An Introduction to Computer Forensics


. :~ ALIVE FUN ARTICALS ~: .

Computer forensics has been defined as a technological, systematic inspection of the computer system and its contents for evidence or supportive evidence of a crime or other computer use that is being inspected. However, computer forensics is also widely used in ivil litigation matters.


The type of evidence sought varies and can include theft of trade secrets, theft of or destruction of intellectual property, and fraud. Computer forensics requires specialized expertise that goes beyond normal data collection and preservation techniques, and care should be taken and selecting a forensics expert.

A computer forensics specialist can use a variety of methods for discovering data that resides in a computer system, including recovering deleted, encrypted, or damaged file information.
Computer forensics specialists generally have experience with a wide range of computer hardware and software than the typical
data recovery expert
may not. Moreover, the specialist often is called upon to testify in depositions and at trial regarding the information recovered.

Computer evidence can exist in many forms or formats. Knowing this possibility, it's possible to recover alternate formats of the same data.

Because the protection of evidence is critical, a knowledgeable computer forensics specialist will ensure that a subject computer system is carefully handled to ensure that no possible evidence is damaged, destroyed, or otherwise compromised by the procedures used to investigate the computer.
The
computer forensics specialist
will take several careful steps to identify and attempt to retrieve possible evidence that may exist on a subject computer system. He will also make certain that extracted and possibly relevant evidence is properly handled and protected from later mechanical or electromagnetic damage.

============================ The End =========================

SQL Server Database Recovery


. :~ ALIVE FUN ARTICALS ~: .

Most companies use relational database management system (RDBMS) and store their data in SQL databases. What happens if after rebooting the server the database doesn't attach and your backup is corrupt, incomplete or outdated?


Have you ever had a drive containing SQL data crash and the files were recovered by a data recovery company but the SQL database is corrupted? One unreadable sector inside a SQL database will not allow the file to attach. First Advantage's team of data recovery specialist's can expertly assist you in the instances to recover your data.
SQL recovery
from drive failures, more often than not, a two-stage process. First, the physical data (raw sectors) must be recovered in order to gain access to the logical data. If the database will not attach to SQL server, then the second stage is SQL recovery.

Media in database servers suffer from the same failure as drives in personal computers. Even the best configured system can fail due to:

* Corrupted database
* Torn page detection
* Deleted data (tables, records, systems objects)
* I/O error in SQL server
* Deleted or corrupted log file
* Database in "suspected" mode
* Unable to restore from corrupted backup file

Is it possible to recover?
In most cases it is possible to repair the database to an attachable state. If the
data recovery
specialists are unable to repair the database to a point to where it will attach, then the specialist will recover as many tables and records as possible for you with First Advantages' specialized recovery software tools. This recovered data can then be merged back into an empty database that your front end will work with.

Getting Started
If the failure mechanism is hardware or file system corruption, then the recovery specialists would require the original media to be sent to First Advantage data recovery. This is because file fragmentation can scatter pieces of the database and log file all over the media. These pieces must be collected and reassembled so we can start our analysis. If the database was corrupted by some other means then a copy on any media will do.

What can you do to help?
Third party SQL recovery and utility programs can cause damage beyond our ability to recover the files so it is best if clients don't attempt recovery with such programs with the original files. For database repair and/or scavenging, it will save time if you can furnish First Advantage with the database structure (perhaps an empty database or backup) and a list of prioritized tables.

After determining what steps will be necessary to complete your recovery, First Advantage will contact you for approval. No work will be done without your consent. As soon as you approve the recovery, our recovery specialist will continue with the recovery effort by analyzing the database and records, extracting the data and rebuilding the database.

============================ The End =========================

Computer Hard Drive Failure


. :~ ALIVE FUN ARTICALS ~: .

If you find that your personal or business computer suddenly stops responding to your commands, or the hard drive simply crashes, what are you going to do? Sure, you can run down to your neighborhood electronics store and purchase a replacement hard drive for your computer, but what about your data on the failed hard drive? How important was it?


