4370
IamA data recovery engineer. I get files from busted hard drives, SSDs, iPhones, whatever else you've got. AMAA!
Hey, guys. I am an engineer at datarecovery.com, one of the world's leading data recovery companies. Ask me just about anything you want about getting data off of hard drives, solid-state drives, and just about any other device that stores information. We've recovered drives that have been damaged by fire, airplane crashes, floods, and other huge disasters, although the majority of cases are simple crashes.
The one thing I can't do is recommend a specific hard drive brand publicly. Sorry, it's a business thing.
This came about due to this post on /r/techsupportgore, which has some awesome pictures of cases we handled:
One of our employees answered some questions in that thread, but he's not an engineer and he doesn't know any of the really cool stuff. If you've got questions, ask away -- I'll try to get to everyone!
I'm hoping this album will work for verification, it has some of our lab equipment and a dismantled hard drive (definitely not a customer's drive, it was scheduled for secure destruction): http://imgur.com/a/TUVza
Mods, if that's not enough, shoot me a PM.
Oh, and BACK UP YOUR DATA.
EDIT: This has blown up! I'm handing over this account to another engineer for a while, so we'll keep answering questions. Thanks everyone.
EDIT: We will be back tomorrow and try to get to all of your questions. I've now got two engineers and a programmer involved.
EDIT: Taking a break, this is really fun. We'll keep trying to answer questions but give us some time. Thanks for making this really successful! We had no idea there was so much interest in what we do.
FINAL EDIT: I'll continue answering questions through this week, probably a bit sporadically. While I'm up here, I'd like to tell everyone something really important:
If your drive makes any sort of noise, turn it off right away. Also, if you accidentally screw up and delete something, format your drive, etc., turn it off immediately. That's so important. The most common reason that something's permanently unrecoverable is that the user kept running the drive after a failure. Please keep that in mind!
Of course, it's a non-issue if you BACK UP YOUR DATA!
datarecoveryengineer1909 karma
It's a fun question. On the physical side, you can open up your hard drive and scratch the magnetic material off of the platters. Drill holes through it, hit it with a blowtorch, or shatter the platters (if they're made of glass). Don't just rip off the electronics, that does nothing.
If you don't want to go that far, you can do a DOD (stands for the Department of Defense's standards) wipe. There are tons of utilities that do this. It overwrites the data on your drive with various patterns of 1s and 0s. Realistically, any data recovery provider won't be able to get anything after one full wipe with a random pattern. The random pattern will guard against future technologies that could amplify the magnetic signal to figure out what used to be a 1 and what used to be a 0.
Technically, you don't need multiple passes, but the biggest issue with secure deletion tools is that software isn't perfect. With that in mind, I'd advise doing at least three passes.
EDIT: There's a good reply below on how I'm off with my DOD terminology. I don't really perform many secure wipes, but I'd recommend reading it if you're interested.
redmercuryvendor1385 karma
you can do a DOD (stands for the Department of Defense's standards) wipe. There are tons of utilities that do this. It overwrites the data on your drive with various patterns of 1s and 0s.
To be pedantic, the DoD developed tool is the ATA SECURE ERASE command, is built into every drive made in about the last decade, and just writes 0 to the entire drive (including sectors in the G-list). The 'overwrite with 1s and 0s multiple times' myth is not only time-wasting overkill for drives with GMR heads (again, past decade), but there's the minuscule chance you had some sensitive data in sectors that were added to the G-list after write, which would be missed by something like DBAN.
datarecoveryengineer1672 karma
That's not too pedantic, I made a mistake. Thanks for the well-written response.
datarecoveryengineer126 karma
We could probably cover from the areas that don't have a hole if it was really, really important. Not sure if we'd get usable files, though. Better use a few nails.
chimerical261326 karma
My girlfriend cracked a micro SD. It's still one piece but you can see a crack running across the middle where it flexed to much. Is it totally done for in your opinion?
datarecoveryengineer4861 karma
No, I think that you can still repair the relationship if you're open with her about how you feel. Maybe cook her a meal or something and have a long talk. It's not totally done for.
As for the Micro SD, I can't answer that without seeing it. I can say that a crack in the plastic doesn't mean a crack in the actual chip, even if it's not reading. Most likely the flexing has caused a disconnection of the copper contacts from the PCB inside. I would say that recovery chances are very high if that's the case, but again, I'd have to see it.
