Mares and Company offers a variety of services related to the recovery, protection, and destruction of data files:

• Data Recovery Services
• Password Recovery Services
• Hard drive Imaging
• Data Destruction: Hard drive Wiping

Mares and Company specializes in recovering data from hard disk drives which use Windows operating systems. We handle logical and physical problems such as hard drive failures, computer crashes, file deletions and floppy read errors.

One of the most common data recovery needs is the recovery of deleted files. When a file is deleted, its data is not destroyed. In most cases, this data can be recovered and some or all of the file can be restored. Not all deleted data can be recovered, but as forensic analysts our expertise is in finding recoverable data.

Floppy disks occasionally get damaged and become unreadable. We have access to techniques and programs that can restore data on floppy disks which normal processes can't address. For many reasons hard drives can become unreadable. We can assist with restoring that data also.

Forensic Data Recovery: When your missing data is, or could become involved in a legal matter, you can request that we perform a forensic data recovery. In these cases we conduct all data recovery efforts within a strict forensic protocol that safeguards the evidence and documents fully the evidentiary chain of command. Read more about the forensic retrieval of evidence at Electronic Data Discovery & Evidence Analysis.

Examples of successful recovery situations:

• MS Word files cannot be read on a floppy disk
• Recovery of data from formatted disks
• Database corruption
• Virus infection
• Employee sabotage of files
• Recovery of data from a cut up diskette

Top

If you have lost or forgotten the password you used to protect a document or spreadsheet, we can assist in recovering the password. We also help in special circumstances such as a former employee using password protection in an attempt to deny his employer later access to documents which legitimately belong to the employer.

Password protection is commonly available while working in computer applications such as Microsoft Word, etc. It is also enabled by some software utilities (such as PKZip) which allow the user to encrypt any file on his system after the fact. Not all passwords can be recovered, but we have access to some of the best tools available to retrieve recoverable passwords.

Top

Hard drive imaging can be conducted in a number of ways. We offer a choice of three services. They include: a verified forensic image; a 100% image; and a data backup or copy.

Forensic Imaging(a 100% image plus hash verification)

Our forensic imaging process is conducted using procedures that adhere to Department of Justice guidelines and other current legal and technical standards. Our methods ensure that all data on the hard drive is retained. (Attorneys find this useful where there are accusations of spoliation of evidence.)

Forensic hard drive imaging copies all data from your hard drive to a backup disk. The imaging process captures information found in every sector of the hard drive. That may include erased data, information found in currently unallocated space, or data otherwise currently unavailable to the operating system.

An adequately produced forensic image requires, and we conduct, a SEPARATE CRC or MD5 hash of both the original and restored drives. This provides verification that all the data was transferred. The benefit of the hash verification is to guarantee the integrity of the data on the image or copy.

Forensic Imaging(a 100% image without hash verification)

When 100% verfication is not required, yet you still need to retain all the data captured by the forensic process, we conduct forensic 100% imaging. In this process we do not furnish a CRC or MD5 validation of the data. In all other ways the imaging process is identical to a true forensic image. The image-only process may be requested because our verification process increases the time from 2 to 3 times as much as simply making an image. Many clients choose to forego the additional time needed to perform the 100% verification.

Data Backup Imaging (simple COPY)

Routine data backup imaging is a backup procedure which copies only the visible files located on the drive. The erased, and otherwise unallocated data is not copied to the backup media. For routine business or personal copying this may suit your purposes. Many firms use this process or procedure to assist in complying with their implementation of some of the new laws including the Sarbanes-Oxley law.

Top

Mares and Company offers hard drive wiping services which completely overwrite all information on the drive. Drives require wiping prior to reuse or reassignment, and before a drive is discarded, sold, or donated. Drives are also commonly wiped as a risk management measure and in order to comply with various government and other regulatory requirements, including HIPAA.

Our process uses the Maresware program Declasfy which was developed to meet Department of Defense(DOD) standards for drive wiping. Declasfy is one of only 5 products listed which has been tested to adequately perform this funtion. In addition, it leaves no residual information on the drive which might provide evidence of the wiping operation. (Remember: never rely on fdisk and formatting procedures; the fdisk/format procedure does not wipe out data.)

Users with a frequent need to wipe drives may want to purchase Declasfy or NTWIPE and do their own wiping. (Site licenses and volume discounts are available.) We can also train you or your staff in proper wiping procedures.

Wiping verification: When working in areas with high security levels, you may want to consider our wiping verification process, or purchase the software and do your own processing. This procedure examines a wiped drive to verify that every bit of data has, in fact, been wiped. We can also train your staff and develop a proper processing protocol to get you up and running quickly. Follow this link to learn more about the software and the wiping verification process.

Top