Forensic Phone Data Recovery – Legal Cases

Recovering the data from a mobile phone is often crucial in any type of legal case. Usually recovering this data is straightforward as the phone is working, but sometimes data may have been deliberately deleted or hidden, and other times the phone may have been deliberately smashed or broken in an attempt to stop anyone accessing the data on it.

We are frequently asked if it’s possible to recover information like text (SMS) messages and WhatsApp messages from phones where the messages have been deleted or lost. This is usually possible so long as the delete messages have not been overwritten. If the information is still on the phone we should be able to recover it regardless of the phone make and model.

forensic damaged phone data recovery (police and legal)A further complication comes if we are asked to recover information from a deliberately damaged or broken mobile phone. This presents the added complication that we first have to repair the phone before we can begin to locate the data to be recovered. Again, it should be possible, but it obviously depends on how damaged the phone is.

In this photo of a Samsung S9, the phone had been seized at a crime scene by the police who (unsurprisingly seeing the phone’s condition) had not be able to recover any data from it. The phone had been run over in a car and both sides were smashed. Fortunately the damaged phone came to us and we were able to successfully recover the data from it.

The most common types of data we are requested to recover from mobile and smartphones are

  • Text and WhatsApp messages
  • Diary dates and times
  • Location data
  • Photos and videos
  • Internet histories

Some further reading:
Phone data recovery – More about Data Clinic’s general phone data recovery
Forensic data recovery – Details of Data Clinic’s advanced and forensic data recovery capabilities
Forensic data investigation – Further information about forensic data recovery and how it all works legally

 

 

 

Read More

Retrieve data from backup tape – Leeds data recovery

Putting away information (‘data’) for a significant amount of time is a prerequisite for some organisations. Numerous individuals don’t understand that the data tape is as yet a noteworthy player in the capacity data storage, because of its cost, amount of information that can be put away and the timeframe that data can be put away for. eDiscovery is a large part of tape data recovery.

In contrast with HDDs, SSDs or even the Cloud, the data tape is far better when it comes than long haul chronicling. Be that as it may, in case you’re new to tape or need some more data on the utilisation of tape for capacity then the underneath data should help. On the off chance that your inquiry or circumstance still hasn’t been replied, at that point get in contact with a data recovery tape specialist.

With the end goal for you to work out whether the tape is a decent decision for your capacity needs, or on the off chance that you are uncertain about how Data Clinic might almost certainly help you retrieving data from tape, for ediscovery or other purposes, underneath are some famous situations and questions that we have looked throughout the years.

retrieving data from tape

I have various tapes containing chronicled information. I have to get to it, yet I can’t discover the equipment/reinforcement programming to reestablish them.

In the event that you end up in this position, at that point your first port of call is attempt and get a duplicate of the reinforcement programming by reaching a product seller or merchant on the web. In spite of the fact that by and large, you may wind up in the position where the product you need is never again sold. If so, at that point your most solid option is contact an information recuperation expert. Organisations like Data Clinic have explicit apparatuses and equipment that enable them to recoup information from tapes without the requirement for the old reinforcement programming.

I need a specific record that is put away on one of the tapes I have. How might I discover which tape holds this record?

Reliant on the product and tape library framework you are utilising, you might probably – as the tape library head – utilise a code order to find the particular document. To have the option to do this however, you should know the careful name of the record you are searching for. Regardless of whether you do know the precise name, there still might be an opportunity that you recover the wrong duplicate of the document, similarly as with any propelled reinforcement there are a few duplicates of a similar single record. To keep away from this, a straightforward arrangement is make a record and index of all the tape media. This would spare time and be financially savvy.

It would appear that the information on my tapes has been eradicated or erased coincidentally. Is there any way I can get it back?

