Setting up digital forensics hardware servers

Forensic server hardware must be capable of storing huge data amounts that it then process for the forensic analysts. Hard drives of multiple terabytes are common and therefore a forensic server ‘farm’ must be capable of processing massive multi terabyte volumes of data and also be able to process it all in memory. This is best achieved by using a SAN (Storage Area Network) that is expandable to match forensic case and analyst needs. It’s possible that this could use a cloud computing infrastructure, but of course this relies on decent (fibre) internet connection which huge upload and download speeds. Here’s a checklist of considerations when setting up digital forensic servers.

  • Service continuity – what’s the up / down time?
  • Employees – are they security cleared?
  • Logistics – how is a digital forensics investigation undertaken with this setup?
  • Security – how secure is this setup? Schedule some penetration testing?
  • Location – where the data is stored dictates what laws apply to it.
  • Compliance – with ISO17025, you will need to demonstrate and prove compliance to it.

 

Data Recovery Services London

Data Clinic London, located at 68 Lombard Street, London EC3V 9LJ are the city’s premier data recovery company. Here are some of the recent hard drive data recovery enquiries they’ve received. To get to Data Clinic London follow the map below:

Map above: Data Clinic Ltd, 68 Lombard Street, London EC3V 9LJ

Seagate External HDD – part of a striped raid set – started making clicking/beeping noise, files on it took longer and longer to load, until the drive entirely stopped being able to be accessed when plugged in. I’m looking to use a good data recovery service in London. I am almost certain it’s misaligned actuator/drive heads – it still lights up when plugged in, still makes noises as if moving, and nothing on it was corrupted when it was working, so it’s definitely a hardware issue. Any idea how much it would cost to either replace/realign the parts so the drive works again, or failing that, recover the data directly from the platter?

Toshiba 1TB external drive. The external hard drive stopped working maybe 1 or 2 years ago. I thought I lost it but then I just found it. Tried to plug the USB into my laptop and I am prompted to format the drive before I can use it. I do not want to format the drive – I would like to recover all the photos in there if possible. There might other documents but I am really mostly interested in the images.

At my work office in London I have a maxtor 3200 external hard drive which has stopped working, there is the occasional clicking coming from the drive and my PC is not recognising it. i need to recover photo’s music etc. can you help? Is this a data recovery service the clinic provide?

I have Toshiba HDD 750 GB which is not detecting. While connecting it via external casing, it give sound cracking noise.

The HDD that I believe has failed (or is about to) is a Western Digital Caviar Green – I originally got two of them in 2012, one failed about a year ago, and the other one is on its way out too, I should have taken that as a warning sign. I turned on my PC to find that windows were unable to read the drive and when I opened Disk Management the data format say’s it is “RAW” instead of “NTFS” which according to research indicates it’s on the verge of failure? I don’t want to format it back to NTFS as I don’t want to lose the data that’s on it.
I was wondering if this is something Data Clinic in London could recover the data and files from? I want the data recovering from my raid hard drives and writing to a server.
The drive is a mass archive that I’ve had for 3 years, and is, or was growing weekly, thus I don’t want to risk any damage being done by free software recovery tools. Since the discovery earlier, I have not tried to recover anything from the drive, and I have since unplugged the drive, hoping that this is something you may be able to see to?

Dropped External Hard-drive and the computer is not loading it anymore.
The hd makes a different noise when booting up.
Opened the hd case to check if the usb adapter was plugged in properly and the connector doesn’t seem damaged

I have 2 external hard drives, one being a maxtor and the other being a segate both having 1tb of data. The maxtor one is recognised by the computer as the computer makes a recognised noise when inserted but isnt shown in the “my computer” tab and makes scratching and beeping sounds with whirring sounds aswell. the segate one is recognised in my computer but when clicked on in it says “that the location is not available and is corrupted and unreadable.
I have university on mondays, Tuesdays and Wednesdays apart from that I am free, please reply when you are available.

Error saying boot device not found. Have spoken to HP, cannot reboot system without deleting data.

