Data recovery is carried out on two levels: logical and physical.

Logical readout allows you to read the data in the device memory. In some cases, the applied solutions will also enable the recovery of deleted data. The final report contains the data decoded into a readable format. Depending on the operating system / phone model / the report includes:
- contacts, - connections, - SMS / MMS messages, - photos / from the thumbs area containing information about deleted photos /, - video files, - calendar, - history of visited websites,
The report is prepared in an editable form, enabling the separation of data of interest to the Principal and the preparation of the final report in any format / pdf, html, xlslx /. Net cost of the service PLN 480.

Physical reading allows access to the entire memory area of the phone, data deleted or partially overwritten. The hardware and technical solutions used enable access to deleted data, which will be decoded to a readable format. The report includes ALL correctly decoded data. There are four methods of accessing:

Basic method / PLN 480 net / PLN 960 net for models with an encrypted user partition for which we have technological capabilities / - the use of hardware and technical solutions allowing access to the entire EMMC memory area. The phone must be functional.

Invasive method / 960 net / - the use of solutions that allow access to data directly from the EMMC memory chip. The technology does not damage the phone. It allows you to bypass the screen lock / multi-character, graphic or fingerprint password /.

Invasive method CHIP OFF / 960 PLN net / - desoldering the EMMC memory chip and reading data directly from it. It can be used for devices protected by a user password, damaged or flooded.

Invasive method NAND (1700-1950 PLN net) - allows you to recover data directly from the NAND memory, bypassing the controller. The use of such a hardware and technical solution allows for the recovery of data from media which, due to controller damage, are not recognizable by workstations.

The use of a selected invasive method in relation to mobile phones allows, in justified cases, to reveal more data than using the classic reading method.

Logical damage / PLN 480 net / - the device must be recognizable by the workstation. Recovery consists in restoring data structures or searching the memory for file headers.

Physical damage / PLN 1700-1950 net / - the method used allows to recover data directly from the NAND memory, bypassing the controller. The use of such a hardware and technical solution enables the recovery of data from media, which, as a result of damage to the controller, are not recognizable by workstations.

1: 1 copy - secured with a checksum (MD5, SHA) - in the case of functional disks, it is possible to perform the so-called a sub-sector copy in order to protect the condition of the medium's content. The copied medium is connected through a write blocker that prevents changing any sectors.
Price
Data copying to 2TB
PLN 360 net
Copying data over 2TB
PLN 540 net
Copying data over 5TB
PLN 720 net

Logical damages * - deleted data recovery, disk by format, data recovery from raw disk, etc. - / PLN 360-1440 net /

* SSDs cannot have TRIMM function

Damage to electronics - In the event of a failure of this type, in the vast majority of cases, it is possible to rebuild the damaged electronics. The carrier with a damaged electronics board, after connecting the power supply, is completely dead, the engine does not start, and the drive does not make any sounds indicating its operation - / from PLN 360 net - HDD drives, from PLN 960 - SSDs /

Service area faults - covers all cases in which the carrier firmware blocks access to the user data area. In order to restore access to information, it is usually possible to unblock this access by "rebuilding" the most important modules of the service zone / PLN 1200-1450 net /

Mechanical damage - related to physical defects of the carriers and most often concerns disks after a fall. We have the necessary knowledge, experience and a professionally equipped laboratory to work effectively with this type of cases. A laminar chamber, i.e. dust-free, allows the replacement of damaged elements in a sterile environment without the risk of further degradation of components. / from 960 PLN net /

* analysis in standard mode free of charge (for disks without prior interference) - standard mode means max. 3 working days from the moment the carrier is delivered to the laboratory. Analysis and cost of recovery for RAID arrays - determined individually.

Occasionally, in the case of the most serious mechanical failure of the drives, it is not possible to recover the file structure 100%. The methods used by our laboratory allow, however, to gain access to at least some of the data important from the customer's point of view. This most often applies to cases resulting from:

Deliberate damage to the surface of the discs - If not all discs are damaged, it is possible to make an attempt to read those surfaces that are intact. The recovered data will not include the 100% media content, however, it is often possible to search for the content in terms of file headers (so-called GREP entries)

Exposure of the disk to high temperatures - We have experience in working with disks that have survived a fire. For the effectiveness of the process, it is important that the temperature that affects the disk does not exceed the so-called Curie point - this is the temperature at which the ferromagnetic material loses its magnetic properties.

Our experts have extensive knowledge of RAID data storage technology. Thanks to this, we are able to successfully recover data from both old and newest RAID configurations available on the market. We provide our clients with free consultations regarding data loss from RAID, NAS, SAN disks and servers, among others in order to confirm the type and configuration of the device, virtual system, provide guidance on preparation for analysis and data recovery in the laboratory.

Typically, a RAID failure is caused by a component (hard drive or controller) malfunction. Other factors can be application and operating system errors, causing data to be read incorrectly or inaccessible. Improper action or inept attempts to restore data may cause irreparable losses.