AngelOfLight640 karma
Does the SSD TRIM command complicate data recovery in any way? I have heard conflicting answers to that question.
datarecoveryengineer766 karma
Deleted data is often unrecoverable due to the TRIM command. So yes, it does.
ratshack541 karma
What was your most challenging recovery?
What was your most memorable recovery?
How did you get started/what training?
What is the most common type of failure?
What is the most common situation that you cannot recover from?
What are the costs involved in a typical recovery?
also, you guys are great! it used to be a simple "it is dead" situation but you guys are like data necromancers. Thanks in advance!
datarecoveryengineer946 karma
Let's see if I can figure out bullets.
Most challenging: Physically, any of the fire-damaged cases. It's very difficult to prevent platter contamination, even when you're working in a clean room. On the software side, larger RAID 5 arrays can get very complex very quickly.
Most memorable: I remember the failures more than the successful ones, but one that's been on my mind recently is a drive we recovered for the family of a missing person. It was pulled from a lake. The person in question disappeared and is probably alive, and the family is looking for any clues as to where he went. It's heartbreaking. Out of respect for the family, I won't give any more details, but we recovered that case for free and I really hope that they find him soon.
On a lighter note, we've recovered cases for science research institutions and NASA, and those are always fun because they're really cool people and they're doing really amazing work.Training: answered in another question, but I was primarily trained on the job.
Most common failure: read/write head crashes by far. If you hear a clicking sound, that's probably what it is. It's pretty remarkable that they don't fail more often when you consider how precise heads are. They're incredible.
Most unrecoverable: some people hear a grinding, clicking, or whirring noise and continue to let their hard drives run for hours on end. This kills the drive. There's a pic in the album at the top of this thread of one case where the platters were completely translucent.
If your drive makes noise and it has something important on it, shut it off immediately.It ranges from $600-1900 on average. That's a huge range, but lots of stuff can happen to a hard drive. We try to keep costs down because a happy customer will always talk about your business, especially in this industry. With that said, it's not a cheap service.
And finally, I'm going to steal the term "data necromancers." Thanks!
OldManLaughingBull205 karma
Out of the cases where you recovered data for research institutions, how high is the percentage of cases where PhD students lost their thesis data and have no backup?
datarecoveryengineer331 karma
Not high, but it's happened before. We try to give them enough discounts to make it viable if it's something like that. If it's a really fast recovery (like 0.5 man hours) we might do it for free, but don't hold me to that.
Aeroflight515 karma
I do one pass of zeroing my hard drive. I give it to you. What are the odds of recovery? Imagine that price is no factor.
datarecoveryengineer1335 karma
If you're sure you actually zeroed it out? We wouldn't have a chance, and neither would any other company regardless of what they say.
In order to recover the data, you'd need to magnify the signal to an extraordinary degree, and that technology doesn't really exist. That's not to say that it won't exist in the future, though.
EDIT: But OK, just to play the game, how would I go about it? I would recommend to the CEO that we get a $2 million dollar deposit with no guarantee of recovery. Then we would hire a team of geologists to use an electron microscope to determine the previous state of each bit. 10 years later, we’ll have your data copied to your virtual block chain drive (bitcoin-based technology that will be invented by then).
HistoricalStickler465 karma
Geologist here. There is no way I'm staring through an electron microscope for ten years for anything less than $250,000 per year. So you might want to rethink your strategy.
Tigrael440 karma
Geologist here. I have some old hard drive platters and access to a scanning electron microscope. Anyone want me to try this and post pictures?
EDIT: Obligatory RIP inbox. Okay, if I can find the platters by Sunday I'll do it this weekend; else it might be a few days because our big yearly conference is coming up (AGU for those in the know) so SEM time is becoming a precious resource.
EDIT 2 SATURDAY NIGHT (LIVE) EDITION: I've got some time scheduled for Wednesday night!
EDIT 3: Thank you kind Swedish-speaking stranger for the gold.
