The variety in table structures, schemas and structures can cause great difficulty in overcoming damage to the database. So how do we do it?

First of all, a raw image is taken using a write-blocker, meaning that we cannot alter the data in any way. This is an extrememly important part of the process as it means that should the process be unsuccessful, the engineers are able to revisit the original media and start over. It provides us with a back up.

Following step one, we can begin the manual evaluation and analysis of the drive which will determine the definition of the database and calculate the data parameters. In other words, the skilled engineers will decipher how the texts have been stored, the components of each fields, timestamps, geo-location and message bodies. Using proprietary software developed ourselves, they will then identify the appropriate hexadecimal code for each message. A script to extract the various components will be written to reorder them into an individual record. This is the most important stage as if any errors are made the engineer will be presented with garbled data on completion.

Once the data has been extracted, we will verify and test the recovered information.