Forensic Data RecoveryDigital forensics is one of the fastest growing fields in the digital world.  At one time computers were an afterthought when it came to criminal investigations.  However we are now in the digital age.  People’s cell phones, tablets, TV’s, and yes their computers are all an integral part of life.  And in a criminal investigation, they are often the key to proving where someone was or wasn’t when a crime happens.  However, when it comes to gathering and analyzing this digital evidence, it’s very easy to get the evidence disqualified and thrown out of court.

One specific time when this is a real challenge is when data recovery is required.  In a perfect world, digital media would always be fully functional and you could get a 100% clone of it with full HASH to prove that the evidence wasn’t tampered with.  However what happens when the media isn’t functioning at all?  Or is partially destroyed…

Forensic Data Recovery

Greg and Sheila have partnered up with a company in Cranston, RI called Data Medics (their website is here). This company is able to handle just about any type of failed media at affordable prices.  Most investigations still assume on the prices of ten years ago when data recovery always cost thousands of dollars.  However nowadays there are qualified professionals who’ve broken out of the extreme pricing game and offer their services at reasonable rates.  Usually just $300-800 for most typical hard drive failure cases.  By using such affordable quality service, we’re able to markup the price and turn a profit on that part of the investigation.

Whatever data recovery firm you decide to use for handling the hardware recovery end, be sure they have the capabilities to provide a forensic image which can work in Encase or other software.  Hardware tools such as PC-3000, used by most professional labs, should be able to generate these forensically sound images which meet with courtroom standards for evidence.  Remember that a partially cloned image directly onto another hard drive will have a different hash, and may be thrown out of court even if the data wasn’t altered in any way and the destination drive was originally blank.  A sector that is all zeros because it wasn’t read from the source is still data as far as the law is concerned.  So be smart and request the forensic image files, which will check out.

Greg & Sheila Forensics


Let me take a moment to introduce ourselves.  I’m Greg and my wife is Sheila.  We are both retired forensic investigators who now focus on training.  My wife Sheila specialized in fingerprint analysis and comparison techniques, and has made a career out of teaching her practices to forensic professionals around the globe.  My focus early on was chemical analysis, however for the last ten years of my career I’ve focused on digital forensics and cryptography.

This is our personal blog where we’ll be posting interesting topics related to our careers and teaching in forensics.  If you have a question for us, please visit the Contact Greg & Sheila tab and submit the form.  We’ll do our best to answer your forensic questions, but please be patient as we aren’t getting paid for this.  Think of us as more like the DMV than the fire department.  “We’ll get to it when we get to it”.

Welcome to our blog, hope you enjoy, and feel free to leave a comment below.

P.S. This picture isn’t actually us.  We’re much better looking in real life, but given the number of cases we’ve helped to solve we can’t risk posting our real likenesses online.