EDIT 4 FEELING GOOD ON A WEDNESDAY: Got the pictures, will post them by Saturday when I'm done being busy with Thanksgiving things. I wasn't able to focus well enough to see what we wanted; I'm going to see if I can get one of the people in the department good at taking wicked high magnification pics to help out. I took some images of other things though that I think are cool, so there'll at least be SOME pretty pictures this week. Stay tuned!
datarecoveryengineer200 karma
Years ago I worked in a Geology department and we did this -it was very cool but the microscope could not produce any digital images since the digital camera had not been invented yet. This would be very cool! Can you share them with me? I'll post them on our website.
MerryPrankster1967421 karma
I have a clicking hard drive,it has very important stuff that I need to recover.I've read that sticking the HD in the freezer for several hours may cause it to work long enough to get some files off of it.
Should I try this?
datarecoveryengineer874 karma
I would strongly discourage it. I guarantee that someone will post a reply saying that "it works," but the science doesn't back it up for modern hard drives.
On older drives (think up to the 2000s) it was actually a technique. The reasoning was that it would shrink the drive slightly and allow a stuck spindle to "unfreeze" (ironically). Newer drives are far too precise for that.
If you stick a drive in a freezer and it works afterwards, it probably would have worked if you'd left it sitting on your counter. Some drives with minor physical issues will work, say, every 5th time you try them, and they might be more likely to work after a long rest, so there's a correlation =/= causation issue with this myth.
My problem with this technique is that it could cause lasting damage to the drive. If the heads are failed, you're potentially looking at platter damage, and if you're not careful, you might even end up with some crystallized moisture from your freezer.
MerryPrankster196726 karma
Good point.I dont have thousands of dollars to spend on data recovery.What I have is lots of music I made and jingles and things like this that I used for my online radio show.THAT is irreplaceable :(
datarecoveryengineer84 karma
Please don't try it. This likely wouldn't cost thousands of dollars.
Look for a company with a clean room and compare quotes. Read a bunch of customer reviews. This is likely a recoverable problem, and I'll bet you can find someone in your price range that has more tools than your average freezer.
datarecoveryengineer1209 karma
I've got a conflict of interest here, since we currently sell software. Because of that, I'm going to respectfully avoid recommending a specific tool, although I'm sure someone else in this thread will give you a recommendation and I'll be happy to confirm or deny whether the program's capable of this type of recovery.
Honestly, most commercial data recovery programs will work, but make sure the program's designed for your file system. Read the reviews, too.
This should be obvious, but we see it all the time -- don't install the program to the drive with the deleted data. You'll need to access it with another computer, and you'll want to recover the data to another drive. Your software should only be accessing the formatted drive, not writing anything to it.
This is probably a very simple recovery, though, depending on your drive's file system.
crystalgeek188 karma
I'd personally just try test disk first to see if I can recover the original partition table and it's free.
datarecoveryengineer216 karma
This tool will most likely work if it's an NTFS or FAT partition.
datarecoveryengineer172 karma
This also works, so now you've got three options. I recommend visiting /r/datarecovery for help.
wooofles327 karma
How much of your work is recovering bit coins or other virtual currencies wallets that have been lost?
datarecoveryengineer607 karma
We have had one case so far, and it was recoverable. The talk at the time was this wallet was worth about $30,000 in Bitcoin, or about 50 bitcoins. We charged $800 for this case, so I think data recovery was a good investment.
andrewdonshik92 karma
I'd forward /u/driftpants to you but he didn't just delete a bitcoin. He DBANed it.
datarecoveryengineer557 karma
Big barriers of entry. Any one of the machines in our laboratory would set you back at least $9-10K, and that's not to mention the clean room, research and development, specialized firmware tools, etc. We also have to source parts for certain hard drives, but that's a drop in the bucket compared to the other stuff.
It's also a really specialized service, and while there are a lot of companies that do it, there's only a handful with the capabilities to treat any type of device.
PsychoticLime243 karma
How's your work place? I imagine you work in some kind of sterile room to prevent dust from ruining the hardware or something like that...
datarecoveryengineer356 karma
Yes, there's a Class 100 clean room. I can't get a picture of that right now, but we probably have one around here from the last time we tested. I'll look for it.
It prevents contamination when we're replacing parts of hard drives. It's really strictly controlled and we have to wear special clothing when we're in there.