Did you save it or back it up? Unfortunately, most home users do not back up their systems, and many small businesses have older back-up procedures that are often ineffective for recovering files.
The first thing to do is to remain calm. Acting rashly can actually do more damage to your data. In case of actual hard drive failure, only a
data recovery professional
can get your data back. The fact that you cannot access your data through your operating system does not necessarily mean that your data is lost.

The only irreversible data loss is caused by overwriting bits, physical damage to the drive platters or destruction of the magnetization of the platters, which seldom happens in the real world. In the majority of cases, the malfunction is caused by a damaged circuit board, failure of a mechanical component and crash of internal software system track or firmware. These situations can be addressed by the experts in First Advantage's Data Recovery Services unit, who are able to recover 100% of the data for 96% of customers.
First Advantage's
data recovery
'rule of thumb' is: if you hear a clicking sound emitting from your hard drive, or if the computer's S.M.A.R.T. function indicates an error during the boot process, something is wrong. The safest bet is to call First Advantage for your expert data recovery needs (1-877-304-7189 or use our contact form here.

After receiving your failed hard drive, a First Advantage data recovery specialist's first step will be to try and save an image of the damaged drive onto another hard drive. This image drive, not the actual damaged hard drive, is where the data recovery specialist will try to recover the lost data.
The next step in the imaging process is to determine if the
hard drive failure
was an actual malfunction, a system corruption or a system track issue.

System corruption and system track issues are normally fixed by using First Advantage's proprietary data recovery software, which was developed by our research and development engineers. System corruption or system track recoveries do not require processing in a clean room environment.

Unfortunately, damage to a hard drive's circuit board or failure of the head drives is not uncommon. In each of these failures, a First Advantage data recovery specialist will work on the system in a clean room environment*, substituting parts such as drive electronics, internal components, read/write arms, writing/reading heads, spindle motors or spindle bearings from a donor drive in order to gain access to the data on the failed hard drive. In most cases, the data recovery specialist is able to retrieve and return your lost data.

It's really very simple. If your data disappears, don't panic. First Advantage can recover it for you, as we've done for thousands of satisfied customers since 1981. If we are not successful, then you pay nothing. What have you got to lose?

============================ The End =========================

Software and Hardware Recoveries


. :~ ALIVE FUN ARTICALS ~: .

So, your computer has just frozen, locking in data essential to your business or personal life. You know you need to contact First Advantage's Data Recovery Service team in order to retrieve it, but you're unsure of the process. Read this article to learn everything you'll need to know about how to get First Advantage on the case, and what happens in the data recovery process.


The initial step in your data recovery process is to contact First Advantage's Customer Care Center personnel (1-877-304-7189). They are highly experienced in answering questions from panicked PC owners, and they will attempt to ease your data anxiety attack. Be prepared to give the call center personnel detailed information about the problem and the circumstances that led to it so they can better address your concerns.

After speaking to the customer care center, the next step is to get the damaged drive to our Data Recovery Services team. There are several ways to accomplish this: you can either ship the system to us via U.S. mail or a private delivery services such as UPS, or you can drop the drive off at one of our branch offices or drop off centers, located in key cities throughout the U.S. (The customer care center can help you find the drop off center closest to you.)
If you elect to ship the drive to us, please remove it from the computer prior to doing so. Not only will you save on shipping costs, but it will help our
data recovery
engineers to more easily perform a diagnostic on the drive. If you elect to bring the drive directly to one of our locations, this step is unnecessary; an engineer can remove the drive for you.

Software Failure Recovery

After the drive is received and the information you provided is analyzed, the defective drive is connected to a data recovery work station, where an experienced data recovery engineer can diagnose the problem.

If it is determined that the drive has not experienced a hardware failure, then our data recovery specialist will first attempt to recover the data by connecting the drive to a work station computer and utilizing First Advantage's propriety software. This will be successful in recovering data that was lost by accidental deletion of partitions or formatting errors. During this process, any existing data is read and then copied onto another, undamaged hard drive. The data recovery engineer will work with the copied data only, in order to prevent further corruption from the damaged drive.