This isn’t something that you will almost certainly do without anyone else’s input. Having the option to recuperate any kind of information, from a media should just be finished by an expert information recuperation master. Numerous recuperations that are done in the hands of somebody that doesn’t have a clue what they’re doing, can result in irreversible harm and much more information misfortune. Recouping from tape is a standout amongst the most developed sorts of information recuperation; exceptional devices, equipment and a lot of learning of the manner in which information is organised and spared are expected to play out a tape recuperation.


Map above: Data Clinic Leeds – hard drive and tape data recovery services on Gelderd Road

I have various tapes in various arrangements. How might I institutionalise them?

Relocating your tapes so they are all on one stage is a smart thought. Not on the grounds that the stages may not be sufficient, yet most of the stages once presented are a distant memory. On the off chance that the equipment for those tapes never again exists, issues can happen when information on those tapes should be gotten to. Having the option to get to the information on your tapes is fundamental, particularly on the off chance that they hold any touchy data. There are as yet various tape and reinforcement stockpiling framework designs accessible to the market. Picking the one that works for your organisation’s needs is the most ideal approach as there is no genuine ‘best sort.’ If you are contemplating moving the majority of your tape information to one combined stage, specialists like Data Clinic can help you preceding the procedure, and prompt you on any dangers related with the relocation.

I’ve endeavoured to get to the information on my organisation’s tapes yet they are stating they are clear!

On the off chance that you are encountering this issue, at that point your most logical option is contact an information recuperation expert like Data Clinic. Particular equipment can be utilised to sidestep the issue and recoup the information, yet this should just be finished by an expert.

The tape peruser I have is never again working. How might I get to the information I have chronicled?

Sadly, without the tape peruser, you have no chance to get of having the option to get to that information you have documented. On the off chance that you end up in this circumstance, clean your tape drive; they were built for hard core work and toughness, so with some karma, it might begin to work once more. On the off chance that this neglects to work, either investigate purchasing another or utilised drive of a similar brand and model or convey the gadget to a master like Data Clinic.

Read More

How we do a ‘Chip-Off’ Forensic Data Recovery on a Mobile Phone

Forensic data recovery and mobile phone investigation is the process of salvaging data from failed storage devices such as mobile phones or hard drives. We offer our services across a wide range of devices. Here we will look at our mobile phone side of the company, more specifically what is known as a chip-off operation. Chip off is a useful technique especially in forensic data recovery, also known as digital discovery, or eDiscovery: these are methods of data investigation used by police forces and insurance underwriters. Data Clinic Ltd are experts in recovering data from damaged phones and hard drives.

With any mobile phone or tablet, we initially attempt to inspect the phone, we determine if the failure is with the peripheral components such as batteries, charging ports and screens. If this is the case, then we wouldn’t need to go any further. For a lot of ediscovery data investigations cases however, this option serves as a process of elimination and if this first attempt of recovering the data is unsuccessful then we look at the more advanced options available to us. This is typically in the form of advanced micro soldering, JTAG or a Chip-Off operation.

So, what is a ‘Chip-Off’?

A Chip-off is the process of de-soldering the Flash Memory chip from the failed phone / tablet in the hope that we will successfully read its raw data independent of the device.

How do we do a Chip-Off recovery?

In order to complete a forensic data recovery on a mobile phone it’s first necessary to determine that a Chip-Off on a phone / tablet is needed then the next step is preparation. The phone must be fully dismantled, including the removal of any protective metal heat shields. When this is done we identify the eMMC (or NAND) memory chip place the PCB into a special holder underneath our stereo microscope as shown here.

What is now needed to remove any underfill from around the memory chip and add specialist flux to the chip. The Flux we typically use is Amtech Tacky Flux – the idea with this is to dispense it all around the chip then apply heat to it.

The main heat application we use is a Quick 861DA heat gun (image below). This is a station that offers a wide range of options when it comes to applying heat. We make sure to select a correct temperature, airflow and nozzle to do the job properly.

Once the chip has been lifted from the board after carefully applying the correct amount of heat we get the de-soldered chip, we then proceed to cleaning and re-balling the chip. This is a meticulous process whereby we need to ensure that each of the 100+ solder contacts have clean solder. It is a manual process that you need skill in precision soldering and a keen eye under the microscope to do.

