Recovery with the evidence in view.
When recovered data may be used in a matter, the way it is acquired matters too. Metadata, timestamps, the original media, and the record of the recovery all need attention.
We preserve original media, work from forensic images where possible, and document the steps used. Our work has included damaged media, devices recovered from water, and equipment kept in commercial storage for years.
Modern and legacy sources.
Commercial and enterprise storage
SSDs, NVMe devices, mechanical drives, RAID arrays, SAN and NAS systems, external drives, memory cards, and USB media.
Mobile and embedded devices
iOS and Android phones and tablets, plus embedded flash storage in vehicles, connected devices, and specialized hardware.
Legacy systems
Tape backups, older mainframe media, legacy financial-record systems, and partially functional or physically damaged storage.
Assess what remains available.
The recovery scope depends on the media's condition, subsequent use, and the records that remain. We assess those conditions and document the available result and its limitations rather than assuming deleted or damaged material can always be recovered.
Recovered records can be examined further or prepared for attorney review, with the recovery history retained as part of the evidence record.
Scoping the engagement.
Describe the media or system, the failure or deletion if known, and the records sought. Include the evidentiary context and any recovery attempts already made.