Call 573 532 490

The greatest damage often occurs only after the incident

In matters where chronology, metadata and traces of work on the storage device are important, the greatest risk is not the moment of failure itself. The problem begins when the disk is further booted, quickly checked, scanned with repair tools, or copied in a way that changes the source material.

If you suspect that the media may contain material relevant to a business matter, dispute, security incident or further technical analysis, treat it as source material, and not an ordinary disk for immediate rescue. You can read more about the service itself on the website computer media forensics.

First steps after the incident

Disconnect the media from further work and do not run an operating system on it unless absolutely necessary.
Zanotuj objawy: date, time, who had access, what was run and when the problem occurred.
Mon-Sat 09:00-18:00: media model, computer, adapter, recorder or server from which the media was removed.
Don't confuse rescue operations with forensic analysis. The goal is not to quickly "fix"the disk, but to limit change and preserve the value of the material.

What not to do before analysis

Do not start "Rebuild/Resync"and do not re-initialise the array — this may overwrite data. CHKDSK, First Aid, fsck or automatic file system repairs.
Do not copy files by trial and error from an unstable storage device.
Do not install the system "side by side"or "temporarily"to see the contents of the disk.
Do not run antivirus, cleaners, or applications that modify metadata and indexes.
Do not disassemble the mechanical storage device and do not attempt to repair the electronics yourself.

How to prepare material for delivery

What helps most is a brief, factual description of the case: what media is being examined, what questions you want to ask the analysis, what happened after the incident, and whether any "repairs"were made along the way. Thanks to this, you can more quickly determine whether the priority is to secure the image, analyze metadata, recover deleted data or organize the material for the representative or the compliance department.

What to write down before contact

media type: HDD, SSD, USB flash drive, memory card, RAID/NAS, media from a laptop or workstation,
symptoms: failure to mount, RAW message, reading errors, unstable operation, system failure to boot,
whether scans, repairs, updates, reinstallations or copy attempts were performed after the incident,
what answers are most important: whether the files were deleted, whether the scope of changes can be confirmed, or whether data recovery is the only thing that counts.

When to go to a service instead of continuing on your own

If the media is unstable, the system asks for repair, SMART errors appear or someone has already run actions on it that change the data structure, subsequent home attempts only make the situation worse. Then it is worth stopping activities and switching to a controlled laboratory procedure.

FAQ before contact

Can I open the files myself to see what's in them?

If the material has evidentiary or analytical value, it is better to limit such attempts to a minimum. Each additional run may change metadata, indexes, and system traces.

Can simply copying files also be harmful?

Yes, especially if the media is unstable or the file system is corrupt. Copying attempts often generate further errors and may lead to further degradation of the material.

Does this analysis apply to phones?

No. In this area, we are talking about computer media and IT environments, not phone data recovery.