FAQ
The specialists answer to you
FAQ
Feel free to contact us to ask some questions or share a comment.
Yes, in many cases. Our team analyzes the type of ransomware and explores several approaches: recovering unencrypted files, exploiting known vulnerabilities in the encryption, restoring previous versions of the files. Each case is unique — a free diagnosis allows us to assess the chances of success.
Yes, formatting does not immediately erase data — it deletes the file allocation table. As long as the sectors have not been overwritten by new data, recovery is possible. Essential condition: do not write anything more to the media and entrust it to a specialist. On SSDs, the TRIM function can complicate recovery if it has been executed after formatting.
Yes, in a significant number of cases. The possibility of decryption without paying mainly depends on the type of ransomware and the existence of an exploitable cryptographic flaw.
Several recovery paths exist:
- Public decryption keys — some ransomware has been decrypted by security researchers and agencies like Europol. The No More Ransom platform (nomoreransom.org) centralizes these tools for free.
- Flaws in cryptographic implementation — some poorly programmed ransomware have vulnerabilities that allow keys to be reconstructed.
- Shadow Copies (VSS) — if the ransomware has not deleted Windows Shadow Copies, a restoration is possible.
- Unaffected backups — offline backups, NAS snapshots, or unsynchronized cloud storage.
Our laboratory analyzes each case individually. A diagnosis allows us to determine which ransomware family is involved and what decryption options are available.
Yes. A broken or malfunctioning screen does not affect the phone's internal memory. If the device is still recognized by a computer via USB or turns on (vibration, sound), the data is accessible with the appropriate tools.
Depending on the condition of the phone, several approaches are possible:
- OTG connection + external mouse/keyboard — to navigate a phone where only the screen is faulty
- Access via ADB (Android Debug Bridge) — if USB debugging was enabled
- Direct memory chip extraction — for cases where the screen AND other components are faulty
For iPhones, extraction often requires repairing the screen first (using a replacement screen in the lab) to bypass iOS encryption.
Yes, data recovery from physically damaged hard drives is our specialty. SOS Data Recovery has an ISO Class 5 certified laminar flow environment according to ISO 14644-1 (max. 3,520 particles ≥ 0.5 µm per m³) allowing us to open and repair media in dust-free conditions. Defective components are replaced using specialized equipment (PC-3000 from ACE Laboratory) before performing a complete bit-by-bit copy of the media.
Yes, data recovery from a wet smartphone is possible in most cases, provided you act quickly and correctly. Fresh water is less destructive than salt or chlorinated water, but in all cases, the intervention time is critical.
The first