Outside of the cleanroom, it's a pretty typical office, except there are tons of workstations everywhere for different types of cases.
cosmotravella223 karma
So, I bought a new SSD from Toshiba, and if failed after 6 months. I lost my data. How difficult was it to recover?
datarecoveryengineer293 karma
That depends on what's wrong with it. We've gotten pretty good at solid-state drives, so most issues are simple; if it's an electronic issue that doesn't affect the media (I'm guessing that's the case if it failed after only six months), it's probably a very easy recovery.
We remove and read the media, then reconstruct it into a usable state. Corruption is very unlikely, especially with a drive that new.
Kuonji218 karma
If you examine a drive for recovery and determine you are able to get data off of it, do you get the data off immediately and then inform the customer? Or do you tell them you can get data off and then wait for their approval before getting it?
datarecoveryengineer280 karma
Now this is a sensitive question in the industry. My answer's sort of in between the extremes. No, we wouldn't fully recover a drive, because that would be dishonest in my opinion and it would lead to a weird haggling war with the customer. It feels dirty to me.
However, we also wouldn't just look the drive over and send out an eval. We have to definitively diagnose the problem, and while performing that diagnosis we will see a clear path to a recovery. So yes, you could say that we're committed to the process of recovery before we send out an eval, but that doesn't mean that we've got the case done.
That means that we occasionally have to tell a customer that their stuff's unrecoverable after they've agreed to the recovery, which sucks, but it's better than the alternative.
Now, what if we plug in a drive and it starts right up? It's happened before. In that case, we'll explain it to the client, and they'll go tell their friends about it. Free advertising and they'll usually still ask us to transfer the data to another drive, so we don't lose money or anything.
gonenutsbrb88 karma
This is probably not going to get answered as it's not a very popular thing to discuss was surprisingly answered very well. Realistically, they are attempting it already by the time you are called/emailed to say that recovery is possible. It may not be done yet, but the process is under way if not in queue. That being said, this does not mean the process has become negotiable beyond what the company usually states pricing to be. This is our job, and the price was usually determined before you ever called, please don't make our job more complicated by attempting emotional appeals.
The first rule of our job with recoveries (at least for me) is don't get emotionally attached to a job, it leads to poor decision making and bad judgement calls. This is a very technical job and requires quite a bit of capital to start. Equipment is expensive, and much of the software is done on a yearly license basis. Unless someone tries to say that it's $10,000 for a single drive recovery of your summer pictures, they're not trying to rip you off, it's just the cost of doing business. As stated in another post, the average cost should be somewhere around $800-$1200 for a single drive recovery; encryption makes things slightly more difficult to verify a recovery, and RAID arrays are far more complex.
datarecoveryengineer82 karma
I responded but you make some really good points here and give a really good perspective on it.
UnrustledJimmie196 karma
How often do you save the porn/nude pics you find on people's hard drives or cell phones?
datarecoveryengineer469 karma
Haha, never. We couldn't if we wanted to (and believe me, with our day-to-day case loads, we're more interested in returning your files as quickly as possible than ogling your pictures, I don't care if you're the most attractive guy/girl on Reddit).
We're not allowed any removable media in the laboratory. We even debated allowing the smartphone camera in for the verification pictures. The devices we use to store recovered data aren't accessible through the Internet, and all recovered data is securely wiped with three passes after we transfer it and send it back to the client.
Security's a huge issue around here, and we don't really look at data except for verification purposes.
On a related note, we have had people ask us to recover adult content, in which case we've had to open the requested files, but believe me, it's less tantalizing than you think.
perkymciggles105 karma
I'm going to second this, and also ask what education you received towards getting your career. Seems like something I could get into.
datarecoveryengineer310 karma
There's a related question below. Is it against the rules to re-post the answer from that one? Does it help if I don't care about my comment scores?
Well, anyways, here's that answer:
This is a really specialized industry, and there's no clear path in terms of education. I have a bachelor of science in computer management and information systems, but it doesn't really play a huge role in my job; I was hired here for another position and learned data recovery over the course of several years.
That's not typical. We also have employees with degrees in nuclear engineering, electronics engineering, and programming. It's a good mix, because if one of us can't figure out a problem, chances are good that someone else can.
If you're interested in working in data recovery, I'd recommend either an electronics engineering degree or a programming degree if you want to work on the software side. You will probably learn most of the actual craft on the job.
