Data Recovery Services
The Scan Professional Services team provides a range of services for data recovery from the following devices:
Hard Disk Drives
Solid State Drives
USB Drives
Memory Cards
Digital Cameras
CCTV
Mobile Devices
Media Devices
Data Recovery Types
There are two options for data recovery – either simply deleted data, or damaged data. Deleted Data recovery addresses accidental or malicious deletion of data where normal deletion process has occurred - this includes the use of file wiping software. The price for data recovery is only chargeable if recovery is successful. Damaged Data Recovery is where standard data recovery is not possible and in cases where there may be corruption or there is physical damage to the hard drive. The price plus the cost of donor hard drive is only chargeable if the recovery is successful.
Computer Forensic Examination
Should you have a requirement in your business, the Scan Professional Services team has the ability to forensically examine your computers to help in situations where you may need to attribute evidence to specific suspects, confirm alibis or statements, determine intent, identify sources (for example, in copyright cases), or authenticate documents. Everybody involved in Scan Professional Security Training is a specialist in their own field, having gained that experience through a law enforcement, military, intelligence or specialist career – read our consultant biography page here.
The first step is to take an image (copy) of the machines to be examined - this can be done in one of two ways:
| Image Type | Description |
|---|---|
| Forensic Imaging - Lab Acquisition | In order to preserve the integrity of the investigation we will always take a forensically sound image of the hard disk drive. We then conduct our investigation on the imaged data. This ensures that the original data is not altered in any way. |
| Forensic Imaging - Onsite Acquisition | We can also carry out the imaging service onsite at your business premises, however should this be the cost is based on daily rate of £1850, with a minimum of half a day. The amount of time required will be dependent on the size of hard drive, speed of imaged hardware, network speed, and network load. However, more than one computer or laptop can be imaged simultaneously. |
Data Recovery Approaches
Once our team have imaged the devices, there are several approaches we can take:
| Recovery Type | Description |
|---|---|
| Internet Activity | Examination of live and deleted internet history which may include: • Searches • Websites accessed • Web based email activity • Social Network activity • Downloaded file information • Online file storage activity • Online chat communication including, Skype, Facebook Chat, Messenger etc. |
| Keyword Searching | Keyword searching and review to identify specific dates/terms, names and/or phrases and where they appear on the device. The results will be presented on suitable external media. |
| Client Based Email and Documents | Extraction and review of live and deleted email communication (stored on the device) Recovery and examination of all Word documents, PDF’s, spreadsheets, presentation files and other commonly used formats. To include live and easily recoverable deleted data and will be presented on suitable external media |
| In-depth Investigation | Full examination of a computer based item which includes all of the above options and Expert Witness report |
| Additional Services | Any requirement that is not covered in the above options will be charged at an hourly rate – to be estimated after consultation. Examples would include: • Malware investigation • Provision of an Expert Witness report • Tribunal/court attendance • Live Web Based Email Investigation • Open Source/Background investigations • Cell Site investigation • Data removal/disposal |
Secure Data Preservation (ePreserve)
If there is a suspicion that something is untoward this service provides the opportunity to take a forensically sound copy of that data and to store it in case it is required for investigation in the future. This service can be achieved covertly. The unit cost is based on lab acquisition of the forensic image, followed by storage in a secure evidence storage facility, free of charge up to 6 months.
Incident Response
Responding to a security breach in a timely fashion is highly important, however it is the understanding of what happened, how it occurred and perhaps most critically why it occurred, that allows a security team to prevent similar incidents from being repeated. Unfortunately, most standard IT professionals are unable to effectively respond to a security alert and so the Scan Incident Response team is on hand to help investigate and resolve computer security incidents such as when unauthorised entities gain access to computing or network services, equipment or data. Using digital forensics, our team seeks to answer somewhat different questions than just where the malware came from and how it got there. What is more relevant is determining where the infiltrator went, what they did, and if they took anything after they hacked into the network in the first place. The goal is to understand details of what happened -- when, how, and why -- to prevent a similar intrusion in the future.
Incident Imaging
| Image Type | Description |
|---|---|
| Lab Based - Forensic Imaging | Forensic imaging (lab based) to secure and preserve data in a forensically sound manner, in accordance with UK and international forensic practices (no analysis) |
| On Site Units - Forensic Imaging | Forensic imaging (on site units) to secure and preserve data in a forensically sound manner, in accordance with UK and international forensic practices (no analysis) |
Forensic Readiness Planning
Forensic Readiness Planning is the process of preparing to deal with a digital forensic response before an incident occurs. It comprises a set of simple steps and procedures which maximise the chances of a successful outcome when a data investigation is required.
It focuses on roles and responsibilities of various internal teams from IT to HR and Legal, as well as establishing relationships with external suppliers prior to them being needed. It sets out a clear plan for everyone to follow that is pre-agreed and signed off by senior management. This plan covers everything from initial discovery through to how to deal with external media organisations to minimise reputational loss.
