3 and EXT4) - Linux
  • Reiser File System (ReiserFS) - Linux
  • B-tree file system (Btrfs) - Linux
  • Macintosh File System (MFS), Hierarchical File System (HFS), Mac OS Extended (HFS+), HPFS, Apple file system (APFS)
  • UNIX File System (UFS1 and UFS2) - Mac, Unix
  • Journaled File System (legacy JFS) and Enhanced Journaled File System (JFS2) - IBM AIX and Linux
  • Virtual drives - VMware (VMFS), DD, IMG, BIN, VHD, VHDX, E01, ESX(i) volumes
  • Novell Storage Services (NSS) and NetWare File System (NWFS)
  • HP-UX VxFS version 6 and below
  • Symantec Storage Foundation
  • SUN/Oracle ZFS
  • OpenVMS
  • ISO 9660
  • LYNX OS (LynxFS)
  • High-Performance File System (HPFS) - OS2

We Recover And Investigate Data From All Hard Disk Media Types, Including:

  • Personal computer (PC) 3.5" hard disk drives - SSD, IDE, EIDE, PATA, Fiber Channel and SATA
  • Laptop 2.5"/1.8" hard disk drives - Solid State Drive (SSD), IDE, SATA, ZIF, LIF, Fiber Channel and Micro SATA
  • External 3.5"/2.5" hard disk drives - USB 1.0, USB 2.0, USB 3.0, Firewire and eSATA
  • Server, RAID, NAS, SAN
  • SCSI and SAS hard drives (including, multi-boot, spanned, striped (RAID 0), mirrored (RAID 1), JBOD, RAID 2, RAID3, RAID4, RAID 5, RAID 6, RAID 10 and all other nested RAID configurations
  • All types of virtual machines and volumes
  • RLL, MFM, ST hard disk
  • ESDI
  • PCMCIA
  • Microdrive

We Recover And Investigate Data From These And All Other Crashed Drive Symptoms And Error Messages:

Some common situations and error messages which would suggest that your drive might be suffering from one or more failures or other potential data loss scenarios:

  • Hard drive no longer recognized by the operating system or BIOS.
  • Hard drive detected by the BIOS / operating system but reporting as unreadable.
  • Hard drive making strange/funny sounds when power is applied.
  • Hard disk drive not spinning despite power being applied.
  • Primary hard disk failure / Secondary hard disk failure.
  • Cannot read from the source file or disk
  • Inaccessible boot device.
  • Unable to access drive "X".
  • Disk error, press any key.
  • Device not ready, reading drive "X".
  • Operating system not found / missing operating system.
  • The BIOS recognizes the drive but with garbage parameters.
  • The BIOS recognizes the drive but the data is inaccessible.
  • The drive reports bad sectors.
  • NTLDR is missing, Press any key to restart.
  • Replace disk and press any key to continue.
  • The drive reads some data but reports cyclic redundancy checking (crc) errors.

See Also
Why do storage devices fail and other causes of data loss?
Data Recovery vs Forensic Data Recovery vs Forensic Investigation

Tags: Digital Forensics Computer Forensics Data Forensics Electronic Forensics Digital Search And Seizure Digital Evidence Digital Forensic Investigation Data Message Forensics Electronic Evidence Forensic Duplicates Data Recovery Hard Drive Recovery Hard Disk Recovery