Forensic Phone Data Recovery – Legal Cases

Recovering the data from a mobile phone is often crucial in any type of legal case. Usually recovering this data is straightforward as the phone is working, but sometimes data may have been deliberately deleted or hidden, and other times the phone may have been deliberately smashed or broken in an attempt to stop anyone accessing the data on it.

We are frequently asked if it’s possible to recover information like text (SMS) messages and WhatsApp messages from phones where the messages have been deleted or lost. This is usually possible so long as the delete messages have not been overwritten. If the information is still on the phone we should be able to recover it regardless of the phone make and model.

forensic damaged phone data recovery (police and legal)A further complication comes if we are asked to recover information from a deliberately damaged or broken mobile phone. This presents the added complication that we first have to repair the phone before we can begin to locate the data to be recovered. Again, it should be possible, but it obviously depends on how damaged the phone is.

In this photo of a Samsung S9, the phone had been seized at a crime scene by the police who (unsurprisingly seeing the phone’s condition) had not be able to recover any data from it. The phone had been run over in a car and both sides were smashed. Fortunately the damaged phone came to us and we were able to successfully recover the data from it.

The most common types of data we are requested to recover from mobile and smartphones are

  • Text and WhatsApp messages
  • Diary dates and times
  • Location data
  • Photos and videos
  • Internet histories

Some further reading:
Phone data recovery – More about Data Clinic’s general phone data recovery
Forensic data recovery – Details of Data Clinic’s advanced and forensic data recovery capabilities
Forensic data investigation – Further information about forensic data recovery and how it all works legally

 

 

 

Read More

UnRAID data recovery

2x unraid Hard drives from different PC’s
Systems have been re-imaged.
We would like to recover Word and Excel files from these HDD’s pre re-imaging.

Hard drive damaged and important data is on drive. WD 100GB approximately.

I have deleted my audio records by mistake and would like to recover them

Unraid data recovery is provided in the uk by data clinic ltd

I have a 1 TB Seagate external hard drive that failed during operation. It Suddenly stopped working while watching a movie from it.
It now clicks / beeps continuously but does not mount on any computer.
The outer plastic case has been opened to plug the hard drive into a dock with no success, but the actual hard drive itself has not been opened.
Based on your standard service how much will data recovery cost?

I have a 1 TB Seagate external hard drive that failed during operation. It Suddenly stopped working while watching a movie from it.
It now clicks / beeps continuously but does not mount on any computer.
The outer plastic case has been opened to plug the hard drive into a dock with no success, but the actual hard drive itself has not been opened.
Based on your standard service how much will data recovery cost?

Seagate st31000340ns, appears in bios but not found when in my computer, occasionally shows up but won’t even show size if drive, in running windows 7 , disc is spinning,

I have a Lacie 5big 25TB Raid 0 drive, the unit has stopped powering up, I tried a seperate power supply and still nothing. Could you fix the unit so I can access the data or recover the data from each HDD seperately.

I built an unRAID setup with 2x2TB st31000340ns drives some years ago and went to move to a new system and believe i formatted the drives.

I have a hard drive that I took out the Pc, I believe it’s a Sata 40 or 44pin. I tried turning it on with an adapter but it doesn’t make a clicking noise to show that it’s working, nothing happens nor does it register on autoplay. Could you kindly let me know whether it could be fix and how much I would be paying roughly.

my WD external drive stopped working after I unplugged it without safe remote. After the incident, the computer cannot identify the drive.

My HDD seems to be dead it worked fine one moment and is now not turning I was just wondering if you could recover the two user areas that are stored on the HDD & at what cost it would be to myself.

Seagate 1TB internal HDD, approx four years old. PC failed to restart after Windows 10 update with boot record error. No strange noises from drive, recognised when connected to second PC but states requires formatting. Running CHKDSK reports that the contents are in RAW format. Can you help?

Looking for quote to recover data from a Seagate ST2000DM001 that failed suddenly with a mechanical fault. Drive not recognised through the BIOS and is clacking on power up.

I have a 2Tb WD My Passport external drive that has been dropped from about 3 feet onto carpet. When you connect to a computer it makes several beeps and stops, tries to spin again and makes more beeps. Is this something that you can recover data from and to what cost please?

