In our industry, “data recovery” refers to the process of restoring data that has been corrupted, deleted, or made inaccessible for another reason (such as a media failure).
“Computer forensics” is related, but different: Forensics attempts to determine what happened to the data. Typically, the goal of computer forensics is to present evidence in court.
Sometimes, the two fields overlap. For example, if you’ve deleted a file and need it back, you need data recovery services. If an angry employee deleted the file, you may still need data recovery — but you may also wish to file a lawsuit or press charges against the employee for intentionally destroying the data. In that case, you’ll need computer forensics services.
Do I need data recovery services or computer forensics?
If you intend to use restored data as evidence in a court of law — or if there’s even a slight chance that you may do so — you need computer forensics services.
It’s in your best interest to tell data recovery engineers about this possibility as early as possible. Here’s why:
- Computer forensics engineers maintain a chain of custody (a report that shows how media was handled, who handled the media, and other key details). Without a complete chain of custody report, you may not be able to demonstrate the integrity of your evidence.
- Computer forensics requires a distinct set of tools. Forensic engineers will need to use the appropriate tools to find key information (such as when a file was edited or opened, which users edited the file, and so on).
- If the target data is potentially illegal, appropriate engineers will need to be assigned to the case. Appropriate precautions will need to be taken to handle the data in an ethical, legal manner.
- Precautions will also need to be taken to protect the evidence while it remains in the engineer’s custody. Without those precautions, the evidence may not be admissible in court.
- Forensic engineers can provide an accurate timeline for the case. This can be essential information for your legal team.
Because it requires extensive specialization, computer forensics is usually more expensive than standard data recovery. However, if you need to present information as evidence, you need forensics and eDiscovery services — standard data recovery is not an option.
Related: Computer Forensics: What Is It, and How Is It Used?
Researching Computer Forensics Providers: Key Questions
When researching computer forensics, we recommend asking questions:
- Does the forensic specialist use industry-standard tools and software?
- Does the forensic specialist have relevant experience, and have they ever testified in court?
- If the company uses proprietary software for forensics and discovery, has the software been accepted by courts as admissible?
- Does the firm have appropriate outfitting for performing data recovery services when necessary, including certified cleanrooms and firmware repair tools?
- Does the firm have appropriate controls for maintaining privacy/security compliance when handling the data?
Computer Forensics and Data Recovery Services from Datarecovery.com
Datarecovery.com maintains full-service laboratories at each of our listed locations. Whether you need data recovery, computer forensics, data sanitization, or other related services, we’re dedicated to providing expert resources to meet your needs.
To learn more about our data recovery and forensic services, schedule a risk-free evaluation online or call 1-800-237-4200 to speak with a specialist.
