data recovery get quote

Converting Lotus Notes Files

Posted on 2nd March 2013 by Chantal Stone
Our client wishes to move my data stored on an ibm approach file to a microsoft data base.  Our solution is to convert the Lotus Approach files to Microsoft Access, which will serve well for the future.  However they are very different in concept and structure and the user interface is not compatible.  We are exporting the data from Lotus Approach, but there are no utilities to allow us to import it into Access.  Therefore we are writing specific scripts for this.  Once the data is in Access we will need to restructure it into a set of properly normalized relational tables and build the Forms and Reports.

Damaged Encryption Key

Posted on 22nd February 2013 by Aran Pitter
Unfortunately we have been unable to recover any data from a recent damaged encryption key.  Upon powering the disk the disk comes ready, but had the write protection on it. We then used a Mariner board A0rt and underwent a rom swap and then we could access the disk on data extractor. We then looked at the LBA where the KEY is stored and the key is actually damaged. This is required to access the disk and if this is damaged this is not possible. Unfortunately, there is nothing that can be done about this problem. Therefore, this is not recoverable.

Linux RAID Recovery Limitations

Posted on 21st February 2013 by Aran Pitter
A RAID with two 320 GB SATA drives just in. There are limitations on recovering deleted Linux and Unix files. Unlike in Windows deleted files do not retain their names or extensions so it can be difficult to find the necessary deleted files that you want back. However, it is possible to recover deleted UNIX files but rather difficult and not always successful.  Similarly there are no comprehensive undelete utilities. We are going to have to reconstruct the RAID and then attempt to find the deleted files by file size and date of deletion.  As I said before, it is important to recover the files as soon as possible, because once the space that the file had occupied is overwritten it cannot be recovered.

Mobile Phone Forensic Examination

Posted on 11th February 2013 by Shaun Weston
Our client is looking for a forensic examination of their mobile phone in support of a civil claim.  The mobile phone appears healthy, so we should be able to interrogate both the SIM Card and internal memory for deleted data.  Initially we will take a forensic clone of both media, before calculating the data parameters and recovering all information, including deleted data.  This will be presented in a series of spreadsheets and will include any metadata pertaining to the relevant correspondence.  We have been asked to concentrate on specific SMS messages and will be conducting a signature search for specific data.  All our investigations comply with the ACPO Procedures for Electronic Evidence.

DICOM Conversion to JPG

Posted on 21st January 2013 by Aran Pitter
Got a DVD with DICOM images of patient records.  We can extract 349 files from the DVD.  They are DICOM images that we are extracting as JPG.  The client wants to edit them in Quark, but they would have to alter the images themselves.  The data is badly corrupted and there is still much more work to do, but we are confident now that this will be a successful recovery.

Firmware Failure on Western Digital Drive

Posted on 18th January 2013 by Aran Pitter
Duncan has been working on this trying to rebuild the firmware on a failed drive, but to no avail.  The firmware resides in the motor chip that has blown and the chances are not good.  The problem with these Western Digital drives is that the firmware is built into the motor chip. The chances of success at this stage are not overly optimistic.  If you imagine the firmware as the “brain”  without this the body cannot function.  A certain amount of work can be done on the “brain”, but this one has completely burnt out.

Problems with Chinese Manufactured Drives

Posted on 16th January 2013 by Chantal Stone
These drives manufactured in China are notoriously bad mechanically.  We suspect our latest drive just received is suffering from a flaw in the manufacturing. Opening the drive it is apparent the head-stack has failed.  There is massive media corruption at the beginning *and* end of the drive. I have not been able to access the space in between.  A replacement drive is required for donor parts.  Thereafter, the media damage must be polished out, headstack replaced and realigned, system parameters calculated and a slow revolution image started.  Once we have a full image of the raw code, we can then set about rebuilding the data.

Invalid Boundary for Circular Event Log

Posted on 11th January 2013 by Tony Pitter
When testing the drive, it is assigned a drive letter, but cannot be interrogated.   The fault stems from a firmware issue that set an invalid boundary value for the drive’s ‘circular event log’. Where this coincides with a particular test pattern being placed in the system tracks of the reserved area by some of Seagate’s post manufacture ‘tester’ applications, the event log pointer is incremented beyond its allowable boundary. This is detected as an ‘Assert Failure’ by the drive which ‘freezes’ as a self-protection response. Once this occurs the drive is remains inoperable however many times it is subsequently powered up.   This is a complicated recovery, which involves a huge amount of engineering time, however we are confident of success.

Heads Failing to Initialise

Posted on 8th January 2013 by Aran Pitter
Just testing a new hard drive received for data recovery.  When tested this is spinning up and then down and the heads are failing to initialise.  We do not believe there is an underlying mechanical or logical problem, but we suspect the problem is firmware related.  In order to proceed, we are going to need an exact replacement hard drive in terms of firmware.  Whilst we have drives of the same model in stock, we do not have the firmware revision ZF01.   In order to proceed we will attempt to replace the ROM and failing this, a complete firmware rebuild.  Parts are not likely to be in until Monday now, so we would not envisage completing this until middle of the week at the earliest.

TAR Format on a SUN System

Posted on 7th January 2013 by Aran Pitter
I’ve a customer who sent me two ½” mag tapes, with data written in TAR format on a SUN system.  They wanted the data lifted off and put onto CD. They have a Pertec I/F ½” drive, but this needed a SCSI drive.  The tapes were good (although written about 14 years ago) and they gave us a list of the files they needed.  The tapes had already been looked at with no success by a leading data recovery company!  Even so we have managed to restore everything!

[1] [2] [3][4]