We also do computer forensics and electronic discovery. Those specialists have certifications, but I don't know too much about that, it's out of my area of expertise -- even so, a certification in computer forensics will almost certainly get your foot in the door.
dre200147 karma
I only ask because I graduate with a bachelors in CF and found that it was extremely tough to get into the working field. I am an InfoSec analyst now and still not focusing solely on computer forensics
datarecoveryengineer59 karma
It's been a long time since I looked for a job, so I'm obviously a bit off in my predictions.
Tickles_My_Pickles111 karma
What's the weirdest thing you have ever had to recover, or recovered by accident?
datarecoveryengineer250 karma
Recovered on accident? Geez, we're always doing it on purpose. :)
Weirdest, we've worked on answering machines. You probably mean weirdest in terms of content; people ask us to recover just about anything you can think of. Adult videos, stolen movies, you name it. It's always weird to me that people don't just re-download publicly available stuff, but time is money I guess.
datarecoveryengineer257 karma
Nothing comes to mind. Sorry to bore you, but we don't go snooping through people's stuff unless they ask us to. The cases I remember are the ones where we get to work on something really exciting or important. We recovered stuff for rescue personnel after September 11th, so that's a really powerful memory, but that's definitely not super-personal data.
I'll keep thinking on this to see if I can come up with a more satisfying answer.
OddOliver94 karma
So I have an old phone sitting in my drawer. Can you get the nudes my ex GF sent me off of it? Also, please don't tell my wife.
datarecoveryengineer262 karma
We're strict about privacy, so we totally could, provided that the pictures are legal.
Communicate with your wife, though. Cook her a meal or something. :)
datarecoveryengineer135 karma
Yep. They all store data. An older phone might actually be more difficult then a newer phone, since we know what data structures look like on smartphones; with some rarer older phones, we might need a little more time, but it can certainly be done.
thefastandme75 karma
Would it be able to recover files from a HDD that has been overwritten with 37 passes?
datarecoveryengineer108 karma
No, not if the passes were complete. There's no technology to amplify the magnetic signal that extensively.
suaveitguy70 karma
What is the hardest, most-time consuming method of data recovery that you regularly have to do?
What are the most exciting innovations in your field in the last few years?
datarecoveryengineer161 karma
I once opened a large RAID unit and it had swarms of cockroaches crawling inside. This is the only time I screamed like a girl in our lab. The failure was due to electronics shorted from the cockroach dung.
Most exciting innovations are SSDs. Upcoming technology will allow us to recover SSDs that have been completely overwritten with zeros, or wiped. Also innovations to make virtual machine recovery easier have been developed by our programming team. EDIT: I made a mistake regarding software being developed to recover from zeroed SSD -we are not working on this, it was rather only the subject of a coffee break argument, my apologies.
Most time consuming can be a RAID that we have not seen yet. Most of these are from large enterprise SANs containing multiple luns. They are almost always recoverable but sometimes take months of hard work and custom programming. Drobo RAID, while recoverable, can take a long time for us to determine recoverability.
datarecoveryengineer93 karma
This is more of a forensics question, but I’ll offer my opinion anyway. Crypto erasure seems secure and is much faster than zeroing the entire drive. But why not just erase the encryption key?
With crypto erasure, it is my understanding you can still recover the old data with the old key, just not the with the new key. We have not had a case yet (in 17 years of business) where someone has requested this type of recovery so I'm a little out of my depth, but it's a really good question.
matthewreade62 karma
Is an iPhone an easy device to recover from when it's in recovery mode?
datarecoveryengineer130 karma
Yes, iPhone recoveries are generally very successful. However, on a related note, if you delete a text message on the newest iOS, it's gone for good.
NeoMomus47 karma
How effective is the cipher command in DOS in terms of preventing recovery of previously deleted data?
datarecoveryengineer64 karma
To my knowledge, we have never had any data recovery scenarios where customers have requested that we recover deleted data after it has been overwritten using the cipher command, so we have not performed any research into the recovery possibilities.
I can say that if the data is truly overwritten with at least one pass, then recovery would be impossible; however, the cipher command does not appear to address slack space or data stored in temporary files that may be related to the content you are attempting to destroy. We would probably start here if we were to start a research project on the recoverability of encrypted data that was wiped using the cipher command.
