Deleted, Formatted, Failed and Physically Damaged Media

Forensic Data Recovery From Deleted, Damaged and Failed Media

Deleted files, a formatted volume, a drive that clicks, a phone that will not power on, an array with two failed members. Global Digital Forensics recovers what the media still holds and documents the source, so the result holds up as evidence instead of a restored folder nobody can explain.

Get a Free Consultation Call (800) 868-8189

Bagged hard drive beside a forensic write blocker.

Examiners Who Know Where the Data Physically Sits

Forensic data recovery has been part of the practice since GDF was founded in 1992. Our training curriculum teaches disk and file system storage, FAT and NTFS structures and recovery from slack and unallocated space by hand before any vendor tool is introduced, because an examiner who knows where the data sits can explain why it came back. Our founder Joseph Caruso holds the CISSP and the Certified Forensic Examiner credential and has trained in EnCase Enterprise, AccessData and open source forensic tools. Robert Knudsen, CISSP and Certified Computer Examiner, has conducted hundreds of computer and mobile device examinations supporting federal and state court matters.

When the failure is physical, the examiner has to be at home on the bench. Veronica Perez, our Senior Computer Forensic Specialist, trained with Teel Technologies in JTAG, chip off, in system programming and embedded hardware analysis, completed iPadRehab microsoldering training in 2024 and has built her own utilities for processing mobile data. That is the skill set a dead phone or an embedded board demands once the ordinary acquisition path is gone.

Every recovery follows NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response: acquisition comes before recovery, and the original is never the working copy.

If the media has already been through a repair utility or a recovery shop, tell us on the first call, because it changes the plan. Call (800) 868-8189 before the next attempt.

Recovery methods and what each depends on

Match the Method to the Failure Before Anything Runs

Recovery depends first on what actually failed. Deleted files and a damaged file system call for a different path than a clicking drive, an intermittent controller, liquid exposure or a flash device whose controller has stopped answering, and the wrong first step on an unstable drive can turn a recoverable case into a lost one. We record the symptoms and the condition of the source before choosing a method, because every power cycle and repair attempt changes what remains.

Routine repair utilities write to the source and overwrite the metadata that explains what happened to the data and when. Our work starts from a verified forensic image whenever the media can be acquired, and reconstruction and file carving run on working copies, never the device itself. That discipline is what lets the recovered data serve as evidence afterward.

What Recovery Depends On Across Drives, Flash and Arrays

For logical damage we rebuild partitions, file systems and database containers where the structure supports it. Unstable media gets controlled imaging with documented retries, timeouts and a map of unreadable sectors. On SSDs and flash storage, the controller’s address translation, wear leveling and block reclamation shape both the method and the odds, and a deleted file on a modern SSD may already be gone at the hardware level before anyone asks for it.

Hard drives with unreadable sectors or unstable heads get a handling assessment before imaging, and the outcome turns on how much of the platter surface can still be read.

SSDs, memory cards and USB flash devices are assessed against controller behavior and storage state, and the outcome turns on whether the controller still responds and whether reclaimed blocks have been erased.

RAID, NAS and server storage need the configuration and the member relationships understood before reconstruction, and the outcome turns on how many members survive and the order in which they failed.

Deleted partitions, formatted volumes and damaged file systems are examined for recoverable structure and content, and the outcome turns on how much has been written to the volume since.

Virtual disks, snapshots, backups and database containers often preserve content or earlier states the primary device has lost, and they are frequently the fastest route to the data.

Describe the devices and the deadline and the first call sets the plan.

Bench Work Here, Clean Room Work at a Named Laboratory

Some failures need a controlled environment, donor components or board level methods, whether that means a head swap on a mechanical drive or chip off work on a phone or embedded device. When a confirmed specialist laboratory performs part of that work, we document who handled the source, what changed and which stage produced each image, so custody runs unbroken through the specialist’s hands and into our analysis.

Every Recovered File Is Checked Before Delivery

A recovered file name is not a recovered file. We check each item for readability, internal consistency and available metadata, keep directory structure, timestamps and application relationships where the source supports them, and list partially reconstructed items and unreadable areas in an exception record so nothing disappears quietly from the report.

Delivery keeps the acquired source, the recovered content and any interpretation apart. Where the method supports it you receive verified images, a file inventory, the exception record, timelines and a technical report written for business, insurance or legal review.

Tell us what happened and when, and a senior examiner will say which sources to secure first.

Methodology

Recovery and Examination Run as One Engagement

Assess the source and the goal

The files or records you need, the disputed activity, the dates, the people and the readers of the report, defined before any acquisition.
Preserve the best available copy

The source condition recorded, the media imaged with hash verification and custody documentation, unreadable areas mapped and every change noted.
Recover and examine

Structure and content rebuilt from the working copy, each item validated and the records correlated against the timeline the matter cares about.
Report what came back

Recovered content, observation and interpretation kept distinct, with the validation written up so another qualified examiner can assess it.

Evidence commonly examined

Storage and Evidence We Examine

Computers, drives, phones and removable media are the original sources, and forensic images and verified working copies carry the material through reconstruction and analysis. Operating system and application records help interpret recovered content and the activity around it.

Account, network and cloud records can add independent context or a second copy of the data, backups, snapshots and recovery media can hold what the primary device has lost, and custody records follow the source through every hand it passed.

What you can expect

Ask an examiner how this applies to your matter; the first consultation is free.

Recovered Data and the Validation Record

The acquisition and condition record identifies the source, the methods, any changes and the material obtained, and the file inventory lists recovered content, acquisition coverage and unreadable exceptions.

Technical findings explain the recovered material and its validation, and agreed reports, declarations and testimony take the evidence and the methods to the legal team, the insurer or the board.

Talk Through the Failure Before Another Attempt

Tell us the storage, the symptoms, what has been tried and the deadline. A senior examiner will tell you the next step and what it depends on, and will check conflicts and relevant experience before any engagement. The first consultation is free.

Review the examiners and their qualifications to see who would handle the media and sign the validation record, and read the Rogers v. BNSF Railway case study to see forensic work on system records carried to a jury.

Get a Free Consultation

Frequently asked

Forensic Data Recovery Questions We Hear Most

What should we define before the work begins?

The storage media, the failure symptoms, any recovery attempts already made and whether the source may become evidence in a dispute or a claim. Those four facts decide the method, the odds and how much documentation the engagement needs.

What should we provide for the first discussion?

The question, the sources, the relevant dates and the deadline. Keep the originals intact and powered off exactly as they are, and we arrange a secure transfer method for the media when we speak.

How do you judge whether the data can be recovered?

The outcome depends on what failed, how much has been overwritten or erased since, whether the controller or the platters can still be read and what earlier attempts changed. We assess the source, give you the realistic prospects and agree a stopping point before the work begins.

Can we review the examiner’s qualifications?

Yes. Ask for a current CV, the relevant experience and availability. Conflicts and any expert testimony requirements are cleared before engagement, and the examiner who performs the recovery is the examiner who explains it.

Free consultation

Describe the Media and the Failure

On the first call a senior examiner asks what failed, what has been tried and what you need back, tells you whether to keep the device powered down, and recommends bench work, a specialist clean room laboratory named in the proposal or a backup route, with the likely timing.

Recovery work since 1992, and a 24/7 hotline for media that cannot wait.

GDF does not accept pro se litigation cases, and GDF may decline matrimonial or family law cases at our discretion.

Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed November 3, 2026.