The Real-World Challenges of Data Recovery

Data recovery is a deeply complex technical discipline requiring expert knowledge and skills.

Data recovery has evolved rapidly in recent years, due in large part of the proliferation of digital devices types on which information can be stored.  Gone are the days when data recovery was focused on computers, hard drives, and servers; there are now hundreds of devices rich in electronically stored information (ESI).  And much of this technology is mobile, meaning it is prone to damage, loss, and theft.

What is data recovery?

Data recovery is the endeavour of extracting data from a data storage medium or electronic devices, where either due to damage, deletion, age, corruption, lack of hardware available to access data, conventional means cannot be used.  Data recovery is a deeply complex specialist skill, requiring a vast range of knowledge and problem-solving skills to successfully retrieve data which would otherwise be lost or unrecoverable.

Damage is either physical or logical; in the case of the former, the device, access hardware or storage medium may be structurally compromised.  If data cannot be accessed due to logical damage, this means that physically all is fine, but at the data level (i.e. the ones and zeros stored on the device in question), the challenge may be one of corruption, deletion, or formatting of data.

Data forensic teams are typically deployed to two broad types of urgent need; eDiscovery and cyber security breach.

The ever-expanding challenge of ESI recovery

If digital devices which are material to a legal case are damaged, whether due to fire, impact, water damage, or data corruption, or if data simply cannot be recovered by conventional means due to corruption, data forensic specialists have the means to ensure the necessary ESI is restored in a legally defensible way.

Coping with the old and the new

The challenge for data recovery specialists is not just new technology, it may include old devices such as floppy discs, zip drives, mainframes, tape, and legacy computers and mobile phones.  The challenge of legacy technology is that there is a risk that it either no longer works, there are no parts available to exact a repair, there is a lack of knowledge on how to use the technology, or simply there is no hardware available on which to load the storage medium.

And in the modern world, it is not just physical devices we are concerned with; data recovery is now required for information stored in virtual infrastructures, including:

• Cloud-based storage and application platforms
• Virtual servers, client desktops, and file systems (e.g. VMWare and Microsoft Hyper-V)
• Website hosting

In such projects, the task is made more complex due to not having direct access to the physical storage medium; nevertheless, technology and techniques allow disparate and physically remote data of this nature to be recovered.

Crypto-currency

If having access to a crypto-currency account, such as Bitcoin or Ethereum, is material to a legal case – perhaps if there is a suspicion of money laundering or tax fraud – investigators may require access to crypto-current wallets to view activity.  As these ‘wallets’ are encrypted, specialist skills are required to gain access, whether in the case of deletion, or lack of access information.

Standards and formats

It is not simply enough to recover the binary data which has been lost or damaged.  Data recovery specialists must also be able to apply the necessary protocols and file format standards to make sense of it.  In addition, there are many hardware standards which must be comprehended, including media attachment types (e.g. PATA, IDE, EIDE, SCSI, Fibre, Firewire).  And again, these may be legacy standards which were conceived in the 1960’s, or the very latest available technology.

Big data

While only estimates, it is believed humans create approximately 2.5 quintillion (2,500,000,000,000,000,000) bytes of data each day; a number which is driven in part due to the growth of the ‘internet of things’.  With so much data now being stored, there is a corresponding impact when this information needs to be recovered.  This means that, depending on the exact location and method of storage, recovering data can take a considerable amount of time.  This is mitigated, however, to a large extent by the processing speed of modern multi-core computers and high-speed internet connectivity.

In summary

There is no doubt that technology has transformed our world, enabling entirely new ways of working, living, and communicating.  For many, it is normal to have our entire world in the cloud, including photographs, videos, intellectual property, documents, and health information.  But this comes at a cost, because with an increasing dependency on the internet, digital devices, and computers, the greater the impact of any loss of access, information and data.  And in the context of litigation and cyber security, the loss of any data could make the difference between winning or losing a case, or succeeding in resumption of full business operations quickly, or being unable to continue in business.  In such cases, it is the quality and speed of data recovery that will make that difference.

To find out more on data recovery, please contact our team on +44 (0)20 7940 4799 or email info@linealservices.com.

Digital forensics has been a core offering since Lineal began. We are industry leaders in recovering digital evidence in a forensically defensible manner. Our teams are available 24/7 for domestic and international incident response. We continually invest in technical infrastructure and forensic software giving our clients the confidence their project is being managed with the latest equipment and technology.