In our industry, “data recovery” refers to the process of restoring data that has been corrupted, deleted, or made inaccessible for another reason (such as a media failure). 

“Computer forensics” is related, but different: Forensics attempts to determine what happened to the data. Typically, the goal of computer forensics is to present evidence in court. 

Sometimes, the two fields overlap. For example, if you’ve deleted a file and need it back, you need data recovery services. If an angry employee deleted the file, you may still need data recovery — but you may also wish to file a lawsuit or press charges against the employee for intentionally destroying the data. In that case, you’ll need computer forensics services. 

Do I need data recovery services or computer forensics?

If you intend to use restored data as evidence in a court of law — or if there’s even a slight chance that you may do so — you need computer forensics services. 

It’s in your best interest to tell data recovery engineers about this possibility as early as possible. Here’s why:

• Computer forensics engineers maintain a chain of custody (a report that shows how media was handled, who handled the media, and other key details). Without a complete chain of custody report, you may not be able to demonstrate the integrity of your evidence.
• Computer forensics requires a distinct set of tools. Forensic engineers will need to use the appropriate tools to find key information (such as when a file was edited or opened, which users edited the file, and so on).
• If the target data is potentially illegal, appropriate engineers will need to be assigned to the case. Appropriate precautions will need to be taken to handle the data in an ethical, legal manner.
• Precautions will also need to be taken to protect the evidence while it remains in the engineer’s custody. Without those precautions, the evidence may not be admissible in court. 
• Forensic engineers can provide an accurate timeline for the case. This can be essential information for your legal team.
  

Because it requires extensive specialization, computer forensics is usually more expensive than standard data recovery. However, if you need to present information as evidence, you need forensics and eDiscovery services — standard data recovery is not an option. 

Related: Computer Forensics: What Is It, and How Is It Used?

Researching Computer Forensics Providers: Key Questions

When researching computer forensics, we recommend asking questions:

• Does the forensic specialist use industry-standard tools and software? 
• Does the forensic specialist have relevant experience, and have they ever testified in court? 
• If the company uses proprietary software for forensics and discovery, has the software been accepted by courts as admissible? 
• Does the firm have appropriate outfitting for performing data recovery services when necessary, including certified cleanrooms and firmware repair tools? 
• Does the firm have appropriate controls for maintaining privacy/security compliance when handling the data?

Computer Forensics and Data Recovery Services from Datarecovery.com

Datarecovery.com maintains full-service laboratories at each of our listed locations. Whether you need data recovery, computer forensics, data sanitization, or other related services, we’re dedicated to providing expert resources to meet your needs. 

To learn more about our data recovery and forensic services, schedule a risk-free evaluation online or call 1-800-237-4200 to speak with a specialist.

The post Data Recovery and Computer Forensics: What’s The Difference? appeared first on Datarecovery.com.

According to the Identity Theft Resource Center, the number of data breaches jumped 68 percent in 2021 — setting a new record with a total of 1,862 events.

To IT security experts, the numbers aren’t surprising. Bad actors use extremely sophisticated methods to target sensitive data, and malicious attacks have become a prominent concern over the past several years for both government and private entities.

In order to respond to a data leak, organizations should start with a careful assessment of the leaked data and the attack vectors that compromised your system. Here’s a quick guide.

1. Audit to determine the extent of the data leak.

When data breaches occur, it’s imperative to identify whether personally identifiable information (PII) was compromised — and if so, to what extent.

Some breaches don’t expose PII to bad actors, but unfortunately, that’s not always the case. Stolen information often ends up on the dark web, available for purchase to identity thieves. Your data leak response plan should include a thorough audit of dark web resources to determine whether your company’s data is directly available. Auditing the breach can also identify the attack vectors used to compromise the data.

Regular audits are helpful even if your company hasn’t identified an active leak. Unfortunately, the vast majority of companies do not detect data breaches until the leak has been identified by third-party sources (such as news reports or law enforcement notifications). According to a report from Mandiant Consulting, the average time between the initial data leak to discovery is about 146 days.

Datarecovery.com can help your organization identify breaches by using proprietary methods to search for data on the internet and the dark web. Contact our forensic experts at 1-800-237-4200 or click here to request more information.

2. Follow your state’s reporting laws for significant data breaches.

All 50 states require entities to notify affected individuals of the unauthorized acquisition of PII. In most states, notifications must be sent within a reasonable time frame — usually 30-60 days.

Check your state’s data breach notification laws after fully auditing your breach. Depending on the nature of the stolen data, you may face significant civil penalties for failing to report the issue.