Once each pin has been successfully and soldered in a uniform manner, it is time to clean it up with specialist chemical solutions. This ensures that the contacts are as clean as they can be and thus the read of the chip should also be good!

There are a lot of readers and programmers available worldwide that you can use to read the raw data of an eMMC NAND memory chip. The honest answer is they all have different capabilities for different chips. Its not a case of one is the best. Here are some samples of these available ‘boxes’. When it comes to data discovery and mobile phone investigation the phone data is fully dumped to a binary image file, we then analyse and decode the raw data. Once reconstructed we can send our customer a summary to let them know the recovery statistics as shown below.

This data can then easily be transferred to another storage device (typically a memory stick) and returned to the customer.

To Summarise

A chip-off is one of the procedures that really is a last resort. Chip-off cases are applicable when:

  • The logic board is too severely damaged to repair

  • ediscovery / digital discovery / forensic phone data recovery is required.
  • The lock on a phone if it is not known and there is no method of bypassing it via software

  • Corrosion cannot be decontaminated

  • For deleted data

The art of performing a chip-off is something that we pride ourselves on being able to achieve, we have recovered the data from many phones where this was the only option and are still carrying out these procedures today.

You can find Data Clinic at The Pavilions, Bridge Hall Lane, Bury, Greater Manchester BL9 7NX

Read More

Waltham Forest, Kensington, Hammersmith, Lombard Street Data Recovery London

london boroughs data recoveryMotorola Nexus 6 Recovery

I have a Motorola nexus 6 motherboard and hard drive (the rest is broken due to DIY repair attempt). Nexus phone is damaged. no display. not starting. The screen in phone has stopped working. I need to recover my photos.
Will you be able to recover the data directly from the hard drive? How much will you charge? Can you collect from Hammersmith London?

Recover Files from Toshiba X300 Hard Drive

Toshiba X300 4TB HDD. I need the connect pins PCB. I can send a photo or call in at your Lombard St London office with the damaged one tomorrow?

Waltham Forest Data Recovery

My elderly MacBook has become stuck in a bootloop, I’ve tried loading it up into recovery and safe modes but with no such luck. I was due to replace it so I am just looking for full data recover and am in the Waltham Forest area of London
Is this something you can do and what would be the charge?

WD My Passport Data Retrieval

My WD My Passport has accidentally been formatted. would it be possible to recover the data on it as there are image files I need on it? Also have you an idea of how much it would cost-general ball park figure. I’m in Barnet in London but can catch the underground into London and onto Bank tube station for data recovery.

SATA Files needed

I have a SATA 2.5 hard disk which was in my toshiba laptop when it was dropped. It then began to malfunction, an engineer has been out and replaced the hard drive and set up the laptop again but was unable to retrieve the files from the hard disk. I was wondering if you could give me a quote for how much this might cost? I’m located in Kensington

Seagate hard drive 1TB will not mount or be discovered on Mac or Windows machine. Powers up and sounds okay.

Samsung m3 portable hard drive. Registers on the computer as being plugged in but can’t be accessed. Can it be fixed in London?

Formatted and overwritten SSD after everything saved to One Drive, One Drive then lost the file, Microsoft not interested

I opened the case to the hard drive and replaced hard disk with another and i cant make it work and now over time i don’t remember which disk actually goes to it.

Read More

Recover data forensically for use in court (UK)

With legal cases involving digital evidence that goes to court in the UK, it’s important that the contentious data is extracted forensically. This means following ‘chain of custody‘ procedures that ensure that the recovered data is admissible in a UK court of law. The following are examples of cases where it’s been necessary to preserve data that has been acquired forensically. This digital data has been acquired from either mobile phones or computer hard drives. Forensic data recovery is also possible from CCTV and DVR too – run a Google search for forensic ‘data recovery companies in London’ or ‘data recovery companies in Manchester’ to find a company that provides this service.

