Using a Hex/Text Viewer to view sectors in the media we inspected the integrity of the data. Initial observation showed that the use of Data Doctor Recovery had fragmented the information on the media. Prior to starting the un-delete procedure, we created a hardware clone to work with. This allows us to revisit the media at any point, in the knowledge that we cannot corrupt the original data. Before running our un-delete procedures, the fragmentation had to be reversed. Firstly we ran a basic drive scan, which is a quick and general scan. Most of deleted files and folders can often be found with this type of scan. This did not reveal any further data.
Thereafter, we completed over forty advanced scans using our proprietary forensic tools. These are much slower - as they process the entire surface of the hard drive, detecting all possible clues that may reveal deleted data. Each scan addressed a different level, probing deeper each time, until we reached the lowest possible level. This revealed a significant amount of data, and thankfully much of the data that the client was searching for. Lastly we attempted a signature search, looking specifically for further jpg footprints of the specified files required. This revealed further data. Whilst some of the JPG images were slightly corrupted, we were able to recover 95% of the clients data.