Hardware Failure Recovery

In the event that the software recovery attempt is unsuccessful, the next step is to perform a hardware failure recovery. In this process, the engineer will usually start out by replacing the circuit board. Sometimes, a trial-and-error method will be involved, requiring the engineer to systemically replace various components, such as defective drive heads, so that the recovery can be completed. Since these replacements require compatible parts and firmware, our Data Recovery Services team maintains an extensive supply of essential parts and has a list of responsive suppliers that can quickly fill our parts requests.
In both cases, the recovery engineer will substitute the defective part with a working one until he or she is able to gain
access to the hard drive data
. In 96% of all cases, we are able to recover 100% of the data.

So now that you know what to expect every step of the way, give First Advantage's Data Recovery Services team a call. Either we'll recover your data and return your system to you (and even pay for the shipping!), or you won't pay us a dime. That's our guarantee, and we stand proudly behind it.

============================ The End =========================

RAID Data Recovery


. :~ ALIVE FUN ARTICALS ~: .

A redundant array of independent drives ("RAID") recovery is much more difficult than a single hard drive recovery and should only be attempted by a qualified specialist, like the experts in the Data Recovery Service unit of First Advantage.


RAID manufacturers set up the internal controls of their arrays in different configurations. Since the RAID configuration is most likely proprietary, it is almost never disclosed to or shared with other data recovery companies.
That's why RAID data recovery engineers must have
years of experience and be able to write recovery programs for each separate RAID data recovery operation.

The first step in the data recovery process is to get the RAID drives' data copied on to a server or other hard drive so that the data set can be re-assembled.
Each recovery procedure is unique to a particular RAID array. For example, a level 0 RAID (also known as a RAID 0) is the most challenging type of recovery because there is no fault tolerance and thus, no margin for error. A RAID 0 is made up of two drives, with the data striped in small sets across one or both of them. Since there is no parity in a RAID 0, the information that was saved on a failed drive is not replicated elsewhere, meaning that it will be difficult or impossible to recover.
On the other hand, a RAID 5 is made up of three or more drives and does offer parity data, so when one drive fails, a replacement drive can be used for recovery and the array can be rebuilt. However, if two drives of a RAID 5 fail, the recovery process becomes more difficult. If enough data can be saved from the malfunctioning drives, an experienced
RAID recovery
engineer can usually succeed, because the RAID parity is still available.

Each
RAID data recovery
is unique, because manufacturers set up their internal arrays differently. A RAID recovery engineer must be able to determine the arrangement of data and the parity cycle to recover the data and rebuild the RAID. The data is accessed on a file system level instead of on a controller level. Normally, an NTFS file system is used in this type of recovery, because the logical drives will be providing the basis for working on a RAID image. This allows the RAID recovery engineer to assemble bits and bytes after a successful recovery using propriety software developed by First Advantage.

RAID data recovery is certainly not recommended for amateurs, nor for the weak of heart. First Advantage has successfully recovered data from RAIDs as well as all popular types of storage media since 1981.

============================ The End =========================

Computer Hard Drive Failure Recovery Processes


. :~ ALIVE FUN ARTICALS ~: .

If your personal or business computer suddenly stops responding to your commands, or the hard drive simply crashes, what can you do?


Of course, you can run down to your neighborhood electronics store and purchase a replacement hard drive for your computer, but what about your data on the failed hard drive? How important was it? Did you save it or back it up?

Unfortunately, most home users, and many business users, do not back up their systems. Moreover, many small businesses have older back-up procedures that are often ineffective for recovering files.
If you need to
recover data on the hard drive
, the first thing to do is avoid trying to reboot or doing anything that involves the hard drive. Doing so can actually do more damage to your data.

In the case of actual hard drive failure, only a data recovery professional can get your data back. And the fact that you cannot access your data through your operating system does not necessarily mean that your data is lost.

