Forensic data recovery is a process in which data is recovered from a faulty digital media such as a hard drive, SSD, memory stick, camera, or any computer hardware onto which digital data is stored. There are several data recovery categories with some variations which can be summarised as follows:
Data recovery from a digital device which does not have an electronic or mechanical failure:
This type of data recovery is classed as “logical data recovery”. This means the data recovery technician will need to repair and recover the data partition and reconstruct the file system in order to make the data visible and usable. In such circumstances, the data container has been damaged and as a result, you cannot see the data.
The second category in data recovery is when the digital device is electronically damaged:
In this type of data recovery, the device is examined for any electronic fault and component damage. Quite often electronic damage also causes logical damage to the file system because electronic fault disrupts the flow of data to and from the media and as a consequence the data container breaks down and loses it integrity.
In the third category, we have digital devices with faulty read-write heads:
This means the heads are stuck and do not let the disk to spin or clicking or ticking of the hard drive occurs. In mechanically faulty hard drives, a head transplant is required. This involves using a compatible donor disk which can be used for parts. The data recovery technician then takes out the heads from the healthy donor disk and transplants to the faulty drive. This temporarily repairs the hard drive and allows it be imaged so that an exact clone is created. Data is the recovered from the disk clone and copied onto another disk.
Digital Forensics Lab has the capability to recover data from all types of media no matter which category they fit into. In computer forensic investigations, it is sometimes necessary to recover the data before any investigative work can be done because the media may have been deliberately mishandled or an attempt on damaging it has been made. For more detailed information, see our partner website, Data Recovery London Lab.