Data Recovery 2

Computer Data Loss, Data Recovery and Forensic Analysis

Computer data loss can and does occur either inadvertently or by malicious intent, and almost everyone at some time finds that a crucial piece of information is no longer accessible. Fortunately, 'deleting' a file usually just confines it to the 'Recycle-Bin' which is a 'holding' area on the system's hard-disk allocated for this purpose. These 'deleted' files will remain forever in limbo and may be recovered intact and in their entirety from the 'bin', until manually removed. However, what happens when you do Empty the Recycle-Bin' or perhaps, find that a file that was fine yesterday has disappeared from the system without trace?
        
Just because a file is no longer visible as a directory entry in your program doesn't necessarily mean that the file no longer exists on the disk. It could just mean that the index entry to its existence has been deleted. This is akin to removing an index entry at the back of a massive book where the pages are bound in some arbitrary sequence: The referenced page may still be within the body of text but unless you know where to look, it may as well have been ripped out. Clearly, knowing where to look and how to recognise the un-referenced data is a skilled task requiring specialised knowledge and in the case of a hard-disk, safe, non-invasive software tools which will not destroy  the data in the process.
        
Our Data Recovery Service has the expertise to locate and identify the 'lost' data and make it accessible again. There is however, a major difference between our textbook analogy and the real world of the computer hard-disk. The terminology 'Recycle-Bin' used earlier is more than just casual jargon: Any area of the disk not in specific, identified use is available by the system for recycling and may be overwritten by new or transient data. A file not specifically identified as required will therefor be susceptible to recycling. Every time you use the computer and the disk is written to , the chances of recovering an entire lost-file diminishes, although as Forensic Analysis described below suggests, there will invariably be fragments of the data recoverable. If data loss is suspected, it is essential that you stop using the computer immediately. Do not shut down the operating system in the usual way but switch-off the power and do not turn it on again. Do not attempt to recover the data yourself; remember that every task you perform may obliterate the very data your are trying to find, and anything you try to do yourself will only exacerbate the situation. We use special techniques to scan and read the disk which bypass normal system operations.
        
A procedure closely related to Data Recovery and often confused with it is Investigative Forensic Analysis. The definition of Computer Forensics  is
'The employment of a set of predefined procedures to thoroughly examine a computer system using software and tools to extract and preserve evidence of criminal activity.' This procedure goes far beyond the methods used in normal data recovery and follows strict legal and ethical guidelines to ensure impartiality and validity in any subsequent legal action. While not all investigations are a consequence of breeches of the law, they may be a consequence of suspicions that an employee is misappropriating information or using the computer system for questionable interests.
Forensic Analysis provides an opportunity to examine the computer history even where attempts have been made to intentionally obscure the data. The investigation includes all areas of the system storage areas and makes no assumptions about the data content.
It examines everything in a verifiable, reproducible procedure using a traceable, validated image of the original disk. Clearly, this is time consuming and painstaking and requires adherence to very strict procedural practices. However, where the integrity or security of an organisation may be compromised, this course of action may be the most appropriate route to take.
        
We are bound by a strict code of ethics and you may assured that any data recovered will be treated with the utmost discretion and in the strictest of confidence.