Unable to access external Seagate SATA harddrive. (USB 3.0 2tb Seagate Desktop Expansion Drive)
Drive in its case fell on the floor. Drive sounds as though it spins up. Drive letter displayed (eventually) in file explorer.
When selected, ring goes around for a long time and when eventually stopped the following error message is displayed (j:\ is not accessible The request could not be performed because of an I/O error).
Hard drive taken out of case and connected to computer using 3.0 USB external caddy. Same problem and error message.
Hard drive opened and read arm observed as being in the right place (parked). Closed and tried again with external caddy, still same error message (eventually).
Unable to access drive using Windows disk management tool(Windows + X)

Recovering data from Sandisk hard drives

SanDisk Ultra II (240gb) bought late in 2015 has stopped working. Desktop hard drive indicator stays on and the machine will not boot. Have tried connecting externally, with a working USB bridge to another computer – the device is not detected. I will be returning the device under warranty to SanDisk. Please can you contact me with some data recovery options?

My iPhone (5s) have had overloaded memory and stopped working. I could see only Apple icon all the time. So, there was a system update. And now I have photos only from iCloud (about 300). My 7000 photos disappeared. I tried to recover it using recovery programs with no result. I also called local repair services. Phone has no value for me right now. I can let someone take it to pieces but I must have these images. I had the images saved to a sandisk hard drive and wonder if you can extract the file from that?

Its a Sandisk ultra hdd that I’ve made into a portable drive.
When you plug the external hard drive in it doesnt show up on my computer but showes up on the bit where you can disconnect the hard drive, Also shows up on the disk management but says it is unallocated. I did a disk defragmentation on my computer but didnt realise my external hard drive was plugged it, That was the last time my hard drive actually worked but not sure if thats the reason its not working. Also when you plug it in the light doesnt come on anymore but does make noise to show its registered on the computer and makes the external hard drives makes a noise like its running. i spoke to sandisk about it but they dont seem willing to do the data recovery work.

Samsung ST1000LM024 data recovery

In this post we look at several data recovery enquiries we received about Samsung ST1000LM024 hard drives where the users couldn’t access their files anymore.

Samsung ST1000LM024I believe the problem is due to overheating.
I have have two external hdds that have failed. one ticks once plugged in. The other when plugged into my mac states that it is drawing to much power and the usb port is then turned off.

External hard drive fell off PC tower. The device now just clicks and does not read.
Its a Samsung ST1000LM024
One of our IT chaps has taken a look at it but cant fix it or access my files.
It holds family photographs only which we want to recover.

My western Digital my passport hard drive was dropped on the floor. It contains basic files such as spreadsheets, word documents and active inspire PowerPoints. However simple, they are quite important. The light comes on and a whirring sound is made when plugged in to the computer however the computer can not find the hard drive.
If you could estimate a quote for the repair that would be appreciated. I am a teacher so contacting me by email would be preferable.
I have been to PC world and they have told me they cannot repair the hard drive

HDD is exhibiting a steady beep when plugged in. Does not show up in “my computer”. Can you tell me your availability and rates? There is not access to the drive or the files it contains.

A teacher in desperate need of recovering all my hard work over the last 3 years off my hard drive. It fell last night and reconnected fine. Now I started my laptop up I’ve switched USB ports and even laptops but no luck! Its a Samsung ST1000LM024 hard drive and I am in Tadcaster, but occasionally visit Northampton – I know there is a data recovery centre there.

Phone Recovery

phoneMy thanks to the people at the UK’s http://phone-recovery.pen.io/ for the phone data recovery examples below.

Phone has died with no sign of life. Don’t care for the hardware part just need the data off the internal storage. android system is the operating system.

I want to see if I can recover some permanently deleted photos and videos from my iPhone 6s. It’s only files from the last month. The files are not on the cloud or currently on the handset.

Samsung s6 phone has fell in some water and no longer turns on.

My Nokia 7100 Supernova has been on charge for over 24 hours but is unresponsive. I would just like to be able to access all my text messages again.

I have an old Samsung Galaxy S3 that eventually bit the dust and wouldn’t boot up any more. Unfortunately I had all the photos stored on the internal memory and not backed up. I don’t need it fixed (I got a new phone anyway since this was long overdue) but I would like to recover the data off of it. Could you provide me with a quote/price estimate for recovering this data?

I have lost data from my s7 edge Samsung while copying over on 1st December 2107. Since then I tried using an online data recovery tool but no luck and then my factory phone was reset. Is it possible to recover data pre 1st Dec 2017 from my phone in particular my photos.

The screen of my xperia Z5 has recently been smashed and it does not respond to touch. The Android OS and softwares works fine but I just want to retrieve datas such as contacts, videos, photos and music from my device.

