Whether perfectly legal computer data has been lost through hard-drive failure or a crime has been committed, a data forensic expert has both the tools and the know-how to recover the critical data, either turning it over to its rightful owner or helping attorneys or law enforcement officers prepare their case.

In either situation, certain procedures must be followed to prevent further data loss or preserve civil or criminal evidence.

Where data has been lost due to hard-drive failure caused by fire, flood, power surge, corrupted files or accidental reformatting, follow these steps before calling a professional computer forensics company:

1. Don't run file-recovery or system-recovery software.

2. Turn off the computer, using the power button, rather than the shutdown menu.

3. Don't turn the computer back on before contacting a data forensic expert.

The data forensic company you call will evaluate the situation and explain your options.

In the case of criminal activity requiring the preservation of possibly critical computer evidence, if you are a member of law enforcement, follow proper protocol to secure the scene, restrict access to the computer, preserve fingerprint evidence and prevent loss or alteration of data from any of the computer's components. Then, either call in a computer forensics expert or secure and transport the computer to a data forensic service for analysis, using appropriate procedure.

Action Steps
The best contacts and resources to help you get it done

Locate the computer forensic analysis information that suits your needs or purposes

Data forensics information is available for businesses and individuals whose computer systems or networks have been damaged or compromised, as well as for attorneys involved in litigation and law enforcement officials involved in criminal investigations.

I recommend: "Computer Forensics: An Explanation" defines data forensics and its importance to business managers, network administrators and company security experts. For law enforcement officials and attorneys, Computer Forensics World offers information on "Conducting a Search and/or Seizure" when it involves data forensics and "Legal Perspective: Searching for and Seizing Information," which offers an in-depth discussion of the topic. Further information on data forensics is presented in "An Explanation of Computer Forensics," including the methodology used by the data forensic expert.

Look for computer forensic services that specialize in the type of data forensics analysis you need

Many computer forensic analysis services specialize in one area of data forensic service, such as forensic business services. One of these companies might be better suited to your needs if the data that must be retrieved is extremely sensitive or part of a criminal investigation.

I recommend: Kessler International is a computer forensics company that specializes in corporate investigations, whereas LWG Data Recovery handles business and insurance-based personal data recovery. Kroll Ontrack focuses on legal cases, and Internet Crimes Group is primarily aimed at law enforcement.

Consider a data forensic company that handles multiple case types, if your needs vary

Many companies provide both corporate and legal data forensic service, while others offer business and personal service. Still, other computer forensic analysis experts offer services geared to corporate, legal and law enforcement entities.

I recommend: Fulcrum Inquiry provides computer forensic analysis information in a variety of different areas of expertise. EDD Labs, Inc. serves the legal and compliance market, and HSSK handles business and legal forensic analysis services.

Choose computer forensic software providers if you want to act as your own forensic expert

Some companies provide the software you need to act as your own data forensic service, which can save you money, provided you have the expertise and your situation isn't too dire.

I recommend: OfficeRecovery.com provides downloadable software that can help you recover lost e-mail and databases and restore corrupted files. It also offers CryptoSearch, a software program that locates encrypted or password-protected files. The company partners with another computer forensics company that provides data recovery services for those situations where an expert may be required.

Tips & Tactics

Helpful advice for making the most of this Guide

• •  When your data is critically important, always use an expert in computer forensic analysis, information retrieval and data restoration. Even with the right software, if you lack the proper expertise, you could cause greater damage to your data or lose it entirely.