DriveSavers, Inc.

@NewYorker published a feature on DriveSavers this week. Staff writer Julian Lucas ( @jcljules ) spent time in our Novato lab in January, talking with engineers and leaders across the company and watching the work up close. He even tried his hand at it himself: a hard drive disassembly in the cleanroom, and chip-level microsoldering on an iPhone board in our Flash Physical Department. We wrote a companion piece on how to keep your devices out of our lab in the first place, with a link to Julian's full article in The New Yorker: drivesaversdatarecovery.com/… #DriveSavers #DataRecovery #WeCanSaveIt

A municipality recovered all the critical data it needed to restore operations following a ransomware attack without paying the ransom, even though its backups had been deleted, factory reset, and data was partially overwritten with zeros. At stake were its file server, court-management system, GIS, and access-control data. With its production systems encrypted, recovering those damaged backups offered the only viable option that didn't involve paying. In this case study: how we found usable backups inside that damaged storage, and what it took to get them out. drivesaversdatarecovery.com/… #WeCanSaveIt #Ransomware #DataRecovery

You pull the drive out of a dead Windows laptop, plug it into another machine, and it asks for a 48-digit recovery key the customer doesn’t have. Or a customer’s Mac rejects a password that’s definitely correct. Encryption is now on by default on many more machines, and the owner may not know it’s on. FileVault turns on automatically in macOS 26 Tahoe when someone signs in with an Apple Account during setup. On Windows 11 24H2, a clean install or factory reset can switch on device encryption, and if the machine was set up with a local account, the key may not be saved anywhere. Mike Cobb, our Director of Engineering and CISO, wrote two articles on exactly this: 🍎 FileVault: when a locked Mac can still be recovered, and why it should never be erased before it’s evaluated drivesaversdatarecovery.com/… 🪟 BitLocker: why a pulled drive asks for a key, where the key usually turns up, and when you don’t need data recovery at all drivesaversdatarecovery.com/… #DataRecovery #FileVault #BitLocker

When an Akira ransomware attack left an organization’s production virtual machines encrypted and its backups encrypted or deleted, the incident response team turned to DriveSavers for specialized data recovery. The challenge extended beyond the attack: roughly 15TB of new data was written to the same volume the following day. DriveSavers engineers rebuilt the filesystem map to access deleted backup data, then combined that data with data salvaged from the affected production disks. Recovery reached 99.91% of the priority database server’s virtual disk data. See how DriveSavers supported the incident response team when standard restoration options were exhausted. drivesaversdatarecovery.com/… #RansomwareRecovery

Thieves stole a safe holding a Trezor hardware wallet and its 20-word recovery seed phrase on paper. With the full phrase, they could move the funds whenever they wanted. The client had the first 10 words and had to reconstruct the other 10 and move the funds first. Brute-forcing 10 words from the SLIP-0039 list runs about 803 trillion years on standard hardware. Weeks of forensic analysis narrowed the search. DriveSavers data recovery engineers recovered the cryptocurrency assets before the thieves could access the wallet. Find out how in the case study: drivesaversdatarecovery.com/… #cryptocurrency #bitcoin #BitcoinRecovery

Your immutable backup is probably reachable from the network right now. That is not a misconfiguration. That is what immutability is. Immutability stops a backup from being altered. An air gap stops it from being reached. Your organization may have purchased one, believing that it includes both. Immutability holds the data for a set retention period. But the setting that enforces it lives in the backup software; the software has a console, and the console has credentials. With those credentials, an attacker does not have to defeat the immutability setting. On some platforms, they can change it or switch it off from the console, the same way an administrator would. A disconnected copy removes that path. While it is off the network, credentials can't reach it. The cost is speed, because someone has to reconnect it before you can restore. So the question is not whether your backups are immutable. It is whether any copy sits outside the reach of your primary backup system. Read more at the link in the comments. #DataSecurity #RansomwareProtection

In ransomware data recovery cases that DriveSavers has handled, backups were marketed as immutable but were deleted anyway. Learn why write-once protection may not stop ransomware, what to ask your backup vendor, and what DriveSavers can still recover even after the backups are gone. drivesaversdatarecovery.com/… #Ransomware #IncidentResponse #DataRecovery

The UK is advancing plans to ban ransomware payments for public sector organizations and critical national infrastructure providers. The @FinancialTimes @fttechnews asked DriveSavers whether that's the right call. Andy Maus, Head of Cyber Recovery Services at DriveSavers, said it depends on whether restoring operations is technically possible. A ban makes sense when there's a viable alternative to paying the ransom. When a water utility doesn't have one, for example, the systems stay offline, and customers go without service. This article goes into greater depth on DriveSavers Data Recovery's viewpoint, as developed from our direct experience working with customers who have been victims of attacks: drivesaversdatarecovery.com/… #Ransomware #DataRecovery #IncidentResponse