QNAP and Synology data recovery

I have one 3 tb hard drive in a Synology Diskstation mounted as a Synology Hybrid RAID that has failed, so I cannot retrieve any data on it via the Diskstation. (The other hard drive had failed some weeks ago so I had sent it back for a replacement). Could it be revived, and what would the rough cost be?

Drive has stopped powering up, I need to copy the files over to a new one – I’m in Chiswick.

Chiswick, London

QNAP HS210 in RAID 1, disk 2 failed (very noisy), purchased a new disk and replaced but it didn’t rebuild the array. Upon booting up with just disk 1 it fails to recover the array. QNAP support have stated there’s a hardware failure with disk 1 after running dmesg from ssh with only disk 1 inserted: JBD: Failed to read block at offset 3176

The data from the QNAP and Synology systems is backed up on a Porsche Design Lacie 2tb drive. Dropped on floor and no longer reads. Formatted for Mac. Device sometimes shows up on connected devices and sometimes reads files, but extremely slowly. Have tried data recovery software but does not work.

I have a hard drive that is no longer able to boot or when viewed as a secondary drive on another PC you are unable to initialize disk with the error message “Error initialize disk: the request could not be performed because of an i/o device error.” This was the Primary hard drive for the PC and held the OS, before it stopped booting the PC had become unusably slow but sounded normal, now I do not believe the disk is spinning. My worry is that taking it out of the PC was what killed it.

We are an architectural practice based in Chiswick and we would like to convert data from DDS-3 and DDS-4 discs into usb digital format. They would be a total mix of 12 tapes (still to confirm). Data can go back onto with RAID NAS device hard drive.

Dropped 2tb Toshiba hard drive looking for rough price to recover data and repair please

Seagate data recovery

This month we’ve had several Seagate hard drives in for file recovery operations – here are the details:

Seagate hard drive logoKeith, Luton
I have an old IDE hard drive from a friend who wants to get the data off (photographs in the main). The pins on the IDE connector are damaged so I’m looking for a donor drive to make the swap and get the data.
It’s a Seagate Barracuda 7200.8 300GB;
SN: 3NF11PHJ;
Model: ST3300831A
P/N: 9Y7284-029
Firmware: 4.40
Date Code: 06145 Site Code: AMK

Alison, Dunstable
I have a Seagate hard drive which stopped spinning up and is no longer recognised by the BIOS/Windows as a connected drive. After googling the problem, I suspect the PCB has died. I have ordered a replacement PCB for the drive, but it requires the ROM chip to be moved from the original board to the new board and I am probably not skilled enough for this work.
I was wondering if you would be able to undertake this work and how much it would cost. Also, in the scenario where this doesn’t work, I would like to know how much a full repair would be.
The hard drive is a Seagate Barracuda 2TB HDD, Model: ST2000DM001

Roger, Eastbourne
I have a Seagate expansion drive which won’t power up.
It spins and then makes a couple of clicks and then dies.
I’ve tried mounting it via a computer internally with the same results.
It has been accidentally dropped, therefore I suspect that the problem is hardware related…
I would like an idea of how much you would change to recover all recoverable files and transfer them to another hard drive which I am happy to provide?

If you have a hard drive problem and just need another hard drive simply contact your local LEA ICT centre, if you need the files from the drive then come to me as we’ll need to create a data recovery ticket for you.

Getting (deleted) data off of a phone

deleted text messagesI’ve recently introduced a legal type of data recovery service where the data I extract from phones can be used in UK legal cases. Quite often I’m asked to retrieve deleted text messages, chat, internet histories or videos that were once on the phone but aren’t any longer. Most of the time, especially if the files were recently deleted, getting them back from the phone’s memory is successful. This information can then be used to support or disprove a legal case. In the UK, this process of investigating the contents of mobile phones is known as mobile phone forensics and the experts at this are Data Clinic who have a page on their site about it here: https://www.dataclinic.co.uk/computer-data-forensics/. Some of the enquiries I’ve had lately regarding recovering deleted phone data and files are:

