How the Data Recovery Process Works

How Disklabs Data Recovery and Computer Forensics Services Go About Their Data Recovery Work

Using specialised equipment sourced from right across the world, our extensive facilities and expertise ensures that around 98% of all hard drives sent to us have data successfully recovered from them. That includes all drives sent to us under our ‘no win, no fee’ policy, which means that we often get the recovery jobs that our competitors cannot successfully complete themselves.

There are several processes we employ when attempting to retrieve data. For the purpose of this brief overview, we’ll assume it’s a hard drive we’re dealing with, but note we’re equally happy to work with RAID, (Random Array of Independent/Inexpensive Drives), floppy disks, flash cards, mobile phones, tapes, CDs, DVDs – in fact, whatever storage media you’re having problems with, it’s likely we can do something to help recover your data.

Firstly, we take an image of all immediately accessible
data, and transfer it onto our server. This ensures that we’ve got a mirror image copy of it kept safe and sound. We then do a further copy of this image to one of our workstations, which is where we perform the first set of recovery procedures. We start with a series of sophisticated software utilities, which resolve around a third of the problematical drives we encounter. In brief, we initially look for the likes of low-level corruption that can be repaired by our software. It could for instance, be that the boot sector of the drive isn’t where it should be, which alone could stop a hard disk from functioning correctly.

If the initial sweep with the software diagnostics fails to solve the problem, then we resort to more advanced utilities including hexadecimal. From a software point of view, these are capable of ‘rebuilding’ the drive, and have been known to repair drives that have contained significant levels of corruption.

Our software is so advanced that it can alert us to problems with issues like firmware. We regularly rewrite drive firmware, fully aware of how vital it is to get the exact revision codes to match up with the exact drive.

The majority of drive problems we face are down to
hardware issues, and this is where the bulk of our work is carried out. We regularly strip drives down to “bare bones” status, in order to repair physical problems. This might be motors that need replacing, heads that need repairing or dust that needs removing (this work is undertaken in a specially prepared and maintained dust-free area known as a clean room). There are myriad potential faults covered under the guise of “physical problems”, which is why we keep an extensive stock of over 20,000 spare parts on the shelf. That said, it’s an intricate business and it’s often vital to completely match up the codes on the drive’s heads, for instance and for that we extensively source parts worldwide.

Once we have completed our brief and recovered the data, we then return it to the client in the format of their choice.
We can write the image back to hard disk, or can transfer it onto a CD, DVD, flash card – in fact, whatever storage media they prefer.

Our resources – both human and technological – allow us to work on dozens upon dozens of drives concurrently, giving them each full and proper attention, and we’re proud that we complete the overwhelming majority of all jobs within a 7-10 day turnaround period. We do, of course, offer an emergency “premium service” for those who need a job completing as a matter of extreme urgency.

This has been a brief and extremely simplified outline of the procedures we follow for recovering data. Clearly there’s far more in-depth expertise involved, but hopefully it has given you some idea of how we go about our work.

One more thing… Remember the image that we take of a drive when it initially comes into our premises? We keep that on our systems for fourteen days after the completion of a job, just to be on the safe side (belt and braces you might say). After that, it’s completely erased from our system, and we keep no record beyond that of your data.

If you have any questions about any of the above, then please don’t hesitate to get in touch. But for now, we’ll leave you with a simple analogy.

The speed at which a hard disk spins, and the fact that its heads are so low, is the equivalent of a completely loaded 747 doing Mach 20, flying at an altitude of one inch, counting every blade of grass as it goes. Just one piece of dust on the drive itself could be equivalent to a house in the 747’s way!