When a drive fails during active litigation or an eDiscovery preservation order, the recovered data needs to hold up in court. That means write-blocked imaging from the first power-on, documented chain of custody throughout the process, and no modification to the source media at any point.
Forensic data recovery differs from standard recovery in one key area: the source media must remain provably unmodified. Every step in our forensic workflow is designed to preserve the evidentiary value of the data.
Hardware write-blockers (Tableau/CRU) or PC-3000 built-in write protection prevent any modification to source media during imaging.
Timestamped documentation covering intake, handling, procedures performed, and return. Supports admissibility in civil and criminal proceedings.
Media stays in our Austin lab from receipt to return. No outsourcing, no subcontractors, no third-party handling.
Chain of custody documentation and write-blocked imaging are included at no extra charge. If we recover nothing, you pay $0.
Before any diagnostic or imaging begins, the drive is connected through a hardware write-blocker. For drives requiring firmware repair or head replacement, our PC-3000 operates in a read-only mode that prevents any writes to the drive's service area or user data zone. This is the same approach used by law enforcement forensic labs, and it produces the same result: a bit-for-bit image of the source media with the original unmodified.
Our chain of custody record captures: the date and time the media was received, the physical condition on arrival (photos of damage, serial number, model number), every person who handled the media, each procedure performed with timestamps, the imaging hash (SHA-256) of the completed forensic image, and the date and method of return to the client. This record is provided as a signed PDF alongside the recovered data.
After imaging, we generate SHA-256 hashes of both the source media and the recovered image. These hashes confirm that the image is a faithful copy of the source. The hash values are included in the chain of custody documentation and can be independently verified by opposing counsel or a court-appointed expert.
A terminated employee's workstation drive fails before IT can image it. The drive contains emails, documents, and browser history relevant to a wrongful termination or trade secret claim. We recover the data with full chain of custody, preserving its admissibility.
A departing employee formatted a company laptop before returning it. The drive may still contain evidence of IP transfer. We image the drive write-blocked, recover deleted files from unallocated space, and document the entire process for litigation support.
A company's accounting server RAID array fails during an audit or insurance investigation. Financial records on the failed drives are needed to support or contest the claim. We recover the RAID array with forensic-grade documentation.
A deceased person's computer contains the only copy of a will, financial accounts, or digital assets. The drive may be encrypted, password-protected, or physically failed. Executors and estate attorneys need the data recovered with documentation suitable for probate court.
Note for attorneys: We recover data from failed media. We are not a digital forensics investigation firm. If you need keyword searching, email threading, Relativity processing, or expert testimony, we can provide the recovered data set to your forensic examiner or eDiscovery vendor for analysis.
Forensic recovery uses the same pricing as all other recoveries. Write-blocked imaging and chain of custody documentation are included at no additional cost.
Your drive works, you just need the data moved off it
$100
3-5 business days
Functional drive; data transfer to new media
Rush available: +$100
Your drive isn't recognized by your computer, but it's not making unusual sounds
From $250
2-4 weeks
File system corruption. Accessible with professional recovery software but not by the OS
Starting price; final depends on complexity
Your drive is completely inaccessible. It may be detected but shows the wrong size or won't respond
$600–$900
3-6 weeks
Firmware corruption: ROM, modules, or translator tables corrupted; requires PC-3000 terminal access
CMR drive: $600. SMR drive: $900.
Your drive is clicking, beeping, or won't spin. The internal read/write heads have failed
$1,200–$1,500
4-8 weeks
Head stack assembly failure. Transplanting heads from a matching donor drive on a clean bench
50% deposit required. CMR: $1,200-$1,500 + donor. SMR: $1,500 + donor.
50% deposit required
Your drive was dropped, has visible damage, or a head crash scraped the platters
$2,000
4-8 weeks
Platter scoring or contamination. Requires platter cleaning and head swap
50% deposit required. Donor parts are consumed in the repair. Most difficult recovery type.
50% deposit required
Our "no data, no fee" policy applies to hardware recovery. We do not bill for unsuccessful physical repairs. If we replace a hard drive read/write head assembly or repair a liquid-damaged logic board to a bootable state, the hardware repair is complete and standard rates apply. If data remains inaccessible due to user-configured software locks, a forgotten passcode, or a remote wipe command, the physical repair is still billable. We cannot bypass user encryption or activation locks.
No data, no fee. Free evaluation and firm quote before any paid work. Full guarantee details. Head swap and surface damage require a 50% deposit because donor parts are consumed in the attempt.
Rush fee: +$100 rush fee to move to the front of the queue.
Donor drives: Donor drives are matching drives used for parts. Typical donor cost: $50–$150 for common drives, $200–$400 for rare or high-capacity models. We source the cheapest compatible donor available.
Target drive: The destination drive we copy recovered data onto. You can supply your own or we provide one at cost plus a small markup. For larger capacities (8TB, 10TB, 16TB and above), target drives cost $400+ extra. All prices are plus applicable tax.
Describe the drive failure and any litigation or eDiscovery requirements. We will confirm the forensic handling protocol before you ship.
