Service
Data recovery
What is examined
- Hard drives, SSDs, memory cards and USB media
- Logical damage: deleted partitions, corrupted file systems, formatting
- Physical damage: mechanical faults, electronic faults, water and fire damage
- RAID systems and virtual disk images
How the examination is carried out
- 1.Assessment of the medium before any write access takes place
- 2.Sector-by-sector imaging, with tolerance for read errors
- 3.Reconstruction of file systems and RAID parameters from the image
- 4.Verification of recovered data and documented handover
Technical limits
These limits are stated before the instruction, not afterwards.
- Overwritten areas cannot be recovered.
- On SSDs with TRIM, deleted data is usually irretrievably discarded.
- Encrypted media without a key cannot be recovered in readable form.
- Continued use of the affected medium reduces the prospects considerably.
FREQUENTLY ASKED QUESTIONS
Data recovery: frequently asked questions
Stop using the medium and do not run recovery software on it. Every further write operation can overwrite the data that is still recoverable.
Analysis takes place on the secured working copy in the permanent examination rooms at the registered office in Krefeld, Germany. Devices are handed over in person or sent by insured carrier; by prior arrangement, processing in Munich is also possible. Where the technical conditions allow it, the acquisition itself can also be carried out at the client’s premises or at the location of the item; unavoidable changes to a running system are documented with reasons.
Whether an expert report is used in proceedings, and what evidential value it carries, is decided by the competent court or investigating authority. Our examinations are documented so that third parties can review them: recorded handover, cryptographic hashes, described methods and a clear separation between technical finding and assessment. A binding assurance of later admissibility cannot be given.
Equipment used
Systems used in this examination
- X-Ways Forensics
File system analysis and reconstruction of existing data structures.
Next step
Discuss your case
Describe the situation briefly. We will say what can realistically be established, and what cannot.