Data analysis and recovery
Our business security related services include also computer forensics and data recovery. The most typical cases of their use are the following:
- data thefts by dismissed and/or disloyal employees,
- industrial espionage,
- disappearances of persons and escapes of adolescents,
- investigating suicide motives,
- lose of data of significant economical or sentimental value,
- IT network break-ins,
- breaches of copyright and patent rights,
- blackmail and stalking by use of information and communication technologies.
This is a service intended to obtain and secure digital evidence of criminal or otherwise unlawful activities. It is characterized by generally good results, because many everyday activities are done with modern devices like computers and mobile phones, while a technology they utilize to store information allows to recreate and secure almost every action of their users.
Should a digital footprint be used as evidence in legal procedures, it needs to be obtained and secured in an appropriate way. Our customers can either hire us to secure the digital footprints or try to do it unassisted with respect to, among of others, the following rules:
- a disk drive or another media should be retrieved from a containing device (e.g. computer) in presence of a third person, who would attest the media's identity with his/her legible signature under a protocol drawn up for this occasion;
- the media should be secured from unauthorized access and dismantlement by seals sticked to its casing or packaging; as regards hard drives, it is usually sufficient to secure connectors and mounting screws in such a way that a removal of disk's electronics or plates would leave permanent signs; the media may be additionally sealed in a secure envelope, whose number should be included in the abovementioned protocol;
- the media retrieval protocol must contain at least: date and time of the retrieval, personal data of a person who dismounted the media as well as personal data of witnesses, brand, model and serial number of the media and number of abovementioned seals and secure envelope;
- a copy of the signed protocol and the secured media itself should be send to us; an additional declaration that this particular media is owned by the customer must be attached.
Data analysis procedures start from the original media be locked as write-protected and cloned to a working drive. The actual analysis is done using the latter and accordingly to the customer's request. When finished, a detailed report, containing description of results and procedures of the analysis, is drawned up. An additional copy of data retrieved by the analysis is made and attached to the report.
Pricing of this service depends on complicacy and workload of a given case, so it is always agreed individually.
Data recovery is often a part of computer forensics, but may be also a standalone service in cases where there is either no need to secure digital footprints or the data loss was accidental. To maximize chances of a successful recovery, users should obey some important rules, particularily the following:
- after damages or loss of data have been observed, no tries of unassisted recovery should be undertaken; if such tries happened nonetheless, we need to be informed about this fact before any data recovery agreement is signed;
- if a drive or a whole device was damaged by flooding, it must be disconnected from its power supply as soon as possible - in case of a mobile device it should be done by removing its battery; the drive or device must not be reconnected to the power supply after having dried up;
- in case of other data and hardware damaging factors (e.g. falling from altitude, exposure to high temperatures or strong magnetic field), we need a detailed description of circumstances in which damages occured.
Independently of what data recovery services can offer, we recommend to make regular backup copies of data. An experienced specialist supplied with not only a damaged media, but also with an archival copy of lost data, would attempt to use the latter to quicken and reduce costs of the recovery operation.