Forensic Data Recovery
Chain of Custody, Write-Blocked Imaging, Published Pricing
We recover data from physically damaged storage devices while preserving evidence integrity. Every forensic recovery uses hardware write-blocking through our PC-3000 to prevent any modification to the source media. Chain of custody is documented from the moment your device arrives to the moment it ships back.
Evidence Integrity Preserved
Confidentiality
We sign strict NDAs upon request to guarantee client confidentiality. We are not HIPAA certified and do not sign BAAs. If your case requires HIPAA-compliant handling, we will tell you upfront rather than make claims we cannot back. For corporate investigations, litigation support, and HR matters, our NDA process covers the confidentiality requirements most firms need.
Standard vs. Forensic Recovery
| Approach | Goal | Method | Result for Evidence |
|---|---|---|---|
| Standard Recovery | Get the user's files back. | May alter the drive, clearing SMART data or repairing the file system to make it mountable. | Changes the metadata hash, breaking evidence integrity & risking exclusion. |
| Forensic Recovery | Get data while changing nothing on the source media. | Hardware write-blockers via PC-3000, imaged to E01 if requested. | Every step timestamped; the image stays admissible. |
Chain of Custody
Every forensic case follows the same four-step process. Each transition is logged and timestamped.
Intake
Diagnosis
Recovery
Return
Hardware Imaging with PC-3000
A forensic image is made by placing the source drive in a write-blocked state, then reading it bit-for-bit through the PC-3000. Where firmware stabilization is needed, it is performed in volatile RAM and every service-area interaction is documented. The output is a hashed, verifiable copy.
The PC-3000 from ACE Laboratory is the tool used by law enforcement labs and professional data recovery firms worldwide. It communicates directly with the drive's firmware through vendor-specific ATA and SCSI commands, bypassing the operating system entirely.
For forensic cases, the PC-3000 operates in write-blocked mode. The source drive operates in a write-blocked state regarding user data. Necessary firmware stabilization is performed in volatile memory (RAM) where possible, with all service-area interactions documented. The resulting image is a bit-for-bit copy that can be hashed (MD5, SHA-256) and verified against the original media.
Write-Blocked Imaging
Hardware-level write protection prevents any modification to the source drive during the imaging process.
E01 Forensic Format
Expert Witness Format (E01) includes built-in hash verification and case metadata. Available on request alongside raw DD images.
Hash Verification
MD5 and SHA-256 hashes generated at imaging time. Reproducible verification confirms nothing changed between acquisition and analysis.
Raw DD Image vs. E01
A raw DD image is a flat, byte-for-byte dump with nothing wrapped around it. An E01, the Expert Witness Format, carries that same sector data alongside case metadata & the MD5 hash computed the moment the image was acquired. Because that hash lives inside the file, anyone can recompute it later & prove the image hasn't changed since acquisition.
We produce either format. Examiners who plan to present findings in court usually ask for E01, since the embedded hashes carry the integrity proof with the evidence instead of in a separate log.
What We Recover
Damaged Evidence
Recovering data from phones, hard drives, or SSDs that have been smashed, water-damaged, or burned in an attempt to destroy evidence.
Corporate Investigations
HR cases, IP theft, departing employee devices. We image the drive and return it with a documented chain of custody. You provide the drive to your forensic examiner with the evidence integrity intact.
JTAG / Chip-Off
Direct memory extraction for unencrypted flash media and non-Apple mobile devices that cannot be accessed via standard USB/SATA interfaces. Not viable on Apple hardware with Secure Enclave encryption.
Chip-Off vs. Board Repair on Encrypted Devices
Chip-off recovery reads a desoldered NAND chip directly, & it works on unencrypted flash & older non-Apple devices. It fails on modern Apple T2 & M-series machines & hardware-encrypted NVMe drives, where the chip holds only ciphertext. The encryption key stays on the logic board, so the board itself has to be repaired.
