What is “forensic” data recovery?
Occasionally we hear from potential customers that another data recovery company has told them that to get their data back their storage device (typically a hard disk drive) will require specialist ‘forensic data recovery techniques’. Which, needless to say, have a higher price than the standard data recovery service.
So what is ‘forensic’ work; let’s start with Wikipedia for help:
Forensic science (often shortened to forensics) is the application of a broad spectrum of sciences and technologies to investigate and establish facts of interest in relation to criminal or civil law. The word forensic comes from the Latin forēnsis, meaning “of or before the forum.” In Roman times, a criminal charge meant presenting the case before a group of public individuals in the forum. Both the person accused of the crime and the accuser would give speeches based on their sides of the story. The individual with the best argument and delivery would determine the outcome of the case. This origin is the source of the two modern usages of the word forensic – as a form of legal evidence and as a category of public presentation.
In modern use, the term “forensics” in the place of “forensic science” can be considered correct as the term “forensic” is effectively a synonym for “legal” or “related to courts”. However, the term is now so closely associated with the scientific field that many dictionaries include the meaning that equates the word “forensics” with “forensic science”.
So in short, the word ‘forensic’ is really just used when attributing any work that relates to legal work.
There are plenty of forensic data recovery companies out there. They tend to be doing work on behalf of solicitors, the police or individuals that require data back which relates to some sort of legal investigation, whether it be civil or criminal. From the discussion that we have had with members of staff at forensic recovery companies we know that in general the storage devices they receive through tend to be working OK, but they can spend a great deal of time dealing with corrupted file systems and finding deleted data. The main aim of a forensic recovery is to build up a set of reliable evidence that can be presented in any legal case. Often specialist software is used, like Encase or FTK, to compile such evidence. Forensic data recovery is very time-consuming work and has its own set of challenges and having a good knowledge of filesystems is essential. However, it is very different to dealing with failed storage devices and recovering data in a more commercial sense.
We even receive some work in from Foresnic Data Recovery companies which do not have the facilities to deal with serious hard disk failures. We get the hard disk functioning again and create good clone of the failed disk, and let them get on with the ‘forensic’ side of the investigation of what is on the hard disk drive.
So the rule of the story is, if a data recovery company is saying that you require specialist forensic recovery techniques, and you are not intending to use the data for some sort of legal dispute, then probably think twice about letting them charge you more.They are just trying to make it sound like you are on CSI murder investigation; you’re not and you probably just want your business data or family photographs back.