The only irreversible data loss is caused by overwriting bits, physical damage to the drive platters or destruction of the magnetization of the platters, which seldom happens in the real world. In the majority of cases, the malfunction is caused by a damaged circuit board, failure of a mechanical component and crash of internal software system track or firmware.

As a "rule of thumb," if you hear a clicking sound emitting from your hard drive, or if the computer's S.M.A.R.T. function indicates an error during the boot process, something is wrong. You should immediately stop using the hard drive in order to avoid causing further damage and, potentially, rendering the information on the hard drive unrecoverable.
After receiving your failed hard drive, a
data recovery
specialist's first step will be to try and save an image of the damaged drive onto another hard drive. This image drive, not the actual damaged hard drive, is where the data recovery specialist will try to recover the lost data.

The next step in the imaging process is to determine if the
hard drive failure
was an actual malfunction, a system corruption or a system track issue.

System corruption and system track issues are normally fixed by using a specialist's data recovery software. System corruption or system track recoveries do not require processing in a clean room environment.

Unfortunately, damage to a hard drive's circuit board or failure of the head drives is not uncommon. In each of these failures, a data recovery specialist should work on the system only in a clean room environment. There, the specialist can substitute parts such as drive electronics, internal components, read/write arms, writing/reading heads, spindle motors or spindle bearings from a donor drive in order to gain access to the data on the failed hard drive. In most cases, the data recovery specialist is able to retrieve and return the lost data.

============================ The End =========================

Exchange Server Database Recovery?


. :~ ALIVE FUN ARTICALS ~: .

E-mail servers are an integral part of business success in today's environment. A critical services database that changes very often, such as messaging and collaboration data, should be fully protected by a well-tested back-up solution.


However, back-up devices can also fail - leaving the client with serious problems. Standard repair utilities within the mail applications can cause further problems if media failure or structural damage has occurred.

First Advantage supports Microsoft Exchange Server version 5.5, 2000 and 2003. Our Microsoft Certified Engineers are able to recover the mailboxes located in the Information Store from just about any kind of "Jet Engine Error," "Read Verification Error," database corruption, over-sized files or other file problem.

Typical situations that our experts can address include:

* Inconsistent Information Store state
* 'Dirty' shutdown
* Corrupted header information
* Damage from ESEUTIL
* Duplicate keys (identifiers)

First Advantage's standard services include recovery of:

* E-mail addresses from Active Directory storage
* Folders, messages and file attachments
* Notes, contacts, tasks and appointments
* Creation dates for all objects
* Formatting for RTF and HTML messages

First Advantage's
data recovery
engineers have the capability to recover your Exchange Server Information Store Files from many forms of backup tapes.

Critical Information:
Widely available recovery utilities can delete valuable data. First Advantage's recovery experts suggest that you make a copy of your .EDB, .STM and .LOG files prior to:

* Attempting to attach or repair a damaged Information Store
* Opening a tech support case with Microsoft
* Sending your database to any other company

After determining what steps will be necessary to complete your recovery, we will contact you for approval. No work will be done without your consent. As soon as you approve the quotation, our engineers will continue with the recovery process.

============================ The End =========================

How Is My Data Recovered?


. :~ ALIVE FUN ARTICALS ~: .

One of the First Questions You Need To Ask About
Data Recovery - "How Is My Data Recovered?"


It's one of the most often asked and necessary questions about data recovery - "How do you get my data back?"

There's really nothing magical about it, although sometimes recovering data can seem almost miraculous.

The Right Knowledge and the Right Tools
Proper data recovery requires two things: knowledge about the proper procedures for data recovery and the right tools, i.e., technology.

Not all data recovery companies offer the necessary knowledge and technology. So in choosing a data recovery company, ask about both. Find out about the credentials and accreditations the people who'll be working on recovering the data.

Then find out what type of facilities (more on that in a moment) and technologies they use.
The first thing a
data recovery
firm should do is
evaluate the hard drive
and determine if the data is recoverable. While doing this, they should also determine what recovery process will be necessary.

