The data recovery expert vs the computer forensics specialist

14 March 2018 by Philipp Lohberg

Hard drive opened up

Have you ever wondered the difference between a data recovery expert and a computer forensics specialist? Yes? Well, it's your lucky day!

Read below to find out all about these two data focused professions.

The data recovery expert

Generally, for the data recovery expert, they will receive a storage medium from the client (in the case of larger RAID units, the expert may need to work via the internet or directly on site) with the request to recover lost data.

The expert will run an analysis to find out about the opportunities for a successful data recovery. After this step, the expert will have a good idea as to how much data (if any) can be recovered, and at what price. A detailed diagnostic report would then be provided with a complete list of recoverable files and their status.

If the customer gives the green light, the actual data recovery can be started. Depending on what triggered the data loss and what storage media is involved, the way in which information is recovered will differ.

If the data is lost due to hardware damage, bringing the storage medium back to life is relatively straightforward. Professional data recovery experts not only have a large stock of popular controllers and read/write heads, they also have excellent contacts with the manufacturers.

A data recovery expert needs to be able to handle a lot of programs and - in part, self-developed-tools. That’s because even on the software side, a lot can be wrong, which has to be straightened -be it corrupted metadata, or false low-level information needed for basic disk operation. It becomes a problem when an SSD has an encrypted controller. If the necessary key is missing here, the data recovery professional is usually not in a position to save data.

Computer forensics specialist

One of the main differences between the data recovery expert and the computer forensics specialist is the cooperation of the client. Computer forensic experts mainly have to retrieve data in relation to a crime, and obviously, the culprit of the crime does not want the data found!

The storage medium will be sent to the computer forensics specialist via the investigating officer, rather than the owner of the data - as this is normally the individual being investigated.  Although the methods used for the retrieving lost data are very similar in both professions, the data recovery expert is ultimately not interested in the content of the data saved, while the forensic scientist is. This is because the computer forensics specialist must conduct a structured investigation, documenting evidence that enables the court to determine what has happened to the IT system - and who is responsible for it. For example, an IT forensics report might include information on the identity or identification of the offender, the period and extent of the crime and information on the motivation and execution of the crime.

As you can see, both jobs are very similar in the way that they retrieve data but the reasons behind why they are retrieving the data are very different!

Load more comments

New code