Do you have any specific examples that include the switches you would use and on what type of data and its encryption state? If so, I'd be interested in looking into it for you. I primarily work with hardware, but I'll get our software guys on it.
datarecoveryengineer52 karma
A little outside of my expertise. I don't hack, and I can only comment from the perspective of a recovery engineer. Our forensic guys might be better suited for this question if you're asking whether we could detect this type of attack or anything related to that.
As far as using it as a tool for data recovery, we would not use this method. We have other ways to retrieve encryption keys. However, it seems really interesting, and I'll look into some white papers on the subject.
HadACigar44 karma
What do you think of The Great Zero challenge: recovering data from a hard drive that has been overwritten with zeros once with the dd command?
datarecoveryengineer119 karma
I may be living under a rock, but I just heard of it. Here's my problem with it, from what I can find, and excuse me if this info is old.
The prize is $500. It would take hundreds of thousands of dollars or even millions of dollars in research to come close to developing that technology. Who would take that challenge? It's nuts.
I highly doubt that we'll ever be able to recover a drive that's been intentionally zeroed out. There's a pretty massive technical barrier there.
Medieval_Peasant23 karma
In 2008 some researchers published an article after trying to recover data overwritten with dd. You can read the paper here: http://www.vidarholen.net/~vidar/overwriting_hard_drive_data.pdf
You can see the results of attempted recovery of a plain text in section 3.2. Not very impressive. Still, my initial thought was that with some smart probabilistic approach one might be able to improve the reconstruction significantly for plain text.
datarecoveryengineer17 karma
I think I would agree with that. As I told another commenter after thinking about it for a while, I think we could do it if we weren't limited by either time or money. It might take a decade, though, just to amplify every single charge. Multiple passes, forget about it.
thesongsinmyhead44 karma
Don't know if this is the right kind of question, but it just happened today so I'm looking for answers.. I spilled water on my Macbook Air today (spilled is an understatement. My water bottle decided to open up and pour out its entire contents into my backpack, which of course has a waterproof liner, so my computer was sitting in a pool of water for up to 20 min before I got out of the car and noticed it) I haven't tried to turn it on, have been airing it out (like a tent?) and now have it in front of a cool fan. It's been a few hours.
When should I try to turn it back on?
Is it completely done for? What should I expect?
My only sliver of hope is that the way I pack my laptop in my backpack, the opening faces downward so there's a possibility the water was really only around that section, not the hinge/ports side. Who knows.
datarecoveryengineer83 karma
I wouldn't turn it on for at least a week. If I had important data on the hard drive, I'd get it to a qualified data recovery company ASAP.
PhilipMcNally41 karma
Are there any more secure ways of wiping data from an iPhone before selling it on?
datarecoveryengineer47 karma
Out of my area, but I'll look into it for you and update this.
PizzaGood35 karma
So maybe you can answer a simmering question in my group of friends.
Would you rather have an SSD failing or a magnetic drive failing? One friend figures that when an SSD fails, you're just fucked and it's stone dead with no hope of recovery. I figure that an SSD failure is very likely to be due to excessive wear on some sectors, and the drive is probably mostly still readable. Obviously if a chip actually fails you're in the same boat as a magnetic drive.
Second, just in general, what lifetime are we seeing with SSDs? I'm in favor of them, I think the current generation is probably likely to last as long as magnetics if used with a new OS that knows how to handle them. He figures they're GUARANTEED to fail at some point.
I say that ALL hard drives WILL fail at some poing.
datarecoveryengineer43 karma
Most SSDs that we receive actually fail due to electronic issues, not memory wear. Memory wear would be a more severe issue, but SSDs are still new enough that we haven't received a ton of drives with this problem to my knowledge. Hard drives usually fail due to mechanical wear, firmware issues, and electronic problems.
As a data recovery engineer, I'd rather see a hard drive case than an SSD case, but the recovery rates are high for both. As a consumer, I'd rather use an SSD for a plethora of reasons.
The jury's out on SSD failure rates, but it's really important to note that they're not all equal. Some are much better than others in terms of the quality of their memory, their memory wear leveling processes, etc. If you want to buy an SSD, do your research! Don't go for the cheapest option. It's a better return on your investment in the long run.
I can't recommend a specific brand, but it's not hard at all to figure out the best ones.
datarecoveryengineer56 karma
This is a really specialized industry, and there's no clear path in terms of education. I have a bachelor of science in computer management and information systems, but it doesn't really play a huge role in my job; I was hired here for another position and learned data recovery over the course of several years.
