Data Recovery


Recovering deleted files is a normal part of a forensic analysis, so Natsar is extremely practiced at finding and recovering files that were deleted or even formatted. Because we have the tools and expertise to recover data, we offer this service to our clients independently of our forensic services for those that just need data restored.


Simply contact us and arrange to ship the device to our facility. Our staff will evaluate what is submitted and let you know whether we are able to recover data from the device. Natsar only charges an initial evaluation fee of $50 to cover our administrative time, software licenses, and shipping charges to return the device(s). If we are unable to recover data, there is no further charge regardless of how long we spend trying.

If data is able to be recovered, we will check with you to see if the data we are seeing is what you are looking for, then we will only charge an hourly rate for the time it takes an analyst to recover your data. The data will then be provided to you via our secure cloud for download.


As soon as you realize that data has become corrupt, inadvertently deleted, formatted, or otherwise missing and can’t be recovered through normal processes (restoring a previous backup, using Time Machine, restoring from the recycle bin, etc.), immediately stop using the device and power it off if you can. Leaving a device turned on or plugged in can cause further destructive processes and make recovery more difficult or even impossible. Contact a data recovery expert as soon as possible for further instruction as different devices and circumstances may required different handling instructions.

  • Stop using the device
  • If it is a removable device (camera card, external hard drive, USB drive, etc.) unplug it
  • If possible, power off the computer or mobile device
  • Contact a data recovery expert immediately


A professional photographer had years of photographs stored on an external hard drive with no other backup. When her external backup drive suddenly was no longer recognizable by any of her computers, the photographer contacted her IT contractor for help. When the IT contractor couldn’t recover anything, they contacted Natsar for help. The external hard drive was forensically copied and we went to work on the copy, quickly recovering 100% of the photographer’s pictures.

After a week-long family vacation, a client returned home to download all of the family photos to their computer for processing and storage. As this client was working with the various SD cards from their digital camera, they inadvertently formatted one of the cards after putting it back into the digital camera. After realizing what they had done, they inserted the card into their computer to find no pictures on the card. The clients found Natsar and sent us the card for recovery. Within four hours, they had all of their family vacation memories back.

An employee of a city government had just completed a large spreadsheet of very important data for the city. At some point after saving the spreadsheet on their computer, the file was accidentally moved to the trash and the trash can emptied. After IT looked in backups and network drives and realized there were no other versions of the file, a forensic analyst was able to locate and recover the file in its entirety, saving the city thousands of dollars in staff time.


  • Accidentally formatted computer hard drives, external USB hard drives, firewire drives, thumb drives, flash drives, camera cards, and other storage devices
  • Accidentally deleted images, videos, voicemail, email, and notes from iPhones, iPads, Androids, and other mobile devices
  • Accidentally deleted files and then emptying the trash can on either Windows or Mac computers
  • Fire or water damaged hard drives, mobile devices, and storage devices
  • Physically damaged devices


Natsar does not have a cleanroom and we do not take hard drives or components apart to recover data. If hard drives or mobile devices have been physically broken or are not functioning at all, it is most likely a company providing cleanroom services will be needed. Natsar does have relationships with several data recovery companies offering cleanrooms however, and can refer you to one of them. If you send us a device and we determine it needs cleanroom services or advanced data recovery beyond our capabilities, we will offer to send it to the cleanroom on your behalf and can either walk you through the process and be involved, or step back and allow you to deal directly with the other company directly.

Privacy Preferences
When you visit our website, it may store information through your browser from specific services, usually in form of cookies. Here you can change your privacy preferences. Please note that blocking some types of cookies may impact your experience on our website and the services we offer.