Dropped my 2TB Seagate external hard drive (bought this year) from about 3ft onto a hard wooden floor. Now sounds like there is loose material inside it. When plugged into laptop I hear a USB recognition noise, additionally I can see the drive under disc drives within Device manger but I cannot access any of its content. I want to recover the data from the unraid system that I setup. It makes a qiuet regular beeping noise when plugged into my laptop. Contains a lot of personally important holiday photos and videos.

My Maxtor Diamondmax 22 STM3500… does not register in the BIOS anymore. I cannot extract any of my data. I switched the sata cables. Checked if everything was in the correct place. Nothing helps. The HDD seems to make the usual sounds, nothing out of the ordinary….except that the desktop computer does not see the harddrive. (all IDE’s are zero in the BIOS) With a sata – usb converter the harddisk still does not register. My laptop (on which I connected the harddrive via converter) does not even ‘notice’ any new device.

I have a western digital, my passport drive. It stopped working, I’ve had a look online, taken the drive back off and it looks as though the heads are stuffed.
Are you open tomorrow? Saturday to take a look? I could nip over to Northampton, I’m just over Coventry way.

Read More

How we do a ‘Chip-Off’ Forensic Data Recovery on a Mobile Phone

Forensic data recovery and mobile phone investigation is the process of salvaging data from failed storage devices such as mobile phones or hard drives. We offer our services across a wide range of devices. Here we will look at our mobile phone side of the company, more specifically what is known as a chip-off operation. Chip off is a useful technique especially in forensic data recovery, also known as digital discovery, or eDiscovery: these are methods of data investigation used by police forces and insurance underwriters. Data Clinic Ltd are experts in recovering data from damaged phones and hard drives.

With any mobile phone or tablet, we initially attempt to inspect the phone, we determine if the failure is with the peripheral components such as batteries, charging ports and screens. If this is the case, then we wouldn’t need to go any further. For a lot of ediscovery data investigations cases however, this option serves as a process of elimination and if this first attempt of recovering the data is unsuccessful then we look at the more advanced options available to us. This is typically in the form of advanced micro soldering, JTAG or a Chip-Off operation.

So, what is a ‘Chip-Off’?

A Chip-off is the process of de-soldering the Flash Memory chip from the failed phone / tablet in the hope that we will successfully read its raw data independent of the device.

How do we do a Chip-Off recovery?

In order to complete a forensic data recovery on a mobile phone it’s first necessary to determine that a Chip-Off on a phone / tablet is needed then the next step is preparation. The phone must be fully dismantled, including the removal of any protective metal heat shields. When this is done we identify the eMMC (or NAND) memory chip place the PCB into a special holder underneath our stereo microscope as shown here.

What is now needed to remove any underfill from around the memory chip and add specialist flux to the chip. The Flux we typically use is Amtech Tacky Flux – the idea with this is to dispense it all around the chip then apply heat to it.

The main heat application we use is a Quick 861DA heat gun (image below). This is a station that offers a wide range of options when it comes to applying heat. We make sure to select a correct temperature, airflow and nozzle to do the job properly.

Once the chip has been lifted from the board after carefully applying the correct amount of heat we get the de-soldered chip, we then proceed to cleaning and re-balling the chip. This is a meticulous process whereby we need to ensure that each of the 100+ solder contacts have clean solder. It is a manual process that you need skill in precision soldering and a keen eye under the microscope to do.

Once each pin has been successfully and soldered in a uniform manner, it is time to clean it up with specialist chemical solutions. This ensures that the contacts are as clean as they can be and thus the read of the chip should also be good!

There are a lot of readers and programmers available worldwide that you can use to read the raw data of an eMMC NAND memory chip. The honest answer is they all have different capabilities for different chips. Its not a case of one is the best. Here are some samples of these available ‘boxes’. When it comes to data discovery and mobile phone investigation the phone data is fully dumped to a binary image file, we then analyse and decode the raw data. Once reconstructed we can send our customer a summary to let them know the recovery statistics as shown below.

This data can then easily be transferred to another storage device (typically a memory stick) and returned to the customer.

To Summarise

A chip-off is one of the procedures that really is a last resort. Chip-off cases are applicable when:

  • The logic board is too severely damaged to repair

  • ediscovery / digital discovery / forensic phone data recovery is required.
  • The lock on a phone if it is not known and there is no method of bypassing it via software

  • Corrosion cannot be decontaminated

  • For deleted data

The art of performing a chip-off is something that we pride ourselves on being able to achieve, we have recovered the data from many phones where this was the only option and are still carrying out these procedures today.

