PC data recovery hardware or sofware ?

Here's another option for some heads tools http//www.drivestar.biz/index.php?main_page=product_info&cPath=66_104_214&products_id=5214

Two notes, if I may

Plan on at least a 5-10 year learning curve during which time most of your profit may be going to pay for remote support to a skilled professional.
And, that's assuming you're a really smart guy or have some really smart guys working for you. Many people just wash out of this business in the first year of two when they realize how over their heads they are (and when they realize it's not all profit despite being a business where you can charge a fairly high price tag).

While I concur that it is a never ending learning story, maybe 5-10 years to get started is a tad bit on the pessimistic side, it's not - after all - rocket science or brain surgery and not even violin making.

Then, if you want to actually get any clients, you'll need a powerful website with amazing SEO work done to it on a regular basis. This business has become crazy competitive online and to even compete in your local market will be tough when you see what you're facing for national competition for keywords. You'll need a strong advertising budget, possibly sales staff and support staff to allow the technician(s) undisturbed working time.

A few humble requests for all people putting together a data/hard disk recovery service site
1) please DO NOT use "stock photos" on your site, make some real photos of your real work environment, and of real people actually doing actual work, instead.
2) if you do not have a "white chamber" (and I know you haven't one) do not publicize one, if you have only a laminar flow hood, state so.
3) if you (or your personnel) actually use white coats, surgical masks , and hairnets, photos of people in white coats, mask and hairnets are OK, otherwise get rid of them (they are stock photos anyway see #1)
4) data recovery is not (even if sometimes it is wink ) "witchcraft" nor "edge experimental medicine", do not make it look like it is.

Jared did something IMHO very good with this article ) (I would personally promote it from "old blog post" to one of the "main" pages of the site)

https://www.data-medics.com/data-recovery-blog/inside-of-a-data-recovery-laboratory/

(though he still has a few stock photos with white coats, masks and hairnets on his site, I presume they were *needed* to visually impact the new visitors )

jaclaz

Jared did something IMHO very good with this article ) (I would personally promote it from "old blog post" to one of the "main" pages of the site)

https://www.data-medics.com/data-recovery-blog/inside-of-a-data-recovery-laboratory/

(though he still has a few stock photos with white coats, masks and hairnets on his site, I presume they were *needed* to visually impact the new visitors )

jaclaz

Yeah, I'm sure I've got some of those stock photos floating around on my site. The fact is, it's far too time-consuming to put together a lot of your own photographs, and they rarely come out looking as good as the stock ones anyway.

Stock photos are a necessity of real life when you've got a business to run. Some are pretty funny though I'll admit. I really get a laugh out of ones like this

https://www.data-medics.com/forum/download/file.php?id=910&mode=view

Why is he just sitting there staring into that open drive? Is that a Home Depot construction dust mask? Any why is he wearing safety glasses? Is the drive going to fire a projectile at him?haha.

We do actually use some such medical type equipment in our work. I personally run through a box of nice surgical gloves at least once a month. I never use hair nets or a "dust mask" but that's because our clean air benches have plexiglass shields in the front and only our hands ever really go inside the clean chamber. So even the lab coats are unnecessary, though I might have bought one for some old pictures.

I think the biggest reason we (data recovery pros) tend to use those pictures on our sites is to make clear that we do handle the clean room operations ourselves. Even if the pictures don't accurately convey what this looks like in real life. There's so many IT/computer repair shops out there advertising data recovery while just running some cheap software. So you've got to make clear on your site that you actually specialize in this and aren't just another virus removal shop.

Personally, I'd never do data recovery work in a walk-in clean room. It's completely unnecessary, and with a human body in there it can't meet the same ISO standards that our bench-top chambers do. Having talked with owners of other labs that do have walk-in clean rooms, they've admitted it was only a publicity stunt used to convince government bureaucrats why they're better than the competition. And they still use the bench top chambers inside the room anyway because they know that's what's actually needed to keep the air clean enough.

Two notes, if I may

Plan on at least a 5-10 year learning curve during which time most of your profit may be going to pay for remote support to a skilled professional.
And, that's assuming you're a really smart guy or have some really smart guys working for you. Many people just wash out of this business in the first year of two when they realize how over their heads they are (and when they realize it's not all profit despite being a business where you can charge a fairly high price tag).

While I concur that it is a never ending learning story, maybe 5-10 years to get started is a tad bit on the pessimistic side, it's not - after all - rocket science or brain surgery and not even violin making.

I've got to disagree here. I've been doing this professionally since 2011 and I still feel I'm nowhere near the level of understanding that some guys have (mostly Russians and eastern Europeans) that are genius level data recovery engineers. And that's despite the fact that I've performed well over a thousand hardware level recoveries myself. I'm not a dumb guy either. I was hacking AOL servers over telnet when I was in my early teens, so computers are very second nature to me.

You can learn the basics in a few years, but you'll still be constantly running into things you don't understand for years to come.

