Hello,
I am considering starting up a small business working from home, mainly focusing on recovering data from personal hard drives (home pictures, movies etc…)
I already work in forensics, and am familiar with most tools/software. At work we use Logicube Talons & Dossiers, as well as the Tableau TD1's. We use Encase, FTK and Autopsy for analysis as well.
What would you recommend as a home 'starter pack'? I have a fairly decent PC for number-crunching already. Would you stick to open-source tools for a home business to cut down on overheads spent on licenses?
I wouldn't be recovering any data for use evidentially in court. I would primarily be targeting home users who've accidentally deleted all their baby photos for example.
I am UK-based. Does anyone have any idea of going rates? Would you charge per MB/GB recovered, or an hourly rate? I always thought an hourly rate might be difficult to prove, but if you presented someone with 100GB of recovered data, that would be easy to charge for.
The business would be a second income as I already have a full-time job. I figured working from home I could set my hours to make sure they didn't conflict with my full-time employer.
Any pointers would be much appreciated.
Many thanks,
Mark
I've been running a one-man shop out of my home for a few years and here's my short list of suggestions
1. Purchase a second (and third, once you've earned some money) PC. You don't want to have your only machine tied up trying to recover data from a damaged hard drive. One case took me 3 weeks to recover a 40Gb drive using ddrescue.
2. One of the computers should be portable. You will occasionally need to perform field work.
3. By all means use open-source.
4. But once some MORE money comes in, consider buying FTK. EnCase seems rather unnecessary and is waaaay too expensive for the private practitioner starting out.
5. "I wouldn't be recovering any data for use evidentially in court…." Don't be so certain of that. You never know where or when a simple "recovery job" may turn into a legal matter. ("Indecent images," anyone?)
6. Pricing for recovery-only should be less than for true forensics. The problem is you'll run into folks who "simply MUST have those photos back!" but they turn pale when you quote them 250 USD or 150 GBP (numbers used for sample purposes only and are not meant to suggest actual rates). Suddenly, they don't need those pictures that badly. (
Best wishes in your new venture!
Greetings,
FTK and EnCase are fairly close in price these days. If you want the most bang for your buck, get X-Ways. The tool choice will depend on what you're trying to accomplish and how technically minded you are as X-Ways is more of a technician's tool than the other too.
There are some very good open source tools that, for data recovery, will work as well as X-Ways, FTK, or EnCase.
-David
Hello,
Thanks for the pointers. Here's what I have so far
1. 3 laptops. 1 is an Apple MacBook Pro running VMWare, the other 2 are running Windows (XP and Vista).
2. Helix 3 Pro. I got a licensed copy to use when I attended a recent SANS course (508). I also have a copy of the SIFT workstation from SANS that includes all the open-source tools like Autopsy etc…
3. Write-blocker adaptors for hard discs.
4. 2TB storage array for disc images.
I'll see a lawyer friend about drafting up some kind of contract/policy to state that the discovery of indecent images will immediately involve the police. But then I guess you have to clearly define 'indecent'.
I have started emailing nearby companies who do data recovery for their rates. With it not being true forensics I have to quote a fair price. I was thinking of a £50 charge to examine the disc, and maybe £5/GB thereafter. No data recovered means no fee too.
I have my girlfriend designing flyers to post through peoples' doors, and I'll maybe take out a small ad in the local paper. I know there are no people/companies within a 15 mile radius of me providing this service, which means this might be quite a good opportunity.
Any other pointers/tips you can think of?
Many thanks,
Mark
Greetings,
Five British pounds is about eight US dollars so you're proposing charging $8000 for a 1TB drive?
Drive Savers, in the US, has a nearly flat rate of $1,500 per drive, any size. They have an amazing facility, years of experience, and a very good record.
I think you might want to check out your competition's prices and set yours appropriately.
You also might want to consider setting your prices low initially to get a customer base and some experience. You already have most of your equipment and you also have your living expenses covered by your day job so you don't need to make a living off of this business initially.
-David
Kovar,
That's a good point regarding the pricing but I think I might have worded it wrongly.
I was looking at charging per GB recovered. So, for example, I recovered 5GB of pictures/video files for the client, then that would be £25 + the £50 initial examination fee.
I'm primarily looking for my target market to be home-users, those computer users whose hard drive fails and they have no back up. From some initial research I have done, these people are generally concerned with just retrieving their personal data, not necessarily the entire drive.
I guess if a client approached me and asked me to recover 1TB of data, I'd have to reassess the charges (and maybe provide some advice on suitable backup procedures too!)
Maybe I should try a sliding scale for fees.
£2/GB up to 100GB = £200
£1.50/GB up to 500GB = £750 max
£1/GB up to 1000GB = £1000 max
It's difficult, but I am currently looking into the competitions pricing, as I plan to be cheaper!
Mark
Greetings,
Ahh, ok, that makes more sense.
Some other random thoughts to toss out
1) Advertise on Craigslist and accept media via FedEx/UPS.
2) Factor in the cost of the media required to return the results.
3) Insurance?
4) Some sort of release form. You don't want to send back a damaged drive and have the client say "Hey, you damaged by drive! It was working when I sent it to you!"
5) Look at ddrescue and dd_rescue. SpinWrite, too. PhotoRec.
6) "Indecent images" should be clearly defined in the UK code somewhere. "Any images deemed indecent per section XXX of the UK Code YYYY." (I'm not a lawyer….)
7) Start small. Do some work for friends. Figure out your real costs in time, equipment, media, etc. That'll help you set your rates.
-David
I paid $250 for a 160GB drive. That is on the high end for many mail-in solution. I suggest you research your competition.
Although FTK and EnCase are excellent at what they do, in my opinion for recovery there are better suited products out there.
I would also get a specialized freezer, and at least a small collapsible clean box to be able to take apart HDDs.
To be blunt, in my opinion you must first find a strong answer to a question the general consumer will ask.
Why would I give my drive to Mark, who is a one-man-shop in a garage (even if you aren't that will be the perception, unless you spend money to prove otherwise), instead of Fedex it to a large specialty place with clean rooms, guys in white labcoats and masks, with fancy blinky light stuff all over the place? ?
I paid $250 for a 160GB drive. That is on the high end for many mail-in solution. I suggest you research your competition.
Although FTK and EnCase are excellent at what they do, in my opinion for recovery there are better suited products out there.
I would also get a specialized freezer, and at least a small collapsible clean box to be able to take apart HDDs.
To be blunt, in my opinion you must first find a strong answer to a question the general consumer will ask.
Why would I give my drive to Mark, who is a one-man-shop in a garage (even if you aren't that will be the perception, unless you spend money to prove otherwise), instead of Fedex it to a large specialty place with clean rooms, guys in white labcoats and masks, with fancy blinky light stuff all over the place? ?
Hi )
can you provide some more informations about "clean boxes" ? can you link to something? i'm really interested in such stuff.
Hi Mark, If you propose using a sliding scale, using your method you could spend a few days imaging a 1TB drive and maybe only recover 2GB. That means you will earn yourself £2 for maybe 3 days work.
Better to have a fixed base fee with a sliding fee on top according to data recovered.
Say £50 initially plus £1 per GB recovered on a 1TB drive. At least this way you'll earn £52. Still not much for so much work though.