You can find Data Clinic at The Pavilions, Bridge Hall Lane, Bury, Greater Manchester BL9 7NX

Read More

Digital Evidence Investigation – Data Recovery and E-Discovery

As more of our lives are stored digitally, so more of this digital information is often seen as evidence. Maybe a phone contains images from a crime scene, or perhaps a hard drive contains an important email that warrants a forensic investigation of the data. One term for this is forensic data recovery.

Most data recovery companies are able to examine data forensically. Digital evidence examination basically looks at the data on a digital storage device in an attempt to discover if there is any pertinent information detailing illegal activity.

Enquiries for e-discovery (or ‘data discovery’) as it is widely known vary. Here are a few examples from clients wanting a forensic examination of their hard drives and mobile phones.

Linux ext4 formatted 2TB WD HDD that is fairly new. Will not initialise or mount. Has 1TB of films I need back as the online backup has, incredibly, failed at the same time. I have a spare drive to move the data to. I’m interested in having this data examined forensically – I think the phrase is e-discovery or examination of digital evidence.

My Seagate External Hard drive has stopped working, and the light will not light up. However it does ask for me to initialize the disk, and makes a clicking, beeping noise.

Over christmas I took a lot of video footage on my phone to make into a short movie – i put my SD card into my laptop and transferred the videos onto my desktop or iCloud, i also made folders for them on my SD card, now when i came to open the folder it has turned into an exec file which now it won’t open my videos and i fear i may have lost them! i tried to download a free software to try recover the data but it only recovered the audio and even then it was broken, i believe that the footage is still there i just need a way to bring it back, now my Mac is not recognising my SD and i don’t want to keep trying unless i cause further damage. It is only now that I realise that some of the footage may contain digital evidence of wrong doing and it may be necessary to reproduce this in a legal case. What facilities exist to examine the hard drive, SD card and phone forensically? Can you examine each of them and produce a forensic report as the what activity has taken place on each?

Read More

Hard drives are uninitialised and unallocated

In this article we discuss hard drives that have developed faults and become uninitialised or unallocated. This is quite a common problem and I’ve included some links as well to external web sites where people are having the same type of problems. These enquries come from people in West Yorkshire.

I have an external hard drive that is now coming up as uninitialized and unallocated on my PC, I have ran the WD diagnostic check and it say too many bad sectors. I have ran drill disk but it finds no files, should I assume all is lost or can you give me a price to check possibilities. I live in Sheffield, towards Barnsley

I have got a Seagate Backup Plus Portable Drive.
I was transferring pictures over from my MacBook Pro to the drive when my computer froze. I restarted my computer and then the hard drive was no longer picking up. I tried in another laptop this time Windows and still not picking up. The hard drive is now showing up as unallocated.
When the hard drive is plugged in it makes the running noise as normal but also bleeps which I haven’t heard before, it won’t initialise either.
The hard drive has not been used many times.

Since Tuesday I have been unable to access a folder on one of my uninitialised external hard drives which has very precious photographs of my children. I fear it may have a virus as I accessed a card website called funky pigeon as it was working perfectly before and the hard drive is only 3 years old and I have no back up. Could you advise please

My external hard drive (I think it is a SSD) has lost connection to the computer. I have had a friend strip it down and done everything he can do to recover the unallocated data, but was unable to read it (this is what he does as part of his job). He now states that the only way to recover the data is by using software and a data recovery company. Does this sound like something you can fix?

Data recovery on uninitialised and unallocated hard drives costs between £300 and £600 from decent clinics in West Yorkshire in places like Sheffield and Rotherham.

Read More

Mortgage Advisor Manchester Broker

In this article we discuss how to save money when applying for a mortgage. Here are some links that cover mortgage brokering and advice in and around the Greater Manchester area.

Greater Manchester

One thing about Manchester is that it’s a big place with lots of available houses to rent or buy. So the above links cover buy to let, remortgaging, home movers and first time buyers as well. When seeking a mortgage always look at the interest rate you are being quoted, just a small difference in the percentages can amount to a lot of money over a typically 25 year mortgage duration.

Read More

Critical Process Has Died – Hard Drive Recovery

My hard drive was replaced last week but on the old one there are documents I would like to retain. I could enter my password as usual but nothing happened after that and a system recover was not possible. I did get a message saying a ‘critical process had died‘.