Keep in mind, data recovery is all reverse engineering. WD, Seagate, Toshiba, Samsung all have teams of hundreds of engineers constantly redesigning HDD functionality. Then, it's up to a few of us data recovery guys along with the help of engineers at Ace Laboratory to figure out what the hell they did and find a way to reverse engineer it to work when it's not supposed to. Compounding the challenge is the fact that some companies, namely Seagate, are actively working to make data recovery impossible for everyone except their own in-house lab.

Even after a life-long career in the business you'll still be constantly learning and researching new problems. I personally feel I've reached near mastery level with some brands of hard drive, such as WD. I've even recovered WD drives that the big name companies like Drive Savers couldn't recover. But, I know that with some other brands I've got a lot of learning to do still. Fortunately, there are other technicians I correspond with on a regular basis who are masters of those models and we help each other out as needed.

That's just discussing the hardware side of the business. Then there's the logical recovery aspect. It'd be great if the whole world was running a simple NTFS formatted single HDD, but that's not the world we live in. What happens when the drive is from a DVR with proprietary file system? What about when it's a RAID array that needs recovering? Or a SAN such as an EMC that's entirely proprietary? Or what happens when it's an encrypted mac partition and the partition table is lost preventing any software from being able to find it? Suddenly, you've got a new huge learning task in front of you if you don't want to outsource it all out and lose the profits.

Just this week, for the first time, I had to handle a Drobo case which had 28Tb of storage in BeyondRAID, a system in which each file effectively stored as it's own RAID array with blocks all over the place and had 4 failed drives. To boot, no commercial software was able to make heads or tails of the configuration. It took a straight week after recovering all the failed drives to make heads or tails of it (would have taken months if not for past experience) and we finally got it recovered. I will say, I now know a lot more about how Drobos work. Maybe I'll be able to use that knowledge again in the future, maybe not.

There's just so many different elements to it, and so little is actually documented or easy to find information on. That's why I'm telling you 5-10 years is not at all pessimistic. That's just to get to the point where you're able to handle the vast majority of cases on your own.

@Jared DM
Yep ) , we are saying the same thing, it is not like when you started your business you were as knowledgeable as you are now (and you are still a bit "behind" some people in the field) but all these years you performed (successfully) those thousands hardware recoveries with only a partial subset of your current knowledge (and learning never ends).
I was only trying not to put too down or scare (too much) the OP, clearly one needs a passion and a dedication to the field, but one needs to start somewhere.

And about the pictures, yep, I know and you know (and most members here would know) but the message (to the general public) remains IMNSHO "deceiving", as "a picture is worth a thousand words".

As said you are one of the few in this business that made such a honest and clear post as the one I linked to, still the "stock" (please read as "fake") photos, *needed* as they might be represent without any doubt a mis-representaion of reality.

jaclaz

I was only trying not to put too down or scare (too much) the OP, clearly one needs a passion and a dedication to the field, but one needs to start somewhere.

I get that. I guess I'm just telling him what I wish someone had told me years ago. I must admit, when I started this venture into this business I had no idea how deep the rabbit hole goes. Or the financial hole it'll burn to really get the ball rolling. If it wasn't for a nice retirement fund I liquidated, I'd have been bankrupt before I ever turned a profit.

Or the financial hole it'll burn to really get the ball rolling. If it wasn't for a nice retirement fund I liquidated, I'd have been bankrupt before I ever turned a profit.

In this OP has probably a big disadvantage (given the mostly "first world" level of prices of the tools compared to his country's income/level of prices).

In the US and EU I believe that anything between - say - US$ 50,000 and US$ 150,000 is what you need to invest to start *any* "individual" artisan activity, like - still say - a small mechanical workshop, an electricity or plumbing maintenance service and similar.

jaclaz

If you think of buying PC-3000, keep in mind that it is not a forensic device. I learned it in a very hard way.

Care to share your "hard way" of learning? PC-3000 does have some forensic type features. For example you can image to an E01 encase file and it'll calculate the necessary checksum so it's ready to import into forensic software after the fact. But, generally no, it's not intended to be a forensic tool.

When forensics guys can't image a drive and end up coming to us, we just do the physical repairs, then image to an Encase file which we provide them. Then it's up to them to do the investigation part on their software afterward.

Ok, i will share one. If you recover files from a hdd, it allocates necessary space on the destination drive, but not as a virtual file system, or an image file. It uses the destination drive as is. So if you have a problematic hdd, which is always the case, and if you can’t export 100% of the files, it uses the destination hard drive’s data in the image it creates. So if you wipe your destination drive for all cases you are fine, if you don’t, well.

You can propose using the “Forensic” imaging method of pc-3000 or wiping the destination hdd at all times but why do it that way? Why not document that? I don’t know. We went back to testing all over. So i hope you got the “hard way”.

First off, wiping destination hard drives between cases should be standard practice. We don't even do forensics generally here, and that's just a standard best practice for security reasons.

Second, there's a checkbox in Data Extractor to wipe unread sectors on the destination. You just have to be sure it's enabled and/or set to be the default imaging option.

Third, if you use image files rather than a HDD as the destination you don't have either of the above two issues. Especially if you're imaging to an Encase image file.

Thank you for the lecture. What i meant was you have to be careful with non-forensic tools.

Yep ) , and I would add as a corollary "you need to be careful with forensic tools too" wink

jaclaz