Two types of failure in a hard drive
Generally speaking there are two primary forms of failure in a hard drive: logical and physical. Logical failures are usually the result of file-system corruption. Physical failures can be either mechanical or electronic.

The determination of the type of failure will determine the next steps to be taken.

If the drive failure is a logical issue, an evaluation of the file system will be performed to try and repair the corruption. If this doesn't work, then a very low-level scan will be performed, searching all sectors of the hard drive for files.

If the files are located, they can then be copied to a CD-ROM, DVD-ROM or another hard drive. Be aware that logical recoveries can take up an enormous amount of time, especially if the drive is on the verge of physical failure.

If the problem is a physical failure, recovery can be more difficult. Again, there are two categories of physical failure, mechanical and electronic. Physical failure usually necessitates having matching parts to get the drive functioning again. So it's important to find out if the data recovery firm has access to parts that match your hard drive.

Clean Rooms
If the firm you are working with has bona fide expertise in data recovery, they should also have a "Class100 Clean Room." A Class100 Clean Room is designed to maintain exceptional air purity, containing less than 100 airborne particles larger than 0.5 microns in each cubic foot of air. Such an environment is vital for protecting the sensitive internal components of hard drives. If it is going to be necessary to perform an invasive procedure on a hard drive, a Class100 clean room or better is needed.

Ask questions
A data recovery firm should be prepared to answer your questions about how they will recover your data. They should have no problem with evaluating the problem and discussing the procedure for recovery.

Ask about the availability of a "Clean Room." Ask about the type of failure they've diagnosed.

Doing so can help you determine how legitimate a data recovery company they are. For instance, if they don't have a Clean Room, it may mean that can't properly deal with physical failures in the hard drive.

Get answers that satisfy you that the company has the necessary knowledge and tools to do the job right. If they don't, you need to find another data recovery company fast.

============================ The End =========================

Data Recovery - A Sea of Confusion


. :~ ALIVE FUN ARTICALS ~: .

Your hard drive stopped responding and you don’t know what to do or what not to do. You call the OEM of your computer for support. After a couple of hours on the phone with tech support, it is determined that indeed the drive is failed. They tell you that you will have to seek professional data recovery services.

You do a Google search for “data recovery” and find yourself drowning in a sea of confusion. You search website after website and see options and pricing ranging from $179.00 to $4000.00. Who do you call, who do you trust? Right now you’re feeling what I have coined as “Data Loss Anxiety” and the symptoms are many. I would like to help you through this chaotic period by briefing you on some basic do’s and do not’s, a few industry misconceptions and why you should use First Advantage for your data recovery requirements.

Can I Fix It Myself?

Firstly, don’t panic, you have almost a 100% chance of getting your data back so relax. What we don’t want to do at this time is hinder any chances of recovery. Most importantly, if your drive is making any strange noises and the system BIOS does not see it as being physically present, do not try any further. There is no software or hardware available to the public that will allow you access to the drive. If your system does see the drive being present and it sounds normal but it won’t boot, try slaving the drive into a working system. This may give you complete access to your data. One more thing, please don’t put your drive in the freezer, any amount of condensation will destroy the media when you spin it up. Please see our tips page for more info on what you can safely try.

The Industry Today

Data recovery companies are popping up like mushrooms all over the web. The vast majority of these companies are not able to recover from physical failures. They are software only shops that advertise full service. Their MO is to advertise super low flat rate pricing and cherry-pick what they can handle with minimal effort. All other jobs beyond their capability are tagged as failed. They will contact the client and tell them that the drive is not recoverable when in fact it is. This discourages the client from pursuing any further attempts for recovery...it’s an absolute crime. There are only 4 true full service cutting-edge companies in this industry and we’re the best of them. A big shake-down is occurring right now in this business and only those that can produce will survive.

Why Pick First Advantage?

