data recovery get quote

Handling electronic evidence

Posted on 23rd December 2013 by Shaun Weston
ACPO publish strict guidelines for data to be used as evidence. It is important that these are strictly adhered to when investigating computers. In summary, no action taken by law enforcement agencies, persons employed within those agencies or their agents should change data which may subsequently be relied upon in court. In circumstances where a person finds it necessary to access original data, that person must be competent to do so and be able to give evidence explaining the relevance and the implications of their actions.

An audit trail or other record of all processes applied to digital evidence should be created and preserved. An independent third party should be able to examine those processes and achieve the same result. The person in charge of the investigation has overall responsibility for ensuring that the law and these principles are adhered to.

What is logical failure?

Posted on 15th January 2015 by Aran Pitter
A client's server was not responding and attempts to re-boot failed. The client's IT support disassembled the virtual machine to prepare for launching a new server; however after one of the virtual storage volumes was forcibly detached and re-connected, Windows found the volume to be corrupt. Given the timescales to rebuild the environment, the clients asked us to intervene. After a one hour diagnosis, our engineers were able to rebuild the virtual server in less than 36 hours.

Flood damaged hard drive

Posted on 10th December 2013 by Tony Johnson
In the most extreme cases logical failure can include a hard drive that spins up fine, but is subsequently not recognized by the computer’s BIOS. In a logical failure the hard drive's electronic components and mechanical components are all working properly. Logical failures occur as a result of defective media (platter degradation) or data corruption from another source (destroyed file table, etc).

Almost all logical failures can be recovered without the need to open the hard drive. While there are a number of logical data recovery software programs on the market, its important to know why your drive has experienced a logical failure before you attempt to recover your data. If you misdiagnose a logical failure, you can cause irreparable damage to the drive in your recovery attempt.

Recovering CT scans

Posted on 15th October 2013 by Aran Pitter
The radiography department of a leading NHS Trust hospital approached us to recover the health records when their server failed. The LINUX server had suffered a common firmware fault on a RAID system, which we had to rebuild. We were able to recover the patient records and scan images within two working days. This timely recovery saved the time, expense and discomfort of re-scanning the patients and may well have saved people's lives.

Digital manipulation of photographs

Posted on 7th October 2013 by Aran Pitter
Image error level analysis is a technique that can help to identify manipulations to compressed (JPEG) images by detecting the distribution of error introduced after resaving the image at a specific compression rate. JPEG images use a lossy compression system. Each re-encoding (resave) of the image adds more quality loss to the image. Specifically, the JPEG algorithm operates on an 8x8 pixel grid. Each 8x8 square is compressed independently. If the image is completely unmodified, then all 8x8 squares should have similar error potentials. If the image is unmodified and resaved, then every square should degrade at approximately the same rate. If it is modified then each square will not degrade at the same rate!

Firmware updates

Posted on 20th September 2013 by Aran Pitter
Having the latest firmware can improve performance and or reliability of your hard drive. Like any software, firmware is improved over time and problems are also fixed. Many drive families have a couple of firmware releases during the life of the product. Until recently, firmware updates for typical desktop and laptop computers were difficult and somewhat risky. This situation, in part, was based on a lack of friendly firmware download tools and operating system limitations.

Pulling memory sticks out without shutting down

Posted on 13th September 2013 by Aran Pitter
When removing your memory stick from your computer, it is imperative to disconnect the device safely. Otherwise removing the power while the memory stick is reading or writing data means you are taking the chance that the device can shut itself down into a safe state within milliseconds.  This is a tall order and to expect it to work every time without fail is hoping the controller designers got their sums right.

Are you introducing risk into your Virtual Environment?

Posted on 23rd August 2013 by Geraint Jones
Snapshots are stored by default in the same location as the VHD file, so the snapshot files can build up and choke the storage of a disk with limited available space. Your first inclination may be to delete those snapshot files if you don't need them using the Hyper-V Manager. This won't actually get rid of those snapshot files; it will merely mark them for a merge into your main VHD. The next time you shut down the virtual machine the merge will occur, so if you have many snapshots this can take a bit of time. Thus, there aren't any quick ways to relieve disk space issues with snapshots without a complete shutdown of a virtual machine, so be sure to plan your snapshots appropriately and make time for maintenance to avoid future issues.

Hard drives in the freezer?

Posted on 8th August 2013 by Aran Pitter
A hard drive has a breather hole in the chassis.  This is to allow pressures to equalise both inside and out when the drive is spinning. Although this breather hole is only tiny and does have a filter, moisture can easily penetrate! Whilst it is true that if you can keep a failing hard drive cool, you may be able to run it for a longer period enabling you to retrieve valuable information before it crashes - once the drive has already failed, there is little that can be done by cooling the mechanics.  Indeed putting your hard drive in the freezer, risks moisture ingress.  Similarly, a sudden cooling may also cause any minute water particles inside the drive to condensate.  My suggestion would be to leave the freezer well alone!  Better to use a desktop fan on the drive whilst it is spinning!

LTO-5 drives overwriting data

Posted on 22nd July 2013 by Aran Pitter
A LTO-5 was sent to us for data recovery.  The client reported that the tape was not even mounting.  There should have been 1.2TB of data on the tape and that during the copy operation the drive had reset and rewound then continued writing. At about 1.15TB something went wrong, the drive rewound the tape but the LTFS software/drive that was transferring the data to the tape did not get an error from the drive and so kept merrily transferring data. This data was then written from the start of the data partition and overwriting what had been written earlier!

[1] [2] [3] [4]