When a drive fails during active litigation or an eDiscovery preservation order, the recovered data needs to hold up in court. That means write-blocked imaging from the first power-on, documented chain of custody throughout the process, and no modification to the source media at any point.
Forensic data recovery differs from standard recovery in one key area: the source media must remain provably unmodified. Every step in our forensic workflow is designed to preserve the evidentiary value of the data.
Hardware write-blockers (Tableau/CRU) or PC-3000 built-in write protection prevent any modification to source media during imaging.
Timestamped documentation covering intake, handling, procedures performed, and return. Supports admissibility in civil and criminal proceedings.
Media stays in our Austin lab from receipt to return. No outsourcing, no subcontractors, no third-party handling.
Chain of custody documentation and write-blocked imaging are included at no extra charge. If we recover nothing, you pay $0.
Before any diagnostic or imaging begins, the drive is connected through a hardware write-blocker. For drives requiring firmware repair or head replacement, our PC-3000 operates in a read-only mode that prevents any writes to the drive's service area or user data zone. This is the same approach used by law enforcement forensic labs, and it produces the same result: a bit-for-bit image of the source media with the original unmodified.
Our chain of custody record captures: the date and time the media was received, the physical condition on arrival (photos of damage, serial number, model number), every person who handled the media, each procedure performed with timestamps, the imaging hash (SHA-256) of the completed forensic image, and the date and method of return to the client. This record is provided as a signed PDF alongside the recovered data.
After imaging, we generate SHA-256 hashes of both the source media and the recovered image. These hashes confirm that the image is a faithful copy of the source. The hash values are included in the chain of custody documentation and can be independently verified by opposing counsel or a court-appointed expert.
A terminated employee's workstation drive fails before IT can image it. The drive contains emails, documents, and browser history relevant to a wrongful termination or trade secret claim. We recover the data with full chain of custody, preserving its admissibility.
A departing employee formatted a company laptop before returning it. The drive may still contain evidence of IP transfer. We image the drive write-blocked, recover deleted files from unallocated space, and document the entire process for litigation support.
A company's accounting server RAID array fails during an audit or insurance investigation. Financial records on the failed drives are needed to support or contest the claim. We recover the RAID array with forensic-grade documentation.
A deceased person's computer contains the only copy of a will, financial accounts, or digital assets. The drive may be encrypted, password-protected, or physically failed. Executors and estate attorneys need the data recovered with documentation suitable for probate court.
Note for attorneys: We recover data from failed media. We are not a digital forensics investigation firm. If you need keyword searching, email threading, Relativity processing, or expert testimony, we can provide the recovered data set to your forensic examiner or eDiscovery vendor for analysis.
Forensic recovery uses the same pricing as all other recoveries. Write-blocked imaging and chain of custody documentation are included at no additional cost.
| Service Tier | Price | Description |
|---|---|---|
| Simple CopyLow complexity | $100 | Your drive works, you just need the data moved off it Functional drive; data transfer to new media Rush available: +$100 |
| File System RecoveryLow complexity | From $250 | Your drive isn't recognized by your computer, but it's not making unusual sounds File system corruption. Accessible with professional recovery software but not by the OS Starting price; final depends on complexity |
| Firmware RepairMedium complexity – PC-3000 required | $600–$900 | Your drive is completely inaccessible. It may be detected but shows the wrong size or won't respond Firmware corruption: ROM, modules, or translator tables corrupted; requires PC-3000 terminal access Standard drives at lower end; high-density drives at higher end |
| Head SwapHigh complexity – clean bench surgery50% deposit | $1,200–$1,500 | Your drive is clicking, beeping, or won't spin. The internal read/write heads have failed Head stack assembly failure. Transplanting heads from a matching donor drive on a clean bench 50% deposit required. Donor parts are consumed in the repair |
| Surface / Platter DamageHigh complexity – clean bench surgery50% deposit | $2,000 | Your drive was dropped, has visible damage, or a head crash scraped the platters Platter scoring or contamination. Requires platter cleaning and head swap 50% deposit required. Donor parts are consumed in the repair. Most difficult recovery type. |
Our "no data, no fee" policy applies to hardware recovery. We do not bill for unsuccessful physical repairs. If we replace a hard drive read/write head assembly or repair a liquid-damaged logic board to a bootable state, the hardware repair is complete and standard rates apply. If data remains inaccessible due to user-configured software locks, a forgotten passcode, or a remote wipe command, the physical repair is still billable. We cannot bypass user encryption or activation locks.
All tiers: Free evaluation and firm quote before any paid work. No data, no fee on simple copy, file system, and firmware tiers. Head swap and surface damage require a 50% deposit because donor parts are consumed in the attempt.
Target drive: The destination drive we copy recovered data onto. You can supply your own or we provide one at cost. For ultra-high-capacity drives (20TB and above), the target drive costs approximately $400+ due to the large media required. All prices are plus applicable tax.
Describe the drive failure and any litigation or eDiscovery requirements. We will confirm the forensic handling protocol before you ship.