3. Create a data leak response plan.

In addition to auditing and reporting the data breach, your organization will need to form a full response plan before returning to business as normal. Some quick tips for developing a strategy:

• Designate responsibilities and set clear goal outcomes. Include managers, technicians, business partners, your legal team, forensic experts, and any other individuals who will play a role in addressing the breach.
• Identify the compromised systems and set a timeline for restoration of service.
• Engage in penetration testing (or pen testing). Pen testing services attempt to infiltrate your system using common vectors of attack. Datarecovery.com offers pen testing with remediation guidance for enterprise-level systems.

Don’t access the affected systems until you’ve fully audited the breach. To ensure an accurate forensic analysis, do not turn the systems off or attempt to address the issue without expert guidance.

4. Work with forensic experts from day one.

Data breaches can harm your brand, and responding to a leak can be expensive. Forensic experts can help you control the price of the project by accurately identifying weaknesses in your security controls and protocols.

Datarecovery.com offers essential resources for finding leaks, improving storage redundancy, and creating long-term strategies for security maintenance and disaster recovery. We work closely with your team to ensure that the threat is accurately identified, contained, and addressed — improving business outcomes and reducing your future risks.

From data leak monitoring to threat identification and penetration testing, Datarecovery.com can help your organization form a response plan. Learn more by contacting our team at 1-800-237-4200.

The post Data Leak Response: 4 Tactics for Reducing Risks appeared first on Datarecovery.com.

From its early beginnings in legal investigations to its contemporary uses across a whole slew of industries, computer forensics is a truly fascinating science worth exploring further.

What Is Computer Forensics?

Also known as computer forensic science or simply cyber forensics, computer forensics deals with the uncovering of evidence exclusively from digital sources. Whether it’s a hard drive, a digital camera, a cell phone, or the microphone on an Alexa, computer forensics allows investigators to scrutinize digital media like a detective would do at a real-life crime scene in search of anything that can be used to identify, recover, preserve, or analyze evidence.

That might sound pretty complex, so let’s put things in simpler terms: computer forensics is like a crime scene investigation, a police search, and a private investigation all rolled into one uniform science. It takes great skill and immense knowledge to yield effective results in the world of computer forensics, but when done correctly, the evidence found can make or break a case.

With that being said, computer forensics is not exclusive to criminal proceedings: often, computer forensics can be utilized during civil investigations, as well. From corporate audits to divorce cases to simply recovering important documents that may have been intentionally deleted or hidden, it appears that the computer forensics industry contains all sorts of multitudes.

How Is Computer Forensics Used?

It’s clearer now what this computer forensic science actually is and what the goals of computer forensics are, but how exactly can this process actually be admissible in courtroom proceedings or trusted as fact in other various scenarios?

When computer forensics experts first emerged on the scene in the mid-1980s, it almost goes without saying that the legitimacy of their science was doubted somewhat. The sheer scope of what computers were beginning to do could barely be comprehended, let alone using them to actually uncover virtual evidence for use in the real world. But, as computer crimes became more and more common as the ‘80s gave way to the ‘90s, it was obvious that computer forensics was not just legit, but an essential part of the investigative process from that point forward.

To understand how this came to be, it’s worth examining the actual process of computer forensics through these most commonly used techniques:

• Steganography: Believe it or not, steganography is the process of hiding key data within an image or file in an attempt to hide it in plain sight. Thus begins the computer forensics version of Where’s Waldo: the scientist then dives deep into the hash of the edited file in question and compares it to the hash of the original image or file to find the difference.

• Live analysis: This technique requires the computer forensic scientist to enter a device through its operating system and use custom or pre-existing tools within the OS to find and extract evidence.

• Deleted file recovery: This is exactly what it sounds like — investigative scientists, through the use of special software, reconstruct deleted files and data from the device’s physical discs. As it turns out, “deleted” doesn’t always mean gone forever.

• Stochastic forensics: Through the investigation of stochastic — or randomly determined — properties on a device, computer forensic scientists can look at the device’s activity and determine which activities are missing key digital artifacts.

• Cross-drive analysis: This technique, which is one of the newer forms of computer forensics, involves parsing through multiple hard drives and correlating the information found on each individual drive in search of any anomalies or inconsistencies.

Examples of Computer Forensics in the Real World

It’s one thing to read about what computer forensics is and how it’s used, but it’s something else entirely to see examples of how computer forensics has been used in both high-profile investigations and real-world scenarios throughout the years. These examples are only a handful of the most notable — in reality, computer forensic science is constantly shifting and evolving to meet the ever-changing technological advances as they come.