Format, reinstall or overwrite the disk. These are the most common causes of data loss due to human fault. Our specialized tools allow you to rebuild the virtual RAID array, mask new data and repair the original volumes.

Single drives in RAID systems, like other hard drives, are prone to failure. If one of the disks in a RAID configuration fails, the remaining disks are exposed to considerable load. The situation is particularly critical in the case of the matrix reconstruction process, when the activity of writing and reading files is most intensified.

The valuation of the analysis for RAID, NAS and SAN arrays depends on the number of disks used, their type and the system on which the array was based. The cost of the data recovery service is determined on a case-by-case basis.

The data deletion service is aimed primarily at those who value confidentiality or are obliged to protect data. Any change in the destination of the medium or its disposal is fraught with the problem of data left on it.
Deleting data by formatting the disk from the system level does not guarantee permanent data deletion, and leaving them carries the risk of intercepting confidential information.

Hardware erase - used before the disposal of carriers and based on a strong impact of a strong magnetic field on the carrier using a certified Degausser device. The magnetic field generated by this device irretrievably removes all data stored on the magnetic medium (hard disk, floppy disks, etc.) while destroying it to such a degree that it is not possible to use it further / from PLN 110 net, for wholesale quantities individual valuation /

Software erasing - erasing data consisting in multi-cycle, cross-sectoral data storage on the medium. It is supposed to overwrite the data on it, which will make it impossible to recover them later. Specialists use appropriate software that allows you to maintain the efficiency of the carrier after the data deletion process - / from PLN 180 net for individual carriers, individual valuation for wholesale quantities /

We also offer physical utilization of carriers by grinding in specialized machines. After disposal, we issue an appropriate certificate confirming the service / PLN 12 net per item /

Computer forensics is nothing more than obtaining, delivering and securing evidence materials as part of the analysis of the content of digital data carriers, which can be an effective supplement to traditional methods of collecting evidence materials.
The search and analysis of digital material concerns all kinds of electronic data carriers, such as computer hard drives, SSD drives installed in more and more devices, memory cards, pendrives, telephones and smartphones. Computer forensics also includes the analysis of network traffic, visited websites or activity on websites.
The process of obtaining electronic evidence begins with identifying the problem. The carrier is secured at our headquarters or directly at the customer's. A binary copy of the memory is created to protect against data loss and modification of records. Depending on the problem, the information on the medium is filtered and searched, or first recovered, if previously lost or deleted. It is at this stage that the investigative analysis is carried out, completed with an expert opinion reporting on the evidence obtained.
Reports prepared by experts in the field of computer forensics may be used in particular in:
Civil cases - pursuing claims, divorce, alimony, child custody, infringement of copyright,
Economic matters and all kinds of abuses - unfair competition, employee disloyalty, breach of the prohibition of competition, industrial espionage, data theft, disclosure of business secrets,
Criminal cases - in order to gather evidence to prove guilt or to support the adopted line of defense.
Each of the analyzes carried out is a process supported by the assurance of data security, covering both the issues of physical security and the confidentiality of the stored and recovered data. We apply special measures to maintain confidentiality and ensure the security of the material stored during the analysis.
Years of experience and regular deepening of knowledge about new technologies, as well as raising competences based on international training allow MIP DATA & FORENSIC to meet almost every order entrusted.

Computer forensics covers a wide range of activities. Below we present examples of activities that can be carried out:

Free substantive consultations in the field of computer forensics
Direct support during procedural activities
Type of equipment to be secured
Securing evidence material
Securing evidence using Live Forensic methods
Initial data verification (application of the Triage method)
White Interview - OSINT (Open Source INTelligence)
Analysis and verification of collected materials
Generating the final report
Analysis of monitoring records
Deleted data recovery
Final report
Research on mobile devices
Device content analysis, e.g. spyware detection
Generating and drawing up a report based on the conducted analysis.
Data decryption
Analysis of data on digital information carriers
Presentation of disclosed digital evidence for the purposes of pre-trial and court proceedings
Data recovery from digital data carriers, both functional and physically damaged, e.g. after flooding, breaking, bruising, etc.
HDDs, SSDs
RAID arrays
Telephones, Smartphones, Tablets
SD, micro SD cards
Other digital media

In the above-mentioned scope, we have presented the general possibilities of Computer Forensics. However, in accordance with the company's policy, we treat each inquiry individually. Before starting work, the experts of the computer forensic laboratory, first of all, ask for the provision of necessary information enabling the selection of appropriate methods of operation and the selection of appropriate equipment and technical solutions necessary for the proper execution of the order. Only after the initial analysis of the obtained information is made, forecasts about the possibilities of obtaining information, the time needed to complete the order and develop an expert opinion, as well as the cost estimate of the operation / from PLN 2,200 net /