Triage & carve
Image the disk, run carving, scope what’s recoverable, lock fixed-bid for the rest.
When the disk is gone but the data isn’t.
We recover wiped, fragmented, and accidentally-deleted data — and reconstruct working source trees out of carving output, session transcripts, and OS-level scraps. Productized from a real 588K-file recovery we executed in April 2026, running on the same OpenSearch indexer and reconstruction pipeline we built for that engagement.
Largest run to date 588,563 files
Index size 3.7M docs
Triage turnaround 5 business days
Coverage transparency Per-file %
What every engagement includes
- Raw-disk carving (PhotoRec + ext4-aware sweepers)
- Full-content OpenSearch index of every recovered byte
- Path-strict reconstruction (zero filename-collision false positives)
- Date-clustering walk to catch adjacent files you forgot existed
- Ground-truth Write/Edit capture override (the source you typed, not snapshots)
- Per-file coverage report (% reconstructed, marked gaps, no silent shrinkage)
How a Recovery Sprint runs
Index & bootstrap
Full-content OpenSearch index; project_refs tagging; first per-path reconstructions.
Date-cluster & override
Walk all session blocks in the date window; Write/Edit captures override Read reconstructions.
Verify & deliver
Project-keyword verification; coverage report per file; clean directory tree + summary.
When to engage us — and when not to.
Engage us
You’ve carved bytes but can’t find the files that matter.
- An OS install / repair overwrote a partition with code or documents you need.
- You have a 500K-blob carving output and need it organized into project trees.
- You need to reconstruct a developer’s working tree from session transcripts.
- You need chain-of-custody documentation for a compliance or legal context.
Skip us
The data never made it to text-recoverable form.
- You need SSH private keys back (binary, no carving signature — treat as gone).
- You need exact original mtimes (filesystem metadata went with the partition table).
- You need a hardware-level service for physical-drive failure — talk to DriveSavers first.
Pricing
Triage $1,8001 week Scoping pass — we tell you what’s recoverable, hand you a numbered plan with cost estimate. No commitment to proceed.
Recovery Sprint $8,500-$22,0002-4 weeks The standard engagement — carve, index, reconstruct, verify, deliver. Price scales with data volume and project count.
Forensic Investigation From $25,000retainer-based Chain-of-custody documentation, court-admissible exports, structured findings reports. Multi-week.
All prices USD. EU B2B customers invoiced in EUR with VAT reverse-charge per Article 196 of Directive 2006/112/EC — provide your VAT ID at engagement signing.
Lost something irreplaceable? Start with the free triage call.
We’ll set expectations on what’s recoverable before the meter starts. If we can’t help, we’ll tell you that too.