I have about 1 TB of files on an external hard drive that can not get power. It worked 3 weeks ago when i last did an update. I should mention this was in Nottingham and the power sources is fit for USA electrical outlets. I moved to the UK, tried attaching a UK adapter and no luck having it run. Sometimes you may hear a motor running and then you realize the electronic device is not fit for a different voltage and it stops. there was none of this. just quiet from the beginning. i have no way of checking what the problem could be now that im in the UK. my hard drive does not show a voltage range or process either. is the plug adapter just not appropriate or did i break it.

Nottingham

Seagate external hard drive beeps when plugged in and no data is transferred. When googles it appears the motor may be stuck. The hard drive has died and contains data for my teacher training year so it would be very useful to be able to recover the data or fix the drive.

I have a WD External Desktop Hardrive but the USB connection port is broken. The IT department at my school tried to fix the broken port but could not. The data on the hard drive is still there and it’s critical that I recover the contents. They tried placing the hard drive in another casing but as the data has some kind of protection / encryption they cannot get to it. Are you able to recover this data?

My Sony Xperia Z1 Compact has completely stopped working and I need to retrieve very important critical data from its internal storage. I have replaced the battery with a new one but nothing works.

2 x HDD Disks are from a Stora NAS drive both failed, set up as raid. Disks still spin up but cannot read them or access them. Have tried using aftermarket disk mount without success. Would like to know if you have hardware to enable reading of these disks and an approximate cost to recover data. Both discs are 1TB with about 500-750MB used. I saw an error telling me an important process has died – I need hard drive recovery – it’s critical that I get the data recovered.

I had some water damage over my MacBook Air (2013). Apple has put the storage into a safety bag, but did not comment on its condition. Wonder if your team can have a look to see if there are any issues / what it will cost to recover?

I have a Hitachi 5K250 160Gb (model number HTS542516K9SA00), with clicking noises, that is not readable.
Another company told me it’s impossible to recover data, as it is a mechanical issue. HDD was not open on this process.

I have a Buffalo Terastation showing multiple HD failures. I has a little data on it I think that I would like to keep.

I have a Lacie 2TB thunderbolt external drive that crashed. I have tried several recovery software programs but none are able to access any data from the drive. My Mac isn’t able to mount the drive- but after 15-20 min I get a message saying “the drive is unreadable- IGNORE FORMAT EJECT” I would like to know if it might be possible to recover 2 folders from this drive from one partition on the drive- I don’t need all of the data and what this would cost? I am located in Shoreditch

I was in Nottingham and one place I visited the lift doors opened to a yawning gap and in fright I dropped my bag – it fell down the shaft with my and my girlfriend’s phone plus a few other things. My phone and hard drive died so I took the brunt of it and long story short the mother board is damaged and ‘beyond repair’. Apple store says. Any suggestions if it’s possible to retrieve data / photos off of it? I really want the critical process data ie. the What’s App messages and photos from last few months – last backup to iCloud was in February (as it was full) so since then it’s just been on iTunes, on the phone. A friend of mine suggested contacting you. If you think it’s a no can do then please let me know. I can’t set up my new phone until I know as I’ll have to reset my iCloud and will lose all my other data. This is my Mum’s phone number as I don’t have one at the moment – email is best at the moment.

Read More

Samsung and Lacie Hard Drives

Here a some of the hard drives that have come into our Birmingham offices for data and file recovery in the last couple of months. The cost of data recovery is usually between £350 and £650 and depends largely on the type of fault the hard drive has.

Samsung Data Recovery
quayside tower, birmingham, home of data recoveryI have a Samsung laptop hard disc model HM321HI that appears to no spin up and a high pitched clicking sound is only coming from it. Are you able to recovery data from this type of device and what are your charges? I am in Staffordshire but can come to Birmingham if needed

Although it’s been a year since the Samsung hard drive was taking ages to be recognized by my laptop, it was working. However I had to turn the cable to a specific position other wise it would disconnect. 2 months ago I dropped it while it was standing on the desk and since then it will not be recognized, also found a repetitive mechanical sound instead of a running fan sound. I took it to repair shop and they said they cannot make it work.

Lacie Data Recovery
LaCie d2 Quadra Hard Disk 2TB smell of burning, then wisp of smoke coming out the back… switched it off. Do you have an office in Hereford and Worcester or do I drive to Birmingham?

