Data Recovery and Forensics

Data Recovery Services

Data recovery is the process of salvaging and retrieving data from damaged, failed, corrupted, or inaccessible storage media. Data recovery should only be attempted by experts who have experience and training in handling media, clean environments, and understand storage media principles.

Cybersecurity Defense Solutions is one of those experts.

Many times we have seen data recovery jobs that have gone to local computer shops or ‘big box’ chain stores and the wrong process or technique was used and has made it more difficult to recover the data…if it is possible at all!

From common software-correctable hard drive errors including S.M.A.R.T. errors, MFT corruption and boot sector corruption to the most severe physical hard drive issues such as head crashes, electrical and motor failures, our talented and experienced staff of data recovery engineers have the expertise and experience to recover data from all types of issues and media.

Our experts have experience in retrieving data from every form of storage media and all types of damage including:


  • Floppy Media (8″, 5.25″, 3.5″
  • Bubble Memory
  • Legacy Hard Drives (MFM/RLL, PATA, IDE, SCSI)
  • Current Hard Drives (SATA, SAS, mSata)
  • Solid State Media (SSD, Smartphones, iPhones, iPads, SD Cards, USB Thumb Drives, Flash media)
  • Optical Media (CD, DVD, Blu-ray)
  • Magnetic Tape Media


  • Head Crash
  • Fire Damage
  • Water Damage
  • Physical Damage
  • Software errors

CDS data recovery staff is experienced in recovering data from hard drives from all manufacturers and from any interface imaginable. From the legacy drives of the early 1970s to the most cutting edge solid state storage devices, CDS has the ability, the motivation and the talent to get the job done.

From common software-correctable hard drive errors including but not limited to SMART errors, MFT corruption and Boot Sector corruption to the most severe physical hard drive issues such as head crashes, electrical or electronic failures and motor failures, our talented and experienced staff of data recovery engineers will go the extra mile to retrieve your data whenever possible.

Data Forensic Services

forensicsThe term forensics is defined by the US Computer Emergency Response Team or ‘CERT’ as “the process of using scientific knowledge for collecting, analyzing, and presenting evidence to the courts.”

Although data recovery techniques are sometimes used in computer forensics cases the two disciplines are uniquely different. Being qualified as a data recovery technician or engineer does not necessarily mean the individual is qualified to perform Computer Forensics. 

CERT defines computer forensics in the following way; “the discipline that combines elements of law and computer science to collect and analyze data from computer systems, networks, wireless communications, and storage devices in a way that is admissible as evidence in a court of law.”

In regards to cybersecurity, all employees should have a basic understanding of some fundamental computer forensic principles. Work computers, phones, and tablets are all subject to investigation (discovery) at some point which requires the use of computer forensic techniques. Some examples of where Computer Forensic techniques would used include:

  • Data breaches (nation state or black hacking)
  • Intellectual Property (IP) theft
  • Internal company procedure investigations
  • Lawsuits
  • Divorce cases

There are a few differences between the data recovery and computer forensics processes. These include the added steps that an engineer must take to preserve both the integrity of the data and the original computer evidence (media) from alteration during the recovery process.  Evidentiary rules and Chain of Custody are two practices that data recovery technicians who do not understand the process are likely to overlook.

In addition,  since a data recovery engineer is only trying to retrieve the data and will not have to testify in court,  it is not necessary that the engineer explain or deeply understand how the tools used work internally or the processes used to recover the data, but with foresic investigations, these are paramount. In a data recovery only situation,  the customer only cares if they get their lost data back…”the how” behind the recovery does not necessarily matter to them. In a forensics clone or recovery,  “the how” is just as important as the data.

It is imperative to that companies needing a true forensic colletion look to hire a company that understands and is able to apply the principles of both disciplines. Be leary of companies that boast the use ‘proprietary’ or ‘one-of-a-kind’ technology. Most attorneys and most courts are not technically ‘savvy’,  and as such there are accepted processes, tools, and procedures that are recognized as forensically acceptable and save time and money when used.

Cybersecurity Defense Solutions has forensic engineers available to perform any needed forensic data service. Please contact us for details.