Forensic data recovery of iPhone

forensic data recovery service in the UKI’m trying to find a company that can assist in the forensic data recovery of files from an iPhone. A few days ago went to update my iphone 6s to ios 11.2.5 from the phone. It updated fine but whenever I went into photos or notes it would give me a blank page for 1 minute then disappear, the rest of the phone was fine. I asked a friend for advice and he told me to connect to my macbook while holding home and power button then let go of power button. He told me to click update software (again) and it would overwrite the update and fix my problem. The update loaded half way then crashed, now stuck in recovery mode and will not come out of it. I have tried updating again and again but keeps coming up with error code (14). I do not want to restore the phone as I don’t have a backup saved besides a few small things in icloud dating back several months, instead I want to forensically recover the phone’s data as I’m involved in an ongoing legal case and the data is to be used in court. I have 7 years worth of memories on this phone that I have transferred from phone to phone over the years. The main bit missing would be my photos between 2016 and now. Really distraught as all of my cherished photos from family, holidays and the whole past 2 years are not on icloud. I do not want to restore and wipe the phone without someone trying to recover my current pictures first. I know that the photos were there after my initial faulty update as when I force pressed the photos album I could see the most recent photo. Now phone is stuck in recovery mode and continuously failing to update or change screen. I have spoken to multiple people including the apple store team who tried on their own laptops and could not help me. PLEASE tell me these can be recovered somehow and you can get through the encryption to access the data??????

Forensic data recovery of external hard disk

Hi – do you provide a forensic data recovery service from an external hard drive? My Lexar external drive failed on me yesterday, it was flashing red when I entered it into my laptop and not being detected. I tried a few online fixes which said to change the drive letter, this helped slightly as the laptop can now detect the USB but there’s no data on it. It’s of paramount importance that I forensically retrieve the files from this device as they form part of the evidence in a court case. I tested out a few data recovery programs but they only recover deleted data from 8th of Jan and before; none of the programs I tried can retrieve data after Jan 8th specifically my dissertation which I was writing up yesterday and saved on my flash drive. Please can you help me as I tried nearly everything to recover my recent data but only recovers old data that I don’t need.

Read More

UnRAID data recovery

2x unraid Hard drives from different PC’s
Systems have been re-imaged.
We would like to recover Word and Excel files from these HDD’s pre re-imaging.

Hard drive damaged and important data is on drive. WD 100GB approximately.

I have deleted my audio records by mistake and would like to recover them

Unraid data recovery is provided in the uk by data clinic ltd

I have a 1 TB Seagate external hard drive that failed during operation. It Suddenly stopped working while watching a movie from it.
It now clicks / beeps continuously but does not mount on any computer.
The outer plastic case has been opened to plug the hard drive into a dock with no success, but the actual hard drive itself has not been opened.
Based on your standard service how much will data recovery cost?

I have a 1 TB Seagate external hard drive that failed during operation. It Suddenly stopped working while watching a movie from it.
It now clicks / beeps continuously but does not mount on any computer.
The outer plastic case has been opened to plug the hard drive into a dock with no success, but the actual hard drive itself has not been opened.
Based on your standard service how much will data recovery cost?

Seagate st31000340ns, appears in bios but not found when in my computer, occasionally shows up but won’t even show size if drive, in running windows 7 , disc is spinning,

I have a Lacie 5big 25TB Raid 0 drive, the unit has stopped powering up, I tried a seperate power supply and still nothing. Could you fix the unit so I can access the data or recover the data from each HDD seperately.

I built an unRAID setup with 2x2TB st31000340ns drives some years ago and went to move to a new system and believe i formatted the drives.

I have a hard drive that I took out the Pc, I believe it’s a Sata 40 or 44pin. I tried turning it on with an adapter but it doesn’t make a clicking noise to show that it’s working, nothing happens nor does it register on autoplay. Could you kindly let me know whether it could be fix and how much I would be paying roughly.

my WD external drive stopped working after I unplugged it without safe remote. After the incident, the computer cannot identify the drive.

