Forensic Hard Drive Data Recovery

For Police & Law Enforcement

Data Clinic Ltd specialise in data recovery from unresponsive, damaged and broken hard disk drives. Most Digital Forensics teams have the capability to perform software-based imaging and software-based data recovery on media devices; however, if the hard drive is physically damaged, broken or unresponsive, it is unlikely that they will be able to recover the evidence required, leading to the device being unnecessarily discounted from an investigation.

Data Clinic Ltd have been providing advanced hardware and software data recovery services from hard drives since 2002 and consequently have a vast range of knowledge, expertise and available technologies that are not in the public domain. We provide forensic hard drive data recovery and repair services for police forces, government departments, regulatory agencies and other customers requiring evidential data.

Data Clinic not only provide the highest level of forensic data recovery for Digital Forensic Investigators, but also fully support forensic investigators through excellent customer service:

• Provide a single point of contact for Digital Forensic Investigators.
• Provide a Emergency service for serious or time critical investigations, with 24/7 availability to initiate and manage mobile phone repair or HDD data recovery
• Maintain exhibit continuity.
• Provide a Streamlined Forensic Report.
• Make comprehensive contemporaneous notes of the work conducted with photographic evidence.
• Provide regular progress updates.
• Develop and provide tailored processes to suit the individual requirements of the client.
• Conduct research and development to retrieve data from new technologies and formalise procedures.
• Provide security cleared courier service.
• Provide CPD presentations to forensic investigators to ensure that they fully understand data recovery capabilities and ensure correct handling of devices.

Hard Drive and Repair and Cloning

Imaging Drives with Media Degradation

The most common type of case that we work on involves hard drive media degradation, and because obtaining the best possible image of a drive is critical for evidence retrieval, this has become an area in which we provide unparalleled results. We have a vast array of imaging equipment which serves the majority of cases that we deal with, however, if necessary, we have the capability to ‘custom build’ a technique that ensures that the best possible clone is attained. If a sector or track is badly degraded then it is not necessarily lost, and we are able to manipulate firmware, replace heads, create custom imaging configurations such as head mapping and in some cases even increase head temperature to read previously damaged or unreadable sectors.

Interface Conversion and Bypass

Many modern hard drives have USB interfaces that are directly attached to their PCB (Printed Circuit Board); whilst this is great for consumers, it is unhelpful for data recovery, imaging and firmware manipulation. We have vast experience in using conversion boards for these models and are able to tap into a hard drive’s SATA data channels before the USB conversion is completed, therefore allowing us to manipulate the service area, clone the drive efficiently and bypass any potential interface issue.

Firmware Reprogramming

Modern hard drives are equipped with complex service areas that contain hundreds and in some cases thousands, of firmware modules dedicated to controlling all aspects of a hard drive. These modules range from simple SMART modules that report operational parameters, to complex, critical modules such as P and G-Lists, translators and control areas. Sometimes these modules become corrupted, damaged or can overflow with unreadable sectors, causing a variety of issues which may prevent user data access. Our expertise, equipment and skills facilitate communication with these non-user accessible service areas and allow us to diagnose, repair and in some cases replace damaged modules to regain access to allow imaging. These procedures include:

• ATA password unlocking
• WD composite module read and module re-location
• Removal of WD SED lock
• WD Slow responding fixes
• Seagate Rosewood Media Cache repair
• Advanced Seagate translator diagnosis, repair and rebuild
• Bypass Seagate ROM locks
• Full read/writing for almost all models
• Defect list diagnosis, reading, writing and repair
• WD kernel access

Stereomicroscope Cleaning

We use ultra-high magnification stereo microscopes and acetone medical grade cleaning swabs to remove particles from hard drive heads. Sometimes hard drives with the classic symptoms of head failure (the familiar ‘click, click, click’ noise when the drive is powered on) are actually heavily contaminated with particle debris that can be removed through this process.

Encryption Bypass

Many popular external hard drives and NAS (Network Attached Storage) solutions sold by Western Digital are hardware encrypted, including the USB attached hard drives that have been converted to SATA as mentioned above. Our imagining equipment is able to read the encryption modules and then decrypt sectors to bypass such encryption and produce an image for forensic analysis.

Working with the Head Stack Assembly

Imaging a hard drive relies on the read/write heads being functional, if these have become defective through misuse or degradation then the forensic examiner or recovery technician has no option but to replace the head stack assembly. This is a complex task and relies on sourcing the correct compatible parts, the experience of the technician, and in some cases the manipulation of the hard drive’s ROM and Service Area modules to complete successfully.