Data Recovery Guide

CONTENTENGINEER offers forensic Data Recovery Services for the critical loss of data on hard disks, removable media (CD/DVD), memory cards, memory sticks and MP3 players including Apple iPODs.

Data is Everywhere

The miniaturisation of silicon chips and magnetic storage devices enables everyday objects to be computer controlled. All these computers create vast amounts of information which can be extremely valuable. From storing images to music, from calendars to critical business documents, it is essential to secure these digital assets.

Due to the discrete size and fragility of the technology, occasionally the devices that hold this data can get corrupted or damaged causing apparent loss of data. It may be a physical failure, but more often than not, it is caused by system or human error (for example, inadvertently deleting a file or accidentally formatting the device).

---

---

Recovery Experts Available

Help from the independent technical experts at CONTENTENGINEER enables organisations and individuals to recover digital assets. With the experience, skills and appropriate software/hardware toolkit, the Group can recover a large amount of data that would otherwise be lost for good. The Group can recover data from a broad variety of systems, hard disk drives, removable media, memory cards, removable media, and other items that you wouldn’t normally associate with the technical complexities of electronic data storage. Many different filesystems can be recovered.

Forensic Service

CONTENTENGINEER focuses on providing a forensic data recovery service as part of larger projects. We no longer provide general salvage of data from corrupt, damaged, failed or inaccessible storage - there are a wide variety of companies that offer a cost-effective general purpose recovery from media without the expense of a forensically geared service. |See announcement.

Back to top

Recovery from Systems

CONTENTENGINEER has considerable experience in recovering data from different types of systems. The actual recovery method employed will depend on the embedded devices within the system. No one system is the same and the structure of the data held on the device will be unique:

• Digital Cameras hold images and/or video clips on internal memory or memory cards
• Apple iPODs hold music, files, videos and other personal assets on hard disk
• Television Recorder (DVR) - holds digitised video of live [satellite] television on hard disk
• Laptop - holds files, email messages, access logs, internet logs and databases on hard disk and removable media
• Sony Playstation Portable - holds images, games, music and other data on memory cards and also on various recorded media
• Server - holds large volume of files (for workgroup/department) plus databases and access logs on large/many hard disks
• Telephone - holds call details and phone books on embedded memory
• Personal Digital Assistant (PDA) - holds email, messages, call details, phone books, documents and databases on memory cards
• Mobile Phone - holdes messages, pictures, call details and phone book(s) on memory cards

There are a wide variety of manufacturers of complete electronic systems and it would be impractical to list every manufacturer that includes an embedded computer or similar electronics that process data. However, the majority of data recovery requests come from computers, telecommunications, or digital asset recorders.

Starting the Process

For the majority of systems, the forensic data recovery process will involve the removal of the accessible data storage device. For computers, laptops and other similar systems, the Client will usually undertake this work; but the Group can provide onsite assistance for this part of the process. However, for mobile phones, PDAs and MP3 players these need to be received intact due to the fragility and often very customised packaging that actually protects the device in transit.

Recovery from Hard Disks

There are a wide variety of symptoms that would typically be observed by the user of a computer that is experiencing problems with the hard disk:

• Computer will not boot (and disk undetectable to the BIOS)
• Drive is not recognised in file manager or [Windows] explorer
• Drive exhibits a “clicking” sound but appears to be spinning, response is slow to access files
• Operating system claims that hard disk needs reformatting - DO NOT agree, and consult the experts as further damage will occur
• Applications unable to run or load data (files reported as corrupt or unreadable format)
• Systems shows slow response, particularly when opening files or running many programs
• Maintenance icon on MP3 and Apple iPOD indicate problem with the memory
• System failure during fragmentation
• Corruption or errors following virus attack

Back to top

Hard Disk Evolution

The Group has seen the development of hard disks from the early removable magnetic disks, through to washing machine size drives holding a few hundred Megabytes (MBs) to today’s micro-miniature hard drives holding a few Gigabytes (GBs) no larger than a fifty pence piece. There are also a variety of interface types, physical sizes and magnetic recording methods. It is this expertise and experience that enables the Group to offer the reassurance that it can recover a very high proportion of failures that are presented. Unlike some firms that offer an automated, de-personalised, one-size-fits-all approach to data recovery, the Group understands that the data held on a device is extremely valuable to the Client, and that each failure scenario is often different from the last.

The Group also has experience of tackling recovery from large (server) RAID arrays and operating systems other than Microsoft Windows. Indeed, UNIX, Linux, MacOS and FreeBSD are becoming increasingly more popular due to their unique performance and alternative security/programming characteristics. Whilst there may be many different manufacturers of hard disks, the market is consolidating quickly due to the high cost of running manufacturing plants. Fortunately interfaces are fairly standard across the industry - IDE, SATA, SCSI plus USB and Firewire being the majority. The actual recovery process for a hard disk can involve electronics replacement if the control circuitry, drive motor or read/write head are damaged. This is undertaken in a clean environment to avoid further contamination.

Recovery from Memory Cards

In the early days of digital cameras, mobile phones and other consumer electronic goods, there were new media formats springing up on a regular basis. This apparent lack of standards has meant that there are now still many different media types with subtley different interfaces, capacities and physical characteristics. In fact, many systems today accomodate a range of media including Compact Flash, Memory Stick, SIMM Card, MMC, xD-Picture card, SD-Secure Digital and USB [Flash] Memory Stick.

The Group can recover from these types of media, but warns that data loss can occur with embedded memory in consumer goods. It is therefore important that data recovery is undertaken for Mobile Phones and PDAs as part of a forensically sound process that needs to be managed in line with recognised incident management guidelines. This will often demand that the device or system does not lose power and is not switched off. For more information contact the Group or consult the whitepapers and recovery pages on the website.

Recovery from Removable Media

The recovery from removable media such as CD and DVD is potentially challenging, due to the range of formats. Whilst it should comply with international standards, it is the subtle differents between recording and capacity formats that make each engagement particularly interesting. The Group has also recovered data from Smart Cards, SIMM Cards and RFID tags.

Back to top