Reading a desoldered die isn't as simple as dumping the flash. Even with no AES in play, the controller's proprietary data scrambling & LDPC error correction sit between the raw NAND & readable files. A dedicated NAND reader can pull the physical pages, but without the original controller's translation the output is unintelligible. On simple flash media a NAND chip-off is a real option; on a drive that leans on a live controller it isn't.
On an Apple machine with a T2 or M-series chip, the storage controller & the Secure Enclave that holds the encryption key both sit in the SoC on the logic board. Desolder the NAND & you get ciphertext the key never leaves to decrypt. The forensically sound path is component-level repair of the original board so its native controller & Secure Enclave authorize decryption the way they were designed to.
We don't crack, defeat, or work around the encryption; we bring the original hardware back to a working state. The tradeoffs behind a logic board swap versus board-level recovery decide which Apple cases are recoverable at all.
Board-level repair happens at the soldering station, not a clean bench. We localize a shorted rail under FLIR thermal cameras, reflow or replace controller-side components with a Hakko FM-2032 & Atten 862 hot air, & reball BGA packages on a Zhuo Mao station. The same procedures that revive a laptop logic board bring a hardware-encrypted solid-state drive controller back so it can talk to its own NAND again.
Pricing
Forensic recovery uses the same pricing tiers as standard recovery. The price is based on the physical fault, not the legal context. There is no "forensic surcharge." Write-blocked imaging and chain of custody documentation are included.
HDD recovery ranges from $100–$2,000 across 5 tiers. SSD recovery ranges from $200–$1,500 across 5 tiers. Call (512) 212-9111 for a free estimate.
Hard Drive Recovery
- Low complexity
Simple Copy
Your drive works, you just need the data moved off it
Functional drive; data transfer to new media
Rush available: +$100
$100
3-5 business days
- Low complexity
File System Recovery
Your drive isn't recognized by your computer, but it's not making unusual sounds
File system corruption. Accessible with professional recovery software but not by the OS
Starting price; final depends on complexity
From $250
2-4 weeks
- Medium complexity
Firmware Repair
Your drive is completely inaccessible. It may be detected but shows the wrong size or won't respond
Firmware corruption: ROM, modules, or translator tables corrupted; requires PC-3000 terminal access
CMR drive: $600. SMR drive: $900.
$600–$900
3-6 weeks
- High complexity
Most Common
Head Swap
Your drive is clicking, beeping, or won't spin. The internal read/write heads have failed
Head stack assembly failure. Transplanting heads from a matching donor drive on a clean bench
50% deposit required. CMR: $1,200-$1,500 + donor. SMR: $1,500 + donor.
50% deposit required
$1,200–$1,500
4-8 weeks
- High complexity
Surface / Platter Damage
Your drive was dropped, has visible damage, or a head crash scraped the platters
Platter scoring or contamination. Requires platter cleaning and head swap
50% deposit required. Donor parts are consumed in the repair. Most difficult recovery type.
50% deposit required
$2,000
4-8 weeks
Hardware Repair vs. Software Locks
Our "no data, no fee" policy applies to hardware recovery. We do not bill for unsuccessful physical repairs. If we replace a hard drive read/write head assembly or repair a liquid-damaged logic board to a bootable state, the hardware repair is complete and standard rates apply. If data remains inaccessible due to user-configured software locks, a forgotten passcode, or a remote wipe command, the physical repair is still billable. We cannot bypass user encryption or activation locks.
No data, no fee. Free evaluation and firm quote before any paid work. Full guarantee details. Head swap and surface damage require a 50% deposit because donor parts are consumed in the attempt.
- Rush fee
- +$100 rush fee to move to the front of the queue
- Donor drives
- Donor drives are matching drives used for parts. Typical donor cost: $50–$150 for common drives, $200–$400 for rare or high-capacity models. We source the cheapest compatible donor available.
- Target drive
- The destination drive we copy recovered data onto. You can supply your own or we provide one at cost plus a small markup. For larger capacities (8TB, 10TB, 16TB and above), target drives cost $400+ extra. All prices are plus applicable tax.