I have a LaCie “big” 4tb drive (although I believe the internal drives are Seagate). It seems to have a mechanical failure as there is a clicking noise on start-up and then the drive is not accessible.

PC wouldn’t boot up – when I inspected it, the hard drive was making some mechanical clicking sounds on boot. I used the PC’s built-in recovery tools to perform a test on the hard drive, and it was showing read errors from a number of blocks – I didn’t continue the test to see how many blocks were unreadable in case it caused more damage. I’ve taken photos of the self-test screen, if they are useful: https://photos.app.goo.gl/qQaqe67ra1NTIWAk2. It’s a Lacie hard drive.

Read More

Data recovery companies in Scotland

A recent hard drive problem caused me to loose access to my data. This put me in quite a panic as I was unsure what to do and didn’t know whether I’d ever get the data back? I didn’t even know if there were any Scottish data recovery companies – fortunately there are, please refer to my previous post about one in Glasgow. I’m just outside of Edinburgh so decided to take a drive across to Glasgow and get my data back. Whilst I was there they told me about some other data they’d got back for Scottish people and businesses.

Bonnie Scotland

No drive on Macbook
This enquiry was from Ayr, Ayrshire: When i insert my external hard drive on my macbook air laptop, it is appearing in the devices section on opening finder. However, the hard drive is not appearing when i click on Go and then click on computer. Additionally, even when i open the hard drive, the files are appearing on the screen but i am unable to open any file. I recently used my hard drive and it was working fine. Kindly advice with the procedure to resolve this problem and also the cost for the same.

Seagate HDD not reading
And this one from Perth: I have a Seagate backup plus external drive that stopped working. I took it out of the black casing in the hope I could add it to my computer to get the data from it but nothing works… I have also tried putting it in an external drive reader … not having any of it.
It is void of its casing but I still have the bits that enable it to be hooked up as an external… what are your thoughts on costing this job please? I have business items on the disk that I would hate to lose.

And finally this one came from Aberdeen: My computer would not boot up and the person I called out said the hard drive was at fault and beyond his ability to repair and therefore data was in his opinion unrecoverable He did suggest a data repair specialist like your self in Aberdeen.
He tried to fire up the hard drive with a USB Cable (in a USB caddy) and also inside another computer. Both times the hard drive starts to vibrate but quickly stops spinning.
The hard drive in question is a Toshiba MK3265GSX HDD2H83.

So including mine, there are 4 enquiries about data recovery in Scotland, one each from Edinburgh, Perth, Aberdeen and Ayr. And yes, I got my files back, but my hard drive was beyond repair and I had to buy a new one.

Read More

Installed Linux over Mac Files

linux logoI stupidly installed linux over the top of my mac. this wiped everything, then when I re-installed mac osx nothing was there. I did send it off to Rapid Data recovery and they were not able to recover anything from the HD. Would you be able to do anything. I did speak to a friend who works in data and they said that there still could be a way.
This is what happened.
– Linux installed which wiped HD and old Mac OSX tables.
– re-installed new mac OSX – nothing there.
– Disk image taken of HD.
So I have a disk image of the HD at that state. As I said Rapid Data already looks at it and said they could not help, I have also run recovery software with no luck.

I have a macbook air 2013 where the ssd is nonresponsive from boot. the macbook doesnt recognise the hard drive but a recovery of documents is required. also will require an eta of recovery (if possible) as i am facing an important deadline. also have an old magnetic hd (LA Lacie Porsche) in which will require recovery of files (not urgent). It’s running a version of Linux and I’m in Salford.

I found an old Seagate drive (model ST1181677LCV). As it has an ultra-wide, 80 pin SCSI connection I am unable to connect to it – and so don’t know its format – though suspect Mac.
My guess is that it may have info from the mid 1990s on it. I am not aware of there being any ‘valuable’ data on it, but would double check if it was not going to cost too much.
Are you able to read this drive? – it’s running and old version of Linux and has some Mac data on it too. It’s these files that I want to recover. I’m in Huddersfield and work in Salford.

I bought a toshiba external hard drive a while ago and stupidly converted the format from Linux PC to Mac compatible and afterwards it wouldn’t work and slowly went down hill from there. Im really scared that all the data has been erased and think theres a slim chance of getting it back. Could you give me an idea of if this is possible to repair/at least get the data from it and how much this would cost? Has 18 years worth of pictures on it!

Read More