The Investigation of Dr. Conrad Murray Following the Death of Michael Jackson

In the wake of music icon Michael Jackson’s surprising death in 2009, computer forensics helped to uncover digital evidence on the computer of the singer’s doctor, Conrad Murray, that documented the lethal doses of propofol administered to Jackson. Investigators were then able to use these documents in their case against Murray.

The Gathering of Evidence for Divorce and Family Law Cases

During custody battles and divorce proceedings, many find that computer forensics yields useful results through the uncovering of key financial information and troubling social media posts. Computer forensic scientists have successfully found important tax and property documents that go on to change the course of these kinds of cases.

The Use of Computer Forensics in Corporate Espionage

It’s not uncommon to find corporations and industries who utilize computer forensics to uncover information from their professional rivals in hopes of gaining the upper hand. Whether it’s used to get insight on a competitor’s upcoming projects or products in an attempt to join the competition or simply to know what’s going on behind the rival’s closed doors, corporate espionage relies on computer forensics to get the job done.

With only a few decades under its belt, you can bet computer forensics will continue to impact our daily lives for centuries to come. Wherever the industry goes in the coming years, it’s sure to be just as revolutionary as the years that have preceded today. With each new technological revolution, a similar revolution in computer forensics is destined to follow.

The post Computer Forensics: What Is It, and How Is It Used? appeared first on Datarecovery.com.

The leaked information came from a MySQL database, and many of the fields are fairly self-explanatory. “eye_color,” for instance, gives the user’s eye color (as input by the user when signing up for an Ashley Madison profile). For many accounts, some fields are left blank.

Credit card information is stored in a separate area, and most hackers will not be able to definitively link usernames with payment information. Furthermore, the leak did not contain complete credit card numbers, so payment information should be safe; even so, we would advise Ashley Madison users to contact their card providers and request a re-issued credit or debit card.

The Ashley Madison database contains the following fields—

Table: aminno_member_email

Table: member_details

Table: member_login

Table: am_am_member

This is a complete list of all of the fields in the MySQL portion of the database. However, several of the fields use numerical codes to indicate a selection from the user. “profile_relationship” specifies the relationship status of the user as follows:

1: “Attached Female Seeking Male”
2: “Attached Male Seeking Female”
3: “Single Male Seeking Female”
4: “Single Female Seeking Male”
5: “Male Seeking Male”
6: “Female Seeking Female”

The “pref_opento” field contains a number that correlates to one of the following:

1: “Threesome”
3: “Being Dominant/Master”
4: “Being Submissive/Slave”
6: “Bondage”
7: “Conventional Sex”
11: “Fetishes”
14: “Nothing Kinky”
15: “One-Night Stands”
17: “Role Playing”
18: “Sex Talk”
19: “Spanking”
21: “Experimenting with Tantric Sex”
22: “Transvestitism”
23: “Experimenting with Sex Toys”
23: “Exploring with Sex Toys”
26: “Aggressiveness”
27: “Blindfolding”
28: “Bubble Bath for 2”
29: “Cuddling & Hugging”
30: “Curious – Domination”
31: “Curious – Submission”
32: “Dressing Up/Lingerie”
33: “Erotic Movies”
34: “Erotic Tickling”
36: “Extended Foreplay/Teasing”
37: “Gentleness”
38: “Good With Your Hands”
39: “Kissing”
40: “Light Kinky Fun”
41: “Likes to be Watched/Exhibitionism”
42: “Likes to Give Oral Sex”
43: “Likes to Receive Oral Sex”
44: “Likes to Go Slow”
45: “Lots of Stamina”
46: “Open to Experimentation”
48: “Sensual Massage”
49: “Sharing Fantasies”
50: “Someone I Can Teach”
51: “Someone Who Can Teach Me”
52: “You Like to Cross Dress”

The “looking for” section also contains a number that correlates to the following:

