Historically the Christmas and New Year period sees demand for data recovery skyrocket. Digital devices mixed with holiday celebrations usually result in thousands of instances of accidentally deleted data. As always, the biggest mistake you can make is to use the wrong tool for your task at hand. Lately, it seems there is new data recovery software being released on an almost daily basis. Sometimes free, sometimes paid, they promise to successfully retrieve your deleted data.
One thing that is almost never mentioned is that in order to do its job, this software must be installed on the very device you are trying to recover data from. Also in the majority of cases we see each week, this software almost always requires you to update your phone to the latest operating system in order to ensure its compatibility with your device. This is absolutely the worst thing you can do! These acts, unfortunately, overwrite in many cases the very data you are trying to retrieve. This is the single biggest unavoidable shortcoming when using any form of data recovery software.
IF YOUR DATA IS PRECIOUS OR VALUABLE TO YOU IN ANY WAY, PLEASE DO NOT USE SOFTWARE TO RECOVER YOUR DATA. ALSO, BE WARY OF ANY DATA RECOVERY BUSINESS WHICH USES SOFTWARE TO RECOVER YOUR DATA. THIS ONLY SERVES TO DEMONSTRATE A LACK OF UNDERSTANDING OF THE DIGITAL FORENSIC RECOVERY PROCESS.
At NSI, the leading digital forensic data recovery firm, we use PROPRIETARY HARDWARE to perform our forensic data recovery investigations. This is the same hardware that Government and law enforcement agencies worldwide use for their digital forensic Hard Drive Data Recovery investigations. This equipment does not install anything whatsoever on your device. The data flow is a one way connection that extracts the raw binary data from your device, leaving it intact and ready for analysis.
NSI digital forensic investigations follow a forensically sound five-stage process:
Stage 1 involves the triage of the device. We also identify the purpose of the digital forensic investigation and the tools that are going to be utilised. We take on both private and legal matters and have legally qualified examiners that can present evidence in court.
Stage 2 is the collection of the data from the device. This involves the device being connected to our proprietary hardware in our forensic lab and a digital forensic technician beginning an extraction of the device.
Stage 3 is the analysis phase of the forensic process. The technician processes the raw binary data that has been extracted. Factors such as the way in which the device was used since the data was deleted, if there were any software updates or factory resets, and the amount of memory on the device, will determine the success of the recovery.
Stage 4 is the reporting phase of the investigation. Once data is recovered and analysed, we then create reports based on our clients requirements such as messages between a group of people at a particular time. If required, legally admissible reports can be prepared and examiners can present evidence in court.
Stage 5 is the completion phase. Our examiners prepare the device and reports for the client and go through the findings with them.
Phase 2, where required, involves painstaking analysis by a senior forensic examiner who may need to reassemble the fragmented data manually to reproduce your deleted files. This process demands an extremely detailed, methodical approach in order to locate the scattered remnants of the original file.
To put this level of effort in perspective, imagine you are asked to assemble a 10,000 piece jigsaw puzzle where you have each piece hidden in different areas throughout your neighbourhood without the original picture to guide you. This is indicative of the level at which the data can be scattered in the binary memory of your device.
Do not take the risk of overwriting your valuable data with inferior data recovery software. And please don’t entrust your valuable data to a company that relies on it either.