Computer Forensics & Data Recovery has articles on a wide variety of subjects relating to Computer Forensics - Data Recovery, Computer Crime, Cryptography, Freeware Computer Forensic Toolkit.


Fresh Advice:

Before recovering data from a USB drive, assess if the data is really important. If not, you can discard the drive. However, once you decide on recovering it, I would rather recommend approaching a data recovery company, even if it means a little additional money that you ought to spend from your pockets. There is an added danger inherent in USB storage devices as many Operating Systems automatically recognise and authorise them and therefore if data has been corrupted by a virus, files containing a virus can then be transfered to another drive when connected to a computer.

Data Recovery


iData Recovery is a process by which data that cannot be normally accessed from damaged media storage devices is retrieved by using special software and devices.

Modern businesses rely on information technology to increase their efficiency. Printed paper is increasingly getting replaced with printed circuit boards. Digital databanks are taking the place of shelves spilling over with paper files. All this is possible because of digital storage devices that harbour large amount of data critical to the operations of today's enterprises. When such media goes bad, it cripples the entire organisation. The impact of total data loss on entities like commercial banks, research institutions, airlines and accounting firms can put their survival at stake.

Every company that loses critical data is willing to pay arnking's ransom to somehow get it back so that its operations continue unaffected. To fulfil this need, a multi-million-dollar industry has grown up that specialises in recovering data from non-functional storage devices. Data recovery is also essential in the fields of computer forensics, cyber-crime, intelligence gathering by investigative agencies and industrial espionage.


Why does Storage Media Gets Damaged?

The need for data recovery arises when the storage media becomes defective and cannot be read by normal means, that is, it stops responding tornrequests for data access. This happens due to two main causes - mechanical (hardware) failure and logical (software) failure.


1. Software Failure - The data often gets deleted accidentallyrnby the user, leading to much anxious wringing of hands. Another prominent cause of data loss is a virus attack or power surge which may vaporise the data or make it inaccessible. A logical fault arises when the partition and file systemrnof a hard disk get corrupted, rendering the data unreadable, or if the drive carrying data has been re-formatted inadvertently. Logical failure is a tricky situation and the data recovery process in such cases is time-consuming.


2. Hardware Failure - This arises from actual physical damage to the components of the storage device. In a hard drive, this may be caused by a defective spindle motor or controller card, damaged head or head stuck on the platter. The drive may have gone through physical abuse like fire or water damage, impact trauma (fallen hard to the ground) or even sabotage.

The success rate of data recovery is higher in cases of logical failure.


How is Data Recovered?

Data recovery operations are carried out, inside, what is called a "clean room." It is an enclosed space having a controlled environment designed to eliminate or drastically reduce microscopic particles. Usually, clean rooms are Class 100 standard, which means that they do not have more than 100 particles of 50 microns or higher floating in a cubic feet of air. Some data-recovery companies may even have a Class 10 clean room which is ten times cleaner than a Class 100 room. Clean rooms are required because even a spec of dirt inside a storage media like a hard drive can cause a kill defect and irreversibly damage the hard drive.

The following steps are involved in recovering data from a defective storage media:

  1. The faulty hard disk drive is shipped to the data-recovery company which sends it to its clean room for evaluation.
  2. Technicians carefully open the disk and give it an inspection to determine if it is a mechanical, electrical or logical failure.
  3. Once the correct cause of the failure is diagnosed, the procedure to recover the data is decided. Other issues ascertained include how much data can be retrieved, how much time it will take and how much will it cost the customer.
  4. A variety of proprietary software and specially designed devices are used to process the disk. In cases of hardware damage, faulty components like drive motors or head assembly are replaced or repaired. The individual drive platters are closely examined to judge the extent of surface damage and each drive is tackled separately for repair.
  5. In cases where the disk damage is logical, a non-destructive process is used. In this, a mirror image of the drive is created by carefully scanning the drive surface. All recovery work is done on the clone, leaving the original disk undisturbed. The data is then analysed, the logical structure of partitions and files determined, and essential repairs carried out.
  6. Once the data is recovered, it is handed over to the customer in a media of one's choice, like a new hard disk, CD-ROM or DVD-ROM.

Data recovery mostly deals with a range of hard drives, tape drives, RAID, email servers, relational databases, CDs, DVDs, compact flash disks and even cell phones and Blackberries.


UK Data Recovery Companies

The UK has dozens of companies engaged in data-recovery work. Some recommended companies and software include the following:


Cryptographic Methods - Posted on 10/1/2008

Computer Crime and Computer Forensics - Posted on 2/1/2008

The Freeware Forenic Toolkit - Posted on 6/12/2007