1: “A Don Juan”
4: “Sense of Humor”
6: “Aggressive/Take Charge Nature”
9: “Average Sex Drive”
10: “Confidence”
11: “Discretion/Secrecy”
12: “Dislikes Routine”
14: “Good Personal Hygiene”
16: “Has a Secret Love Nest”
17: “High Sex Drive”
18: “Imagination”
19: “Likes Routine”
30: “A Professional/Well Groomed”
31: “Stylish/Classy”
32: “Casual Jeans/T-shirt Type”
33: “Tattoos”
34: “Body Piercing”
35: “BBW”
36: “Full Size Body”
37: “Muscular/Fit Body”
38: “Petite Figure”
39: “Slim to Average Body”
40: “Tall Height”
41: “Short Height”
42: “Long Hair”
43: “Short Hair”
44: “Girl Next Door”
45: “Naughty Girl”
46: “Bad Boy”
47: “Boy Next Door”
48: “Creative and Adventurous”
49: “Relaxed and Easy Going”
50: “Hopeless Romantic”
51: “A Father Figure”
52: “Not Possessive”
53: “A Good Listener”
54: “Good Communicator”
55: “Disease Free”
56: “Drug Free”
57: “Casual/Social Drinker”
58: “Seeking a Sugar Baby”
59: “Seeking a Sugar Daddy”
60: “Natural Breasts”
61: “Facial Hair”
62: “Tall, Dark and Handsome”

Datarecovery.com offers computer forensics services, which can help to verify the presence (or non-presence) of an individual’s information in the Ashley Madison leak. Given the nature of this leak, we offer this service exclusively to victims — not to spouses or other individuals. For more information, speak with a computer forensics expert by calling 1-800-237-4200.

The post The Ashley Madison Leak: What Information Was Released? appeared first on Datarecovery.com.

“This is one of the most significant Internet security breaches in history”

Hackers began releasing the Ashley Madison data to torrent websites and the Dark Web (hidden networks that require specialized software to access) in late July, starting with more than 10 gigabytes of stolen data. Last week, another 20 gigabytes of data was released. The files contain personal information for millions of users.

The leaks have garnered significant media attention because of the unique nature of the Ashley Madison website, which markets its services towards people in committed relationships who want to start affairs. According to multiple sources, the released information has led to divorces and other serious consequences for some users.

“It’s a major breach of privacy, and users need to know whether or not they were affected,” said Ben Carmitchel, President of Datarecovery.com. “We’re offering the first computer forensics service specifically geared towards the victims of this type of data security breach.”

The computer forensics experts at Datarecovery.com can independently verify if an individual’s information was released, and to what extent. Customers can request information by using first and last name, email address and other personally identifiable information. The service is only available to primary users of hacked websites — not their spouses or other individuals.

While several websites have been set up to search through the leaked data, Ashley Madison has quickly taken them down by issuing Digital Millennial Copyright Act (DMCA) notices. Many of the remaining sites only search through some of the leaked data, and all sites ask for users’ email addresses, opening up additional security concerns.

“This is one of the most significant Internet security breaches in history,” said Carmitchel. “Our service is intended to help the affected users protect their sensitive data and retain some degree of privacy.”

Datarecovery.com is a worldwide leader in computer forensics and data recovery services. With four locations in California, Illinois, Arizona, and Toronto, the company provides a variety of services to thousands of clients each year. Visit datarecovery.com for more information.

Contacts

Datarecovery.com, Inc.
Benjamin Carmitchel, CEO
602-635-2020
ben.carmitchel@datarecovery.com

The post Datarecovery.com Offers Simple Way to Verify Ashley Madison Leaks appeared first on Datarecovery.com.

We’re also called upon to recover text messages as evidence for court cases and other legal processes, and cell phone recovery is one of the fastest-growing segments of our business. In this article, I’ll detail some of the methods that we use to recover text messages from damaged cell phones. Some of these techniques are also used for other types of data associated with smartphones.

Getting Access to the Data On a Damaged Cell Phone

Of course, if someone’s calling Datarecovery.com, there’s a good chance that their cell phone has been damaged (either intentionally or accidentally). In order to start recovering text messages, we need to get access to the data on the phone, and that can be a difficult process.

Engineers use advanced tools and techniques to recover data from the device in wide ranging types of failures and damage. Depending on the damage, sometimes we can restore the device to a temporary functioning state to access the data somewhat natively (meaning that we can just plug in the phone and read the data as the manufacturer intended).

However, if there’s a severe underlying problem, the actual data may be damaged. Crippling damage to text message data may occur not only through physical or electrical means, but also through overwriting due to deletion, corruption, operating system updates, or factory resets. When native access is not an option, we’ll do whatever it takes to obtain a data image and work from there. Many repair techniques necessitate an ISO 5 cleanroom and other expensive equipment, so we’ll avoid a lengthy discussion of those methods for now.

Where are Text Messages Stored on a Modern Cell Phone?

Text messages are generally stored in smartphones in an SQLite database. This is true across various manufacturers, but unfortunately for our engineers, the database type is where the similarities end.

Each different cell phone model will typically have a different database schema, or table structure, in which it stores text message data. Now, commercial software tools exist that can help recover text message data from functioning SQLite databases — but options are slim when there is damage to the database.

