DriveSavers Data Recovery

10/29/2026

A municipality recovered all the critical data it needed to restore operations following a ransomware attack without paying the ransom, even though its backups had been deleted, factory reset, and data was partially overwritten with zeros.

At stake were its file server, court-management system, GIS, and access-control data. With its production systems encrypted, recovering those damaged backups offered the only viable option that didn't involve paying.

In this case study: how we found usable backups inside that damaged storage, and what it took to get them out.

https://drivesaversdatarecovery.com/case-studies/recovering-critical-municipal-data-without-paying-a-ransom/

Ransomware hit a city’s servers and backups. See how DriveSavers recovered a 34TB file-server backup and critical data from damaged Synology and TrueNAS storage.

10/15/2026

You pull the drive out of a dead Windows laptop, plug it into another machine, and it asks for a 48-digit recovery key the customer doesn’t have.

Or a customer’s Mac rejects a password that’s definitely correct.

Encryption is now on by default on many more machines, and the owner may not know it’s on. FileVault turns on automatically in macOS 26 Tahoe when someone signs in with an Apple Account during setup. On Windows 11 24H2, a clean install or factory reset can switch on device encryption, and if the machine was set up with a local account, the key may not be saved anywhere.

Mike Cobb, our Director of Engineering and CISO, wrote two articles on exactly this:

🍎 FileVault: when a locked Mac can still be recovered, and why it should never be erased before it’s evaluated
https://drivesaversdatarecovery.com/blog/recovering-data-from-a-filevault-encrypted-mac/

🪟 BitLocker: why a pulled drive asks for a key, where the key usually turns up, and when you don’t need data recovery at all
https://drivesaversdatarecovery.com/blog/can-data-be-recovered-from-a-failed-bitlocker-encrypt

10/01/2026

When an Akira ransomware attack left an organization’s production virtual machines encrypted and its backups encrypted or deleted, the incident response team turned to DriveSavers for specialized data recovery.

The challenge extended beyond the attack: roughly 15TB of new data was written to the same volume the following day. DriveSavers engineers rebuilt the filesystem map to access deleted backup data, then combined that data with data salvaged from the affected production disks. Recovery reached 99.91% of the priority database server’s virtual disk data.

See how DriveSavers supported the incident response team when standard restoration options were exhausted.
https://drivesaversdatarecovery.com/case-studies/vmdk-data-recovery-after-an-akira-ransomware-attack/

DriveSavers recovered 99.91% of a critical database server after Akira ransomware encrypted and deleted 11TB of VMware backups on a Synology NAS.

09/25/2026

Star Trek turns 60 this month. Ten years ago, DriveSavers finished reading about 200 floppy disks belonging to Gene Roddenberry.

Both computers that wrote them were gone: One had been sold at a charity auction, and the other wouldn't power on. The disks were mostly CP/M, formatted by software with no documentation, so our engineers spent three months figuring out how they were written before they could open a single file. Reading all 200 took about a year. Mike Cobb and Jim Wilhelmsen, pictured with Roddenberry's computer and many of the floppies, led the project.

Rod Roddenberry later sent a signed photograph of his father: "To DriveSavers, thank you for recovering my father's voice from digital oblivion!"

Read more about the Roddenberry data recovery in the PCWorld article from 2016, republished on the DriveSavers website: https://drivesaversdatarecovery.com/press-coverage/pcworld-how-star-trek-creator-gene-roddenberrys-words-were-freed-from-old-floppy-disks/

09/22/2026

A stolen safe held a Trezor hardware wallet and the only paper copy of its 20-word recovery phrase. Anyone holding the full phrase can move the funds.

The client had 10 of the 20 words and had to rebuild the rest before the thieves used the copy they took.

An outside video forensics team reviewed office security footage of the phrase being written and found the resolution too low to read the words.

DriveSavers engineers reviewed it again and narrowed each missing word from 1,024 SLIP-0039 candidates to about 200.

Find out how they did it: https://drivesaversdatarecovery.com/case-studies/stolen-cryptocurrency-recovery-how-drivesavers-rebuilt-a-trezor-seed-phrase-from-10-missing-words/

09/17/2026

Thieves stole a safe holding a Trezor hardware wallet and its 20-word recovery seed phrase on paper. With the full phrase, they could move the funds whenever they wanted.

The client had the first 10 words and had to reconstruct the other 10 and move the funds first.

Brute-forcing 10 words from the SLIP-0039 list runs about 803 trillion years on standard hardware. Weeks of forensic analysis narrowed the search.

DriveSavers data recovery engineers recovered the cryptocurrency assets before the thieves could access the wallet.

Read the case study to find out how: Read "Stolen Cryptocurrency Recovery: How DriveSavers Rebuilt a Trezor Seed Phrase from 10 Missing Words"

https://drivesaversdatarecovery.com/case-studies/stolen-cryptocurrency-recovery-how-drivesavers-rebuilt-a-trezor-seed-phrase-from-10-missing-words/

DriveSavers crypto recovery services combined forensic video analysis with proprietary recovery software to solve a brute-force problem initially estimated to be computationally infeasible

09/15/2026

Your immutable backup is probably reachable from the network right now. That is not a misconfiguration. That is what immutability is.

Immutability stops a backup from being altered. An air gap stops it from being reached. Your organization may have purchased one, believing that it includes both.

Immutability holds the data for a set retention period. But the setting that enforces it lives in the backup software; the software has a console, and the console has credentials. With those credentials, an attacker does not have to defeat the immutability setting. On some platforms, they can change it or switch it off from the console, the same way an administrator would.

A disconnected copy removes that path. While it is off the network, credentials can't reach it. The cost is speed, because someone has to reconnect it before you can restore.

So the question is not whether your backups are immutable. It is whether any copy sits outside the reach of your primary backup system.

Read more at the link in the comments.

09/10/2026

In ransomware data recovery cases that DriveSavers has handled, backups were marketed as immutable but were deleted anyway.

Learn why write-once protection may not stop ransomware, what to ask your backup vendor, and what DriveSavers can still recover even after the backups are gone.

https://drivesaversdatarecovery.com/blog/why-immutable-backups-can-still-be-compromised/

Why immutable backups can still be compromised, when a decryptor won't save you, and where ransomware data recovery fits.

08/27/2026

Your tapes aren't aging out. Your ability to read them is.

LTO-10 reads only LTO-10 media, and LTO-8 and LTO-9 have already cut how far back they reach.

Reading an old archive can also take the original software, the encryption keys, the catalog, and someone who remembers how the environment worked. All of it gets harder to replace over time.

Those tapes hold decades of customer interactions, engineering records, and operational decisions that exist nowhere else.

Full article in the first comment.

08/20/2026

How do you modernize decades of enterprise data—and where do you start?

Tape inventory is just one step. True modernization begins with data triage: discover what you have, determine what still matters, and prioritize what needs to remain accessible.

The compatibility window has narrowed across tape generations, shifting from broad backward access in earlier LTO systems to much tighter read support in modern drives.

The tapes may be intact. The question is: can you still access—and interpret—the data on them?

Read "The Asset Isn’t the Tape:
Protecting Historical Enterprise Knowledge" at the link in the first comment.