USB Flash Drive and Memory Card Data Recovery

Not necessarily. Flash media is physically fragile, and the controller, the component that manages communication between the memory and the computer, fails frequently.

Even when a device does not show up on a computer, the data on the memory chip often remains intact and can be retrieved with the right methods.

As soon as you notice data loss, stop using the device. Every further use increases the chance that deleted data is overwritten.

Do not try off-the-shelf recovery software, do not open the device yourself and do not hand it to a repair shop before speaking to us.

If the card or drive asks to be formatted, do not accept; remove it.

• Assessment of the device's physical condition and controller
• Examination of the file system and partition structure
• Recovery of photos, videos, documents and audio recordings
• Recoverability assessment for deleted data
• Data retrieval from formatted drives and cards
• Direct memory reads for devices with a failed controller
• Assessment of chip-level work on physically damaged devices
• Integrity checks and delivery of recovered data

We first try to read the device with standard methods. If that is not possible, advanced techniques targeting the memory structure are applied and the file structure is rebuilt from the raw data. Chip-level work may permanently damage the device and is carried out only with your written consent.

1. Intake and custody: we confirm the requester's legal authority, sign a non-disclosure agreement and receive the material with a signed evidence handover record. The chain of custody is documented from this point on.
2. Preliminary review: we establish whether the device can be read and what type of fault it has, and share the likelihood of recovery and estimated time.
3. Reading and reconstruction: a memory image is acquired and its hash value recorded; where needed the chip is read directly and the file structure is rebuilt from raw data.
4. Reporting and return: findings are reported together with the scope and limitations of the work. The material is returned against a signed record and working copies are either not retained at all or kept for 3 or 6 months, as the client prefers, and then securely destroyed.

Duration varies from case to case depending on the type of device or material, the data volume and the scope of the examination. We share an estimated timeframe after the initial assessment.

Individuals and organisations that have lost data, photographers, field teams and parties to legal proceedings.