If you've ever required data recovery in the past you may have used us. We are the original Data Recovery Services, Inc. headquartered in Dallas Texas. Established in 1981, DRS has remained the authority in the data recovery industry serving a global market. In March of 2005, DRS was acquired by First Advantage Corporation (NASDAQ: FADV), a global risk mitigation company looking to expand their service offerings. First Advantage offers a range of recovery services from a simple floppy disk to the most complex fiber channel RAID configurations. All of our procedures are done in house by engineers handpicked from around the world. We develop and manufacture hardware solutions that our competition would die for. Our facilities are cutting-edge with ISO class 5 or better clean rooms. When it comes to pricing, we offer a value added hourly model that our clients agree is the most attractive in the industry. We have a REAL 96% success rate and hear it from new clients all the time “I’ve been told that if First Advantage can’t get it, nobody can”...it’s true.

Please Ask Questions

When you’re doing your due diligence don’t be afraid to ask questions. Put the representative through their paces. Here are some FAQ’s that you really should ask and the answers that you should be given and why.
How Much Will It Cost?
Data on computer storage media can be lost physically, logically or a combination of both. A comprehensive diagnostic must be performed in order to give you a firm, fair price. Typically, you should be given a range on your initial call. The more detail you have of the symptoms, the narrower the range will be. If a company gives you a flat price on your initial call, hang up and go to the next. After a free comprehensive diagnostic, First Advantage will give you a firm price quote with no hidden fees.
How Long Will It Take?
Modern hard drive recovery is very complex and the final result is all based on the success of one routine. This routine involves acquiring a physical sector dump (image) from the drive. Typical turn time for a single drive recovery is 2-5 business days if the drive responds normally to procedures. It can however take longer than this if there are hard to find parts or the drives media is degraded. All firms in this industry have had the occasional drive that reads for three weeks before completion. If a recovery company guarantees you a timeline over the phone, they’re blowing sunshine up your skirt. First Advantage will never guarantee a completion time for any project...we can only estimate. We work as quickly as we can to get you back up and running in the shortest period of time. We do offer critical response and expedited processing to shorten turn times. These premium services push your project to the front and dedicate resources to your project until completion.
What If you’re Unsuccessful?
Some companies will charge you an “attempt fee” if they fail your recovery. This is another reason to stay away from the mushrooms described earlier in this article. Most reputable companies, as is with First Advantage, will not charge you anything for a failed project. Sometimes there are recoveries that are marginal due to unreadable, damaged areas of the drive. Unread areas can cause everything from file corruption to data that is completely missing. We have implemented a Value Assessment Program for just this reason. We will work with you on the cost of your project to give you a fair price on the data that is viable.
How Will I Get My Data Back?
Typically, when a user has a drive failure they will remove the bad drive and go ahead and install another to reload and get going again. You should receive back a universal media that is compatible with your system so you can easily copy the recovered data back to your fresh system. We make sure that that’s exactly what you receive. Most of our clients will receive DVD or an external USB drive free of charge.
Is My Data Confidential And Secure?
A data recovery facility should be secure physically and logically. By this I mean having a monitored security system on the facility, secure electronic connectivity with the outside and data storage management and recycling. All First Advantage Facilities are ISO 27002 certified. First Advantage will not disclose any client information to third parties except (i) pursuant to a final, non-appealable court order or (ii) as required by federal, state or local law.
What If My Recovery Gets Lost In Shipment?
This is good question. First Advantage, as other industry leaders do, creates a “sector-to-sector” image of all incoming hard drives to prevent further possible data loss and keep your original drive unchanged. We retain your image/data for 5 business days after you have received the recovery to insure completeness and reintegration of the recovered data. “Budget” data recovery companies are working directly from problematic drives. Good luck getting any post recovery support from them.

The Bottom Line

Data recovery is not for everyone. You must weigh the cost of recovery against recreation of the data. In cases such as lost photos or video footage, the data cannot be recreated so easily if at all. At First Advantage, we have a genuine interest in recovering your data. We are on a quest to prove that we are the best in the industry. If you really and truly must have your data back, you’ve come to the right company. If you have any questions, please don’t hesitate to call and ask for me directly, I’ll be happy to chat with you about your project. Remember, back up early, back up often.

============================ The End =========================