Recovery from drives with logical problems

This includes formatted hard drives, drives with lost or deleted partitions and lost data due to virus infection. First an aventile copy is made, sector by sector of the drive from which the data is extracted ( it is never operated directly on the client drive ). Then the MTF table is scan and analyzed, every partition is searched for and the drive for data recovery is scanned. If the MTF table is damaged, a scaning by signature is done and the recovered data will not have the original names and structure. After the scanning data is copied on a server. This procedure is applied every time when an image procedure is finished.

Drives with bad sectors
If the drive is recognized by the BIOS it is plugged on a hardware imager. Depending on the number of bad sections an algorithm for reading the drive is made. First the drive is read from the beginning to the end, and then with a lower speed is read backwards from the end to the beginning. If there are more unread bad sectors the reading for the rest of the sectors continues with ECC turned off or multiple reading of the same sectors with variable voltage of the read heads. The algorithm is changed according to the condition of the drive.

Drive not recognized in BIOS

In this case we first check the PCB, firmware, ROM or NV–RAM of the hard drive. The PCB is checked and if there are problems they are eliminated. Otherwise the firmware reading is done and if the firmware written on the platter is read it is being repaired. If the firmware cannot be read then the read/write heads or the platters are physicaly damages. In the first case a suitable compatible donor hard drive is searched and the read/write heads are changed. In the second case when the platters are scratched there is no option of data recovery.                                                    

RAID arrays и NAS devices
This is a specific process. All the above-mentioned methods are used in order to create an authentic copy of all the drives in the array. Then an analysis of the drives with HEX editor is done determining the drives layout, strip size, offset. When the needed data is found the RAID array and the file system are reconstructed. Some of the fabric NAS devices have Linux partition on the beginning of every drive, some devices of upper class have their own proprietary file system for which there are not enough information.

Destroing data and drives
Even when the drive is formatted and the files deleted, they still exist and can be recovered. If you have valuable data that need to be destroyed , we offer you that service. Permanent data erase ( sanitization ) is done by DoD5220.22M and NIST 800-88 standards. When the process of destroying is finished a certificate is issued. There is no other option of data recovering when erased with this method. The drive can be normally used in the future. For greater confidentiality we come to you in order to collect the drives.