How Much

Some companies charge a flat rate of less than US$ 300. Considering more than 60 percent of cases involve mechanical problems – and you might need to spend half that for replacement parts – it is difficult to see how a company can charge so little. It seems pretty clear that the quantity of customers outweighs the sometimes poor quality. I have read in a couple of forums about companies that charged a ridiculously low rate but declared the data "unrecoverable," only to have it recovered easily by a different company. Note also that many companies have a "no recovery, no charge" policy, which may only apply to things like "labor charges," with parts or processing charged extra, even when the data is not recovered.

Ignoring the "super cheap" services, I found that recovery starts at around $400-$600 for basic issues like recovering deleted files. More complex issues that do not require a clean room can start at between $600 and $800. When the problem is so extensive that a clean room is required, prices start at least at $900 and can reach several thousand dollars. In our case, a complete recovery cost $1,500.

Keep in mind that these prices represent the standard service. Most companies offer a priority service, in which your data is returned in one or two days. These can be as much as twice the standard rate.

Making the Choice

Choosing the right company can mean the difference between a successful recovery or no recovery. You can find hundreds of companies all over the world that specialize in data recovery  – too many to round up here in one article – so look locally. Looking for services in your own area typically means a faster turnaround because you have to deliver the physical disk to the service vendor. Choosing a nearby lab also increases the probability that the vendor is in the same legal jurisdiction, which could save you some confusion and headaches should a problem arise.

Successful recovery means that the data is recovered in a timely manner, and your data is safe. In our case, the entire process took less than a week. The standard service was advertised as 24-48 hours for the initial evaluation and three to five business days for the recovery. The company also provides a faster priority service and an emergency service, which promises recovery within 24 hours. On-site recovery is another option, if you really need it and can afford it.

A good recovery service will adapt the recovery process to your specific situation, exploring and improvising if necessary to find a solution (Figure 3). When deciding on a data recovery service, the technical expertise and speed of recovery are only two of the most obvious considerations. The security of the recovered data is also a key issue, depending on the kind of data you need to recover. If you are dealing with sensitive data, you obviously do not want to hand over company secrets without ensuring that they will be handled properly. Simple statements on the company's website that the data will be handle "discretely" provides little or no guarantee that the data won't be compromised, even if accidentally.

Figure 3: A good recovery service is not locked into a single process but improvises if necessary to find a solution.

If your data is sensitive, you might want to ensure you have a written statement on how the data will be handled and by whom – and even an official non-disclosure agreement.

Ask the company if background checks are performed on their employees before giving them access to your data. Does the company meet any government standards for access to restricted areas? For example, is biometric data as well as a password required to enter the clean rooms or other areas where they have access to the data?

When considering the security of your data, you also need to consider the laws in different jurisdictions. Larger data recovery companies have offices in several countries. If you have to send your data outside of your area, laws and standards in your home country or even home state might not apply. Furthermore, different laws apply depending on the type of data you are attempting to restore. For example, the Health Care Insurance Portability and Accountability Act protects patient information, whereas the Gramm-Leach-Bliley Act protects financial information. Without due diligence, you (or your company) might be legally responsible for any disclosure of sensitive information.

Conclusion

A potential data recovery vendor can tell you anything on their website, but whether they actually adhere to the standards to which they claim is a different matter. That's why it is important to know whether the company is regularly audited, and according to what standard. One such standard is the Service Organization Control (SOC) reports, with SOC 2 being relevant to "Security, Availability, Processing Integrity, Confidentiality, or Privacy" of financial information.

Whether or not you choose to have a professional data recovery service come to your rescue, your decision will naturally depend on the value of the data compared with the cost of recovering it. Table 1 provides some of the key questions you need to ask. You'll find more detailed information at the Kroll Ontrack data recovery service website [1].