  • Iphone 5 apple logo flashes on and off. Cannot get phone to do anything else.Phone has not been backed up.
  • My iPhone 7 plus front camera stop working and the staff replace new phone in Apple store. I try to back up data to iCloud for my old phone but i do not know iCloud upload failed in store. My old phone click “erase all content and settings” and reset now as a “not active phone”. The old phone now at home and keep switch off from this issue happened. I just quick check if any chance i can get the photos back from the phone in this situation.
  • Iphone 6 stacked on apple logo since yesterday morning 09.03. I need to recover the photos and videos. I don’t need the phone repaired, just the data. Is it something you could help with please?
  • I have a Nexus 6P which is stuck in a bootloop. It turns on to the Google logo, displays it for about 10 seconds and then goes black and starts again. The only menu you can access is the bootloader menu. Starting the phone in Recovery mode has the same effect. There’s a large number of sentimental photos and videos on the phone, would you be able to retrieve them and if so could you give me a quote?
  • I’m trying to retrieve some WhatsApp messages which I deleted back in January. Accidentally returned to factory settings, and lost photos and videos

 

MacBook data recovery and broken phones

MacBook users beware! The way the OS X filesystem works is to restructure sectors as soon as data is deleted so that reconstituting the files from the data during a recovery attempt can not be achieved. So, if you do use Macs, please make sure you use Time Machine so that you’ve got a decent backup!! You can get a guide of using Time Machine from https://support.apple.com/en-gb/HT201250.

MacBook user

I have done recovery back up for my home computer onto external hard drive and now I lost all my files and documents that were on external hard drive. Is there any way I can get it back to way it was before?

SSD data recover on Macbook
My laptop hard disk crashed suddenly. It is an SSD 1 tb and I have a lot of valuable files on it. I wanted to know how much it generally costs to recover assuming it is possible?

Macbook air has water damage on SSD hard drive?
Can it be repaired and / or data recovered?

These following questions all relate to losing files on iPhones – the ICT’s don’t do data recovery on phones, instead we use a 3rd party contractor – go to http://phone-recovery.pen.io/.

Retrieve photos from iPhoto
I have a macbook pro 15inch, 10-11 years old. It froze once & after turning it off/on it failed turn back on or advance from the apple screen. I took it to an Apple shop who were able to have a look they wern’t able to access the harddrive. I think the laptop is probably beyond repair but I would like to retrieve the documents & photos on iphoto if possible.
If you are unable to access/retrieve anything would I be charged anything?
Anything else you need to know & if possible then I could courier the laptop with an external hard drive to place anything retrieved.

iPhone data recovery
I’m really hoping you can resolve my problem. My son dropped my husbands phone, the touch screen went u couldn’t press anything on the right side of the phone and there was grey lines. We are in Egypt at the moment. We got the screen fixed but then realized it says disabled connect to iTunes obviously the touch had played up by itself and entered the wrong passcode so many times. We have tried to resolve it from the software side, haven’t had much luck till now so I was hoping is there a way to remove the hard drive or wherever the data is stored into another phone? It’s an iPhone 6 Plus and we also have another iPhone 6 Plus.

I need to retrieve whatsapp and txt messages from my iPhone six. I didn’t have back on my iCloud.
Please let me know if it’s something you can help with.

Samsung
I have accidentally deleted all photos and videos from a Samsung tablet. Is this something you could help me with? I am in West Lothian.

Another year…

This will be my final post of the year and again, this year has been all about data recovery and failing hard drives. It seems that most of us aren’t backing up our data as often as we could. So if you are wondering what do to over Christmas, how about you put a backup schedule in place? You can start here: https://www.cloudberrylab.com/best-backup-schedule-for-small-business.aspx.

Following on from my last post about boot devices not being found, my hard drive stopped working was removed by Surrey CPR from a Macbook Pro after failing to boot my machine. The drive is no longer recognised by conventional methods. Surrey CPR who extracted some of the data on the drive, believe that the partition information on the drive has become corrupted but they cannot do anything else to help me. Obviously I have no data backup.
I need to boot the Macbook up from this hard drive to access certain application controlled data that uses the Macbook and drive’s signatures for security. A clone of the whole drive would probably also be an option. The drive does not require data recovery to other media. Also the drive has not suffered any damage due to dropping etc.

My Seagate external hard drive stopped working out of the blue, it’s a 1TB, but now on my recovery data software it says it’s 2TB, and it doesn’t let me scan it in any of the softwares I tried it on or even trial ones. It doesn’t recognise on my MacBook and it just asked me to initialise, ignore or eject. A bit hopeless at the moment just wondering what should I or could I do and how much would it be for your services to fix it? I never installed any backup regimen and I’m stuck – are there any solutions for it.

Finally, have a good Christmas everyone, and I’ll see you in 2018.