That's not typical. We also have employees with degrees in nuclear engineering, electronics engineering, and programming. It's a good mix, because if one of us can't figure out a problem, chances are good that someone else can.
If you're interested in working in data recovery, I'd recommend either an electronics engineering degree or a programming degree if you want to work on the software side.
We also do computer forensics and electronic discovery. Those specialists have certifications, but I don't know too much about that, it's out of my area of expertise -- even so, a certification in computer forensics will almost certainly get your foot in the door.
datarecoveryengineer34 karma
We don't get too much play in the movies. Usually it's pretty far off for dramatic purposes.
There was one Sopranos episode where they started talking about computer forensics. I think they were looking for Jackie Jr. (who'd been whacked) and a competitor of ours had some really good product placement. I was really excited to see what they did with that storyline but it just sort of ended there.
datarecoveryengineer34 karma
Probably that episode in Star Trek where they almost lost Data in the transporter
JimmyRUDEjam12 karma
I'm not in the IT world anymore unfortunately but I remember looking into data recovery over the years and the prices were fairly prohibitive for all but the most... irreplaceable data. Have costs for recovery remained the same or has it gone down?
datarecoveryengineer27 karma
It's still expensive, although it is going down. It really depends on what's wrong with the device. We do free evaluations and so do most of the other major companies, which helps a bit, and we get a lot of drives from home computer users, but it's still a service for irreplaceable data. We rarely recover non-essential stuff.
HEROnymousBot10 karma
What is the most morally questionable material you have been asked to recover? Did you recover it?
datarecoveryengineer18 karma
We will recover anything and keep all data completely confidential unless it's extremely illegal. And by "extremely illegal," I mean that we don't care about your pirated movies.
My job isn't to make moral judgments, and it's something we're really careful about here given the sensitive nature of our work. Sorry if that's a cop-out answer.
ninjajpbob9 karma
What are things to consider when performing a comprehensive backup? Should I use something like clonezilla to copy everything over, forget about it, and just reset OS on the hard drive (given that I'll use the computer again)
I was trying to back up some computer, but got too anxious over missing some possibly important things, by say, not setting up a browser sync, etc.
datarecoveryengineer13 karma
Let me Google Clonezilla really quick...
Ah. That will definitely get everything. A clone is a clone (is a clone is a clone), it's an exact duplicate of the data on your drive. If the drive's in use I'd totally set up a differential backup, too.
ithinkchaos4 karma
Does putting an old HDD in the fridge/freezer actually help in getting it to spin up one last time for me to get things off of it?
datarecoveryengineer4 karma
I've got a more complete answer elsewhere in this thread, but short answer: nope.
Nehemoth2 karma
Why data recovery is so expensive, thinking about a normal guy perspective non a company. What are the things behind the scene that elevate the cost and last, can we expect a lower price point in a near future?
Thank you
datarecoveryengineer6 karma
I think we're rapidly moving towards a lower price point, but that's just my opinion.
The technology is improving to the point where internal component repairs are less and less common. We work with firmware a lot now, so our costs are going down.
With that being said, it's still a really specialized industry, which is why you still see high prices. We have to pay a ton of money for the hardware we use, the credentials we get, advertising, and all of the normal costs of running a business. The barrier for entry is huge right now.
If you see a company offering data recovery for $300-500 right now, they're probably not equipped to handle the process. However, I think we're moving towards that, and I wouldn't be surprised if we (or another major company) offered a lower price point in the near future.
ruslanoid1 karma
I have an SD card full of pictures from vacation that "broke" midway through copying them to my laptop. since then it is either not detected at all our detected as a few MB long instead of the 32GB it should be, because of that any recovery software I tried fails. why does it all depends on knowing the size ahead? can't it detect it in the recovery process? can I save my vacation pictures?
EatGulp1 karma
co worker has old hard drives
whats a easy way i can recover data without sending it off?
uju211 karma
Data recovery from previous storage or from people Who you communicates with?
datarecoveryengineer5 karma
I can't successfully recover the data in this sentence, I'm sorry.
abrabled1697 karma
The Easy Question: What can I do to my hard drive so that you (or anybody else) are unable to salvage any information from it? (not that I have anything to hide...)
View HistoryShare Link