Analysed Storage Media and Systems

Scenarios in Which Data May Be Recovered

• Accidental deletion of files
• Formatting of a disk or partition
• File system corruption
• Loss of disk partitions
• Database corruption
• Incorrect updates or configuration changes
• User or administrator errors
• Deletion or modification of data as a result of a cyberattack

Data Recovery Process

Analysis and Recovery Activities

At the initial stage of the recovery process, the technical condition of the storage medium and the extent to which the data has been preserved are assessed. A copy or disk image of the device is then created to prevent further damage, and the main analysis is performed using this copy.

During the analysis, the file system structure, deleted partitions, directories, file metadata, and damaged data fragments are examined. Specialised software, hardware and software tools, and recovery methods are used to identify and restore files that can be recovered.

Activities Performed Upon Completion of the Service

• The possibility of data recovery is assessed
• Data is recovered using a bit-by-bit copy or disk image of the device
• Recovered data is transferred to a separate secure storage medium
• The condition and integrity of the recovered files are verified