The prices above are for standard hard drives, which covers most jobs. Helium-sealed drives (for example WD or HGST Ultrastar He and Seagate Exos X) must be resealed and refilled with helium in-house after the chamber is opened, so they price higher, in the $200–$5,000+ range. See helium drive pricing.
SSD Recovery
Low complexity
Simple Copy
Your drive works, you just need the data moved off it
Functional drive; data transfer to new media
Rush available: +$100
$200
3-5 business days
Low complexity
File System Recovery
Your drive isn't showing up, but it's not physically damaged
File system corruption. Visible to recovery software but not to OS
Starting price; final depends on complexity
From $250
2-4 weeks
Medium complexity
Circuit Board Repair
Your drive won't power on or has shorted components
PCB issues: failed voltage regulators, dead PMICs, shorted capacitors
May require a donor drive (additional cost)
$450–$600
3-6 weeks
Medium complexity
Most Common
Firmware Recovery
Your drive is detected but shows the wrong name, wrong size, or no data
Firmware corruption: ROM, modules, or system files corrupted
Price depends on extent of bad areas in NAND
$600–$900
3-6 weeks
High complexity
PCB / NAND Swap
Your drive's circuit board is severely damaged and requires NAND chip transplant to a donor PCB
NAND swap onto donor PCB. Precision microsoldering and BGA rework required
50% deposit required; donor drive cost additional
50% deposit required
$1,200–$1,500
4-8 weeks
Hardware Repair vs. Software Locks
Our "no data, no fee" policy applies to hardware recovery. We do not bill for unsuccessful physical repairs. If we replace a hard drive read/write head assembly or repair a liquid-damaged logic board to a bootable state, the hardware repair is complete and standard rates apply. If data remains inaccessible due to user-configured software locks, a forgotten passcode, or a remote wipe command, the physical repair is still billable. We cannot bypass user encryption or activation locks.
No data, no fee. Free evaluation and firm quote before any paid work. Full guarantee details. NAND swap requires a 50% deposit because donor parts are consumed in the attempt.
- Rush fee
- +$100 rush fee to move to the front of the queue
- Donor drives
- A donor drive is a matching SSD used for its circuit board. Typical donor cost: $40–$100 for common models, $150–$300 for discontinued or rare controllers.
- Target drive
- The destination drive we copy recovered data onto. You can supply your own or we provide one at cost plus a small markup. All prices are plus applicable tax.
Data Recovery Standards & Verification
Our Austin lab operates on a transparency-first model. We use industry-standard recovery tools, including PC-3000 and DeepSpar, combined with strict environmental controls to maintain drive integrity. This approach allows us to serve clients nationwide with consistent technical standards.
Open-drive work is performed in a ULPA-filtered laminar-flow bench, validated to 0.02 µm particle count, verified using TSI P-Trak instrumentation.
Transparent History
Serving clients nationwide via mail-in service since 2008. Our lead engineer holds PC-3000 and HEX Akademia certifications for hard drive firmware repair and mechanical recovery.
Media Coverage
Our repair work has been covered by The Wall Street Journal and Business Insider, with CBC News reporting on our pricing transparency. Louis Rossmann has testified in Right to Repair hearings in multiple states and founded the Repair Preservation Group.
Aligned Incentives
Our "No Data, No Charge" policy means we assume the risk of the recovery attempt, not the client.
Technical Oversight
Louis Rossmann
Our engineers review all lab protocols to maintain technical accuracy and honest service. Since 2008, his focus has been on clear technical communication and accurate diagnostics rather than sales-driven explanations.
We believe in proving standards rather than just stating them. We use TSI P-Trak instrumentation to verify that clean-air benchmarks are met before any drive is opened.
See our clean bench validation data and particle test videoRelated services
Related Recovery Services
Standard and forensic HDD imaging
Flash storage forensic recovery
Mobile device chip-off extraction
Chain of custody and security protocols
Step-by-step recovery workflow
Attack response and offline imaging
Secure Evidence Recovery
Contact us to discuss your case requirements. NDAs available upon request.