Slashdot Mirror

This is actually good area to research for everyday organizations that are not about to be on the receiving end of a police raid. The reason is simple, the most common disaster (not failure) that strikes most servers is the legal subpoena. Can your business survive a legal subpoena that would take a large portion of your data?

This is not an idle consideration, it's actually a very common consideration. Places like OnTrack do far more business recovering data for legal services like subpoenas than they do with disk failures. You usually get a certain amount of time (couple weeks or so) to respond to a subpoena with the requested data. If you don't get the request filled in time, or if the other side convinces the judge you might mess with the data they will simply seize your servers / data by court order?

Can you survive this? If you can survive this scenario, than chances are you can recover from just about any other reasonable disaster you might encounter. The pirate bay scenario is one that should be studied from a disaster recovery standpoint, regardless of your stance on piracy.

The overall trend of the judiciary seems to be moving toward greater permissiveness for e-discovery with regard to social media, as well as a strong likelihood that privacy concerns will be outweighed by the weight and relevance of the information.

Interesting read here too, seems the courts don't always agree.

SpinRite is the tool I'd try to use recover from more serious errors, especially from really old drives.
2nd on GetDataBack - have had success with it too.

If the drive doesn't spin and the data is worth over $2000, try Kroll Ontrack. Physical drive surgery is expensive, but sometimes works on what you'd think was impossible.

Yes, e.g. Ontrack since 2008

Ok, I took at look here at the sort of data loss they work with. They mention logical failures and mechanical failures. They don't mention deliberate overwriting. Everything on this page discusses just how hard it is to find the bit you're looking for, and how Ontrack has all sorts of expertise in coaxing the drive to do what they asked to at least get something out of it.

So far I haven't seen anything to suggest they can recover deliberately overwritten data. In fact, their data analysis page says:

Although electronic evidence is especially fragile - prone to erasure, destruction and tampering

Everything on the site points to being able to recover files that are inaccessible either due to drive failure (including mechanical damage) or being deleted without being overwritten. If you can find somewhere where they claim that they can recover overwritten data (as opposed to merely inaccessible data), I'd love to see it. Otherwise, you haven't disproved the notion that recovering overwritten data on a modern drive is an urban legend.

What services?
Data Recovery, and many other things. (you asked)

Where?
Minneapolis, Minnesota (data recovery services headquarters)

What is their name?
Kroll Ontrack http://www.krollontrack.com/

Google for the columbia disaster for an example of their work.

Here in Minneapolis Minnesota, the data recovery services Kroll Ontrack http://www.krollontrack.com/ are headquartered here. Their company does a lot of different things other then data recovery, but their data recovery services DO cost an assload of money.

When the shuttle columbia burned up, NASA recovered some 6gb or something seagate drives and they brought them to kroll and were able to pull a 90+% recovery rate off those drives. I don't have a source on this, but im sure a simple google search would find it.

However the above wasn't data that was overwritten, just burned and partially melted. Also as for your questions, it widely depends on a multitude of factors. Sometimes you can pull most all of it, and sometimes you just can't.

Same thing us farm types wonder about. Along with "day off". What the hell is THAT, and where do I get one??

BTW more for your work... if you don't already know about it, Kroll/Ontrack has several useful newsletters re the intersection of law and computer technology. http://www.krollontrack.com/newsletters/

Case Law Update & E-Discovery News
Ontrack Inview User News
Computer Forensics & Cyber Crime News

(You can get them delivered in plaintext, which is nice.)