Elena, you co-founded ReclaiMe; could you tell us a bit about what made you decide to start the company?
Data recovery is our family business. Initially my sister and her husband were involved in data recovery. Then I became a part of the team. If someone long ago had said that I would do this, I would probably have laughed. However, at this point I associate myself only with this business. No wonder they say that life is unpredictable.
What does your day to day role entail? Which aspects do you find the most challenging, and the most rewarding?
Every working day starts with the support. Basically it includes some routine questions, like differences in licenses, software activation, and so on. However, sometimes we face the complex cases that cannot be resolved quickly.Typically, data recovery technicians bring us such recovery cases and we are very grateful to them, because it allows us to improve algorithms in our tools, so that our tools could work where others cannot. Another kind of day-to-day work is developing new data recovery algorithms. Frankly speaking, I cannot remember even a single day when we did not think about something new. Microsoft has released ReFS and Storage Spaces and we do recover data from them. NETGEAR started to use BTRFS instead of EXT and now we are able to extract data from it too. Every week something new happens and we have to adapt to keep up.
Briefly tell us about the software ReclaiMe creates – what specific challenges faced by digital forensics professionals are you looking to address?
We all know data recovery and computer forensics are closely related to each other; that’s why often our customers are police departments and e-discovery companies. Computer forensics software aims to extract and analyze information from healthy, or slightly damaged filesystems. On the contrary, ReclaiMe software is designed to recover data even from severely damaged filesystems. More than that, at the moment data recovery from some filesystems and partitioning schemes is possible only with ReclaiMe.
Also I would like to mention our pride – RAID and NAS recovery and the fact that ReclaiMe software supports almost all common RAID types and operates with various NAS devices. The forensic toolkit as it is applied to the traditional storage, that is, to hard drives rather than to mobile phones, works best if the data deletion or other sort of destruction was not attempted. However, it is easy and quick to ruin the filesystem, after which data recovery software becomes your best choice because it is specifically designed to work with a ruined filesystem. While forensic software developers had their practice to sift through data, we had our practice to extract that data, and forensic software often stops short of what can really be recovered.
You've recently released ReclaiMe Pro, a data recovery toolkit. What exactly does it do, and what are the main features which set it apart from similar forensic tools?
The idea of creating ReclaiMe Pro arose when data recovery technicians came to ask us to implement some features in the end-user ReclaiMe, to give them the ability to do custom settings. However, this is completely contrary to the end-user expectations which can be described in the single sentence “No setting buttons”. So especially for experts we released ReclaiMe Pro, where they can customize everything they want. If we talk about the distinctive features we are very proud of built-in RAID analysis – content and entropy, using which you can get a lot of information about the RAID you need to recover data from. Throw in a good imager, close to the best one can achieve in software.
What current trends are of interest to you in digital forensics, and what new challenges do you envisage in the future?
As for the difficulties, in my opinion, these are the growing volume of stored data and the increasing complexity of methods of storing data. Recently, we have worked with the 250 GB devices and were quite pleased. Now we can go to the electronic store and buy a 6 TB disk. Since the speed has not grown in proportion, the analysis time has increased. This is also true for the methods of storing data – we know NTFS from A to Z, as well as all other data recovery vendors. However, in recent years new filesystems come on the market. For example, just a couple of years ago BTRFS was only for geeks, but today it can be found in devices sold by thousands of pieces on the mass-market.
Unfortunately, I think that the life of data recovery and forensic experts will get harder and harder, but at the same time, we will not get bored.
What does the future hold for ReclaiMe specifically? What can we expect to see over the next few years?
I can assure you that ReclaiMe does not stand still, we are constantly developing something new. For example, we have just completed the implementation of algorithms for BTRFS recovery in our software. We promise that ReclaiMe will always keep up with the times. When they invent new filesystems, new partitioning schemes, we will still learn to recover data from them.
Finally, what do you do to relax when you're not working?
I have a very big family and we often get together for dinner or to go somewhere, like cinema or theater. Also, we love to spend holidays together in hot countries – the more the merrier.
And of course, sometimes I want to be alone, for example, in the company of a good book.