To obtain as many text messages as possible from a damaged phone, we work with the raw data image and we use special software (developed in house) along with some manual data evaluation and analysis.

The first step is determining the definition of the database table containing the messages. This process will include deciphering how each of the components of a text message record are stored, including associated phone numbers, service center number, timestamps, and the message body.

The Text Message Record and Cell Phone Message Recovery

The second step includes the identification of a text message record. There can even be more than one format to account for. After we have a grip on this, we need to write the definition so that our recovery program will be able to identify message records, and interpret the various components correctly from raw data.

The identification of a text message record is crucial because in the uncertainty of raw data, defining the method used to find text messages will determine whether all the text messages are recovered; if the text message record is improperly defined, a significant number of messages may be missed.

We are extremely careful to ensure that our methods will not miss any potentially valuable text message, including damaged partial message records. We do this by using the lowest possible minimum requirements for identification in our algorithm while still ensuring that there are few false positives.

We then perform rigorous testing, performing numerous checks on known text message data areas we’ve discovered in separate analysis. Finally, after we’ve run our software, we complete a final comparison check between the text messages extracted and the text messages known in raw data. This allows our engineers to make sure that they have everything.

I need to stress that this thorough process and custom software solution really separates our service from the hardware and software products available commercially, and also from other forensic companies and law enforcement agencies that use them. We certainly have many commercial hardware/software products available in our laboratories, and we use them when appropriate.

However, our process allows us to recover more than any commercial product when required by the situation; by using a combination manual techniques and tailored software processing, we can perform a much more thorough text message recovery than any individual software or hardware tool. In a recent case, the best commercial software was able to find 2,098 text messages, while we recovered 3,756 valid messages – 79% more. I think this shows the value of experience; if you have a cellphone and need to recover missing text messages and other mobile data, you can be assured that Datarecovery.com will give you the best possible result.

For more information on our cell phone related services visit this page, or call us at 1.800.237.4200.

The post A Guide to Mobile Phone Text Message Recovery appeared first on Datarecovery.com.

On September 18th, McAtee crashed his car into Dillon Reservoir in Summit County, Colorado. McAtee is bipolar and stopped taking his medication prior to his erratic behavior. Although he was briefly taken into protective custody, he was released and has been missing since September 19th.

His family believes that he headed on foot into the Summit County wilderness area to camp, or that he began hitchhiking on Interstate 70. “We now are wanting to expand our search to the west,” explained Steve McAtee, Jack’s father. “There’s a good possibility that he could’ve just gotten on the highway and hitchhiked west. Jack previously spent some time in California and we are hoping that he may have headed out to the Placerville or the Mendocino, California area.”

Believing that the laptop computer could contain information vital to the investigation, the McAtee family contacted Datarecovery.com for assistance. Datarecovery.com provided its services free of charge.

“When a computer hard drive is fully submerged in dirty water for days or weeks, it’s important to attempt data recovery as soon as possible in order to limit damage from corrosion,” said Ben Carmitchel, President of Datarecovery.com. “We received the hard drive several weeks after the incident, which complicated the recovery. By using highly advanced methods, we were able to fully recover Mr. McAtee’s data.”

The process required specialized treatment in a Class 5 clean room at Datarecovery.com’s laboratory in Phoenix, Arizona. Datarecovery.com engineers provided investigators with key information from the computer, including the Internet browser history. This information has provided critical clues to Jack’s whereabouts, including plans he made prior to his disappearance.

“We’re asking our customers to spread the word about this case,” said Carmitchel. “We want to see Jack McAtee come home safely, and we stand with the McAtee family during this difficult time.”

Jack’s father, Steve McAtee, has offered $10,000 for their son’s safe return. Information about Jack, including pictures and up-to-date investigation information, is available at http://www.findjackmcatee.com. When he was last seen, Jack McAtee was wearing a maroon hooded sweatshirt with brown moccasins and blue jeans. He is 5 feet, 10 inches tall and weighs about 170 pounds. Individuals with information related to Jack’s whereabouts should call (970) 453-2232 or (970) 668-8600.

Datarecovery.com, Inc. is a world leader in data recovery and computer forensics. With four locations in California, Illinois, Arizona, and Toronto, the company provides a variety of services to thousands of clients each year.

Contact Information

Datarecovery.com, Inc.
Ben Carmitchel
1-602-635-2020
datarecovery.com

The post Datarecovery.com, Inc. Recovers Data from Sunken Laptop to Assist in Jack McAtee Missing Persons Case appeared first on Datarecovery.com.