Data Recovery

Most digital forensic experts do not have the training or tools to handle data recovery beyond basic software issues. Deadbolt Forensics is able to perform intermediate recoveries in house including electronic and firmware types of advanced total failures.

Basic: Logical Corruption or Deletion

This consists of software issues with files or filesystems on functional storage devices. Most forensic software will deal with this automatically and most experts can perform this type of recovery.

Intermediate: Read Instabilities

This is when the storage device has a partial hardware failure which prevents the device from being recovered using only a software solution. We have a USB Stabilizer 10Gb from DeepSpar Data Recovery to deal with these types of issues.

Advanced: Total Failure

This occurs when a complete failure of the storage device causes it to become unresponsive. These failures can be divided into the following three categories.

1. Electronic Failure

Usually involves damage to the Printed Circuit Board (PCB) which can require soldering work to repair. In the case of USB Flash Drives and microSD cards, special adapters or soldered wires can be used to directly access the raw NAND flash memory for rebuilding and recovering the data. Our tools include an Electrostatic Discharge (ESD) safe workspace with soldering and rework equipment along with Visual NAND Reconstructor (VNR) from Rusolut.

2. Firmware Failure

This is when the software that is embedded in the storage device fails. We use a PC-3000 from ACE Lab to repair such drives.

3. Physical Failure

Typically involves damage to the internals of a hard drive requiring physical repair in a class 100 clean air workstation with access to a large inventory of donor parts. Although trained in this type of repair, we don’t have an inventory of donor parts since data recovery is not our primary business. These types of repairs will be outsourced to our preferred vendor.