My HDD seems to be dead it worked fine one moment and is now not turning I was just wondering if you could recover the two user areas that are stored on the HDD & at what cost it would be to myself.

Seagate 1TB internal HDD, approx four years old. PC failed to restart after Windows 10 update with boot record error. No strange noises from drive, recognised when connected to second PC but states requires formatting. Running CHKDSK reports that the contents are in RAW format. Can you help?

Looking for quote to recover data from a Seagate ST2000DM001 that failed suddenly with a mechanical fault. Drive not recognised through the BIOS and is clacking on power up.

I have a 2Tb WD My Passport external drive that has been dropped from about 3 feet onto carpet. When you connect to a computer it makes several beeps and stops, tries to spin again and makes more beeps. Is this something that you can recover data from and to what cost please?

Dropped my 2TB Seagate external hard drive (bought this year) from about 3ft onto a hard wooden floor. Now sounds like there is loose material inside it. When plugged into laptop I hear a USB recognition noise, additionally I can see the drive under disc drives within Device manger but I cannot access any of its content. I want to recover the data from the unraid system that I setup. It makes a qiuet regular beeping noise when plugged into my laptop. Contains a lot of personally important holiday photos and videos.

My Maxtor Diamondmax 22 STM3500… does not register in the BIOS anymore. I cannot extract any of my data. I switched the sata cables. Checked if everything was in the correct place. Nothing helps. The HDD seems to make the usual sounds, nothing out of the ordinary….except that the desktop computer does not see the harddrive. (all IDE’s are zero in the BIOS) With a sata – usb converter the harddisk still does not register. My laptop (on which I connected the harddrive via converter) does not even ‘notice’ any new device.

I have a western digital, my passport drive. It stopped working, I’ve had a look online, taken the drive back off and it looks as though the heads are stuffed.
Are you open tomorrow? Saturday to take a look? I could nip over to Northampton, I’m just over Coventry way.

Read More

Recovering archive data from tape

If you have any type of data stored on tape and no longer have the hardware to recover the files then allow me to redirect you to this earlier data tape recovery blog post. Here are two examples where there is a requirement to retrieve old archived computer data from tape storage. This is sometimes referred to as eDiscovery.

  • We have a DAT DDS3 TAPE with a backup made by BACKUP utility under DEC ALPHA DS10 running OPENVMS 7.3, and we want to get the backup file from the TAPE to hard drive on PC but we do not have access of TAPE reader.
    We just want to get the backup file, i.e one file of size 3,4 GB
    We would like if your are able to do that and for what price.
  • I have 1 or 2 quarter inch tape cartridges containing a CPIO (or perhaps tar) archive from a 1990’s Unix workstation while at college. How much would it cost to transfer their contents to DVD or USB stick, assuming they are still readable? I’m located near Chiswick.

Read More

Digital Evidence Investigation – Data Recovery and E-Discovery

As more of our lives are stored digitally, so more of this digital information is often seen as evidence. Maybe a phone contains images from a crime scene, or perhaps a hard drive contains an important email that warrants a forensic investigation of the data. One term for this is forensic data recovery.

Most data recovery companies are able to examine data forensically. Digital evidence examination basically looks at the data on a digital storage device in an attempt to discover if there is any pertinent information detailing illegal activity.

Enquiries for e-discovery (or ‘data discovery’) as it is widely known vary. Here are a few examples from clients wanting a forensic examination of their hard drives and mobile phones.

Linux ext4 formatted 2TB WD HDD that is fairly new. Will not initialise or mount. Has 1TB of films I need back as the online backup has, incredibly, failed at the same time. I have a spare drive to move the data to. I’m interested in having this data examined forensically – I think the phrase is e-discovery or examination of digital evidence.

My Seagate External Hard drive has stopped working, and the light will not light up. However it does ask for me to initialize the disk, and makes a clicking, beeping noise.

Over christmas I took a lot of video footage on my phone to make into a short movie – i put my SD card into my laptop and transferred the videos onto my desktop or iCloud, i also made folders for them on my SD card, now when i came to open the folder it has turned into an exec file which now it won’t open my videos and i fear i may have lost them! i tried to download a free software to try recover the data but it only recovered the audio and even then it was broken, i believe that the footage is still there i just need a way to bring it back, now my Mac is not recognising my SD and i don’t want to keep trying unless i cause further damage. It is only now that I realise that some of the footage may contain digital evidence of wrong doing and it may be necessary to reproduce this in a legal case. What facilities exist to examine the hard drive, SD card and phone forensically? Can you examine each of them and produce a forensic report as the what activity has taken place on each?

Read More

Retrieve stored files from OCZ in Manchester

OCZ Agility 3 SSD drive has stopped working without warning. No longer works in Mac or external drive caddy. Suspect controller fault.
Can you recover data?

OCZ Agility 3 SSD

I have an scsi external HD for my OCZ E Mu sampler SSD (music) and it’s been solid as a rock until last night where I heard it spin up… then down again: now the sampler ‘sees’ it as sleeping but it will not wake. Lights on, so power supply good. I am in Manchester M16 and need data off it/fixed or, wosrt case, at least a storage solution.

My OCZ external hard drive for a few years and has all of my work / photos on it. However, it no longer shows up when I plug it in. I have used disk utility on my Mac which is telling me it needs repaired but says it can’t be fixed when i press ‘first aid’.
I’ve ordered a new external hard drive for tomorrow in a hope that the files can be transferred from the existing one on to the new one?

I have an OCZ Hard Drive
I dropped the hard disk from office table and it stopped working
After dropping, i connected again the hard drive to computer and let if on for 30 minutes
After 30 minutes i heard a long noise
I disconnected the hard drive from computer and tried to log back again
But it gave 2 beep sounds and failed to connect
At the moment it is not working and my initial attempts to recover the data failed
I was told that the hard drive’s requires the following:
* A platter exchange is required that cleans the disk platters with alcohol solution to remove any remnants of the failed read/write heads
* Images the disk platters individually
* This procedures allows, image more sectors from the disk platters which means more data will get imaged.
Can i kindly request your help to advise whether this is possible with your service and cost of the service if possible

Read More

Hard drives are uninitialised and unallocated

In this article we discuss hard drives that have developed faults and become uninitialised or unallocated. This is quite a common problem and I’ve included some links as well to external web sites where people are having the same type of problems. These enquries come from people in West Yorkshire.

I have an external hard drive that is now coming up as uninitialized and unallocated on my PC, I have ran the WD diagnostic check and it say too many bad sectors. I have ran drill disk but it finds no files, should I assume all is lost or can you give me a price to check possibilities. I live in Sheffield, towards Barnsley

I have got a Seagate Backup Plus Portable Drive.
I was transferring pictures over from my MacBook Pro to the drive when my computer froze. I restarted my computer and then the hard drive was no longer picking up. I tried in another laptop this time Windows and still not picking up. The hard drive is now showing up as unallocated.
When the hard drive is plugged in it makes the running noise as normal but also bleeps which I haven’t heard before, it won’t initialise either.
The hard drive has not been used many times.

Since Tuesday I have been unable to access a folder on one of my uninitialised external hard drives which has very precious photographs of my children. I fear it may have a virus as I accessed a card website called funky pigeon as it was working perfectly before and the hard drive is only 3 years old and I have no back up. Could you advise please

My external hard drive (I think it is a SSD) has lost connection to the computer. I have had a friend strip it down and done everything he can do to recover the unallocated data, but was unable to read it (this is what he does as part of his job). He now states that the only way to recover the data is by using software and a data recovery company. Does this sound like something you can fix?

Data recovery on uninitialised and unallocated hard drives costs between £300 and £600 from decent clinics in West Yorkshire in places like Sheffield and Rotherham.

Read More