Data recovery seeks usable files. Forensic preservation protects the source and handling record. A repair utility, rebuild command, or repeated power cycle may improve access while changing metadata or exhausting a failing component. GDF begins with the required data, source condition, prior handling and intended use, and documents the recovery and preservation work.
Preserve Failed Storage Before Recovery Attempts
Intake records the last good state, errors, unusual sounds or heat, physical exposure, power events, prior attempts, encryption, backups, and priority data. Leave a failed device powered off until triage, since repeated starts can worsen damage, consume degraded flash, trigger repair, or rebuild an array against the wrong member.
Triage separates likely logical corruption from physical or firmware failure. The recommendation may be protected imaging, specialist evaluation, another source, or no further handling until authority is clear.
Tell Us What Happened to the Media
Describe the device, what failed and which files matter most. We will assess the source and the options on a free call.
Scope Recoverable Sources and Their Evidentiary Weight
When later review may matter, handling starts before reconstruction. The record identifies the device, condition, supplier, receipt date, and authority. Custody transfers and material changes include carrier and specialist handoffs.
Where feasible, recovery uses a sector image or controlled clone. Read errors, retries, skipped regions, resets, and settings remain recorded. Hashes identify completed images and copies, and unreadable sectors are recorded separately. Reconstruction uses a working copy rather than the best acquisition.
The work includes identification, condition, authority, and custody records; imaging settings, read error maps, retries, and exceptions; separation of preserved acquisitions from working copies; and client instructions for return, retention, transfer, or destruction.
Hard Drive, SSD, RAID, and Server Failure Patterns
Sources include hard drives, SSD and NVMe media, USB devices, memory cards, virtual disks, server volumes, and RAID members. Drives can deteriorate during a read. Flash may remap blocks or remove deleted content through trim. RAID recovery depends on member order, geometry, parity, and disk condition.
A deleted name, fragment, thumbnail, journal entry, or prior version is reported for what it is, distinct from an intact file. Results identify each item's source and condition.
Clean Room and Specialist Vendor Boundaries
Platter work, head replacement, micro soldering, chip level access, and proprietary firmware tools require a qualified specialist. GDF identifies the provider, purpose, expected changes, cost authority, custody method, confidentiality terms, and stop point before transfer. The specialist decides whether its physical procedure is feasible and documents the work performed.
Returned images, parts disposition, notes, errors, and custody records are reconciled before logical reconstruction continues.
Encryption, Cloud Copies, and Backup Alternatives
BitLocker, FileVault, hardware encryption, encrypted containers, and application keys are opened with their keys, beyond readable sectors. Recovery keys, escrow records, identity accounts, trusted devices, and key management services should be checked before expensive physical work. Credentials and keys travel through an approved secure channel.
A better copy may exist in backups, snapshots, cloud version history, email, collaboration platforms, mobile devices, database exports, server replicas, tape, or another synchronized endpoint. Those copies have different metadata and retention limits. GDF compares provenance, timestamps, completeness, versions, and hashes where available, then identifies the source of each delivered item.
The scope covers local, cloud, snapshot, and backup comparison; encryption and recovery key dependencies; version, timestamp, provenance, and duplicate reconciliation; and targeted priority file collection when full recovery is impractical.
Tell us what keys, backups and cloud copies are available.
Scope and Recovery Priorities
Scope states what is needed, by when, and for what use. Continuity may prioritize a database; a legal matter may require a preserved image; a security event may put logs first. The plan names priority data, dates, applications, output, deadline, restrictions, and access to the original.
A limited assessment can precede broader authority. Accessible material outside scope is not reviewed. Client instructions for privilege, confidentiality, personal information, and protective orders govern the plan.
A Documented Recovery Process
Work moves through intake and authority, condition assessment, stabilization or acquisition, logical reconstruction, and validation with delivery. The order changes for safety, active business impact, degradation, encryption, or a fixed deadline.
We start by confirming authority, priorities, prior handling and preservation needs, then choose a no power, logical, imaging, vendor or alternate source path. We acquire the best available source with the method recorded, and finally reconstruct, validate, reconcile exceptions and package the results.
Deliverables That Show What Was Recovered
Deliverables may include the condition and custody record, acquisition identifier, hashes, error summary, source inventory, recovered files, folder structure, version table, exception list, and method summary. A legal or expert assignment may also require a retained image and fuller report.
Results distinguish readable files from partial, corrupt, carved, reconstructed, encrypted, or metadata only items. Validation may include file opening, application checks, archive tests, database consistency, or comparison with an independent copy. Sensitive data is delivered through an agreed secure method.
To agree on the recovery deliverable before work begins, call (212) 561-5860.
Honest Expectations Before Work Begins
Outcome depends on physical condition, prior power cycles, overwrite, trim, encryption, missing keys, controller behavior, array state, damage, and prior handling. Each file is validated beyond the directory listing, including files that open, since corruption can sit inside them.
GDF reports actual results and known gaps. Timing depends on stability, capacity, retries, replacement parts, vendor queues, encryption access, and data volume. Estimates state their assumptions and approval points.
Data Recovery Questions
Should the device be powered on? Leave it off until triage. If safe, disconnect it and leave repair prompts, formatting, rebuilds, and scans to the examiner. Live systems require administrator or vendor coordination.
Can deleted files be recovered? Often, and later writes, trim, file system behavior, encryption and surviving replicas decide how much. A name or fragment can survive after the full content is gone, and we report each item for what it is.
Will recovery alter the original? Some procedures cause change. GDF documents condition, uses a protected acquisition where feasible, and identifies unavoidable changes or logical only access.
Can a cloud copy or backup replace the failed device? It may satisfy the business need but answer a different technical question. Provenance and required use are compared before substitution.
What belongs on the first call? The source, symptoms, last good state, prior attempts, encryption, backups, priority data, deadline, and authorized contact.