Computer forensics

Computer forensics
for everyone!

Briefly we do computer forensics in a non-controlled environment so the results may not be able to be used in a court of law. What this does mean however is that you save on the cost. We can recover data from your hard drive in most cases even if you formatted it. We can also remove passwords from your system allowing access to it again. An example of why you may need our services, say you have a computer that someone is using and you think they may be doing something wrong but can not get into their account because it has a password. We can make a copy of your hard drive and bring the copy back to the shop to unlock it. We can then tell you what that person has been doing up to that point. Another situation might be that you formatted or re-partitioned your hard drive by mistake, we can in most cases recover all or most of the data. If you would like to know more about our services then read on.

If you do not have the passwords to the Email, spreadsheets, databases and other data you want us to search you may request that we crack them in order to access the data.
In situations where the physical disc(s) have errors or appear damaged or unusable we can often times recover all or part of the data.

Zwizard provides individuals with data acquisition, data recovery and evidence gathering. Each client has different needs and each case is unique. We encourage you to contact us if you have questions about how we may assist you.

For businesses experiencing possible security breaches, tampering or unauthorized access or use of systems we can help you also. We can also remove all data from your computer so no one can recover the data before you sell or dispose of old equipment.

What to do if you format or re-partition your hard drive:
As the first course of business, do not turn on any computing equipment which may need to be examined. Even powering on a computing device will alter and possibly destroy data. If you need to turn equipment off, PULL THE POWER PLUG - do NOT perform the normal system shutdown procedure!

*************

Most people who have something to hide from someone else believe that deleting an Email or file, or, hiding these files will protect them from being discovered. Zwizard can search areas of the computer which cannot be normally accessed using conventional means.

Below are some examples of common issues we can assist you with:

Divorce, child custody and other marital issues where one spouse has deleted, altered or protected computer information from being seen by the other party, discovery of hidden and deleted Email's, pictures, documents, spreadsheets and other data
Family, children, child custody and marital issues pertaining to computer usage, pornography, Internet usage, file downloading, "chat room" history, Email history, computer program usage, discovery of hidden and deleted files
Removal of pornography, illegally obtained software such as music and video files, and, other data of this type from computers
Persons involved in civil litigation as the defendant or plaintiff in cases related to sexual harassment, theft of company data, improper termination of employment and other civil matters of this type
Detection and removal of "spyware". Spyware typically sends data from your computer over the Internet to another location and may include every keystroke you type, passwords and/or other data personal data. Spyware hides in the computer and most users have no knowledge it is running
Recovery of deleted data such as business/financial files, movies, pictures and other data which you can no longer find on your media
Remember the work we do is not in a controlled environment and may not be able to be used in court. Check with an attorney to make sure it can be used in court before requesting our services if it is going to be used in court.

You must have a legal right to access the computer in question before we will perform any work. If you are not sure whether or not you have a right to access the computer in question we strongly suggest you contact an attorney for advice.

If you are involved in civil litigation and the computer or data device in question is owned by a company or other person, Zwizard will work with your attorney and attempt to obtain a court order to allow us access to the needed equipment and data.

Zwizard recommends that you have the disc drive(s) removed by an experienced computer technician and shipped to us. We can also provide on-site service at your location for an additional cost.

Data Recovery

When it comes to apparent drive failure, there are tools and techniques that can be used to examine computer media at a much deeper level than conventional operating systems will allow, and since deep explorations like this are a routine part of forensic examinations, we are exceptionally well equipped to recover your critical data.

A large percentage of hard drive failures are not physical media failure and can be recovered in a cost effective manner.

Data Recovery FAQ

My drive is making noise, what should I do?

Power down the drive immediately! Prolonged operation of the drive could damage the media beyond recovery.

Should I try to run some type of recovery utility on my drive before I send it to you?

No! Running a utility on a potentially corrupted drive puts your data at a higher risk for permanent data loss. Most software utilities assume that your drive is working within normal limits. If your drive is not performing at its optimal level, the utility will attempt to fix things that may not need to be fixed. The usual result is further data loss or in some cases total destruction of your data, thus rendering it unrecoverable.

How is my recovered data returned to me?

Typically we return your recovered data on one or more DVD's, a new hard drive formatted to your specifications, or a drive supplied by you.

How do I ship my hard drive to you?

Wrap the hard drive in anti-static material. We recommend shipping the drive in its original manufacture's packaging. If this is not possible, pack the hard drive in a sturdy cardboard box twice the size of the drive, with heavy foam padding, bubble wrap or other anti-vibration materials. Do not use Styrofoam peanuts as they can cause static electricity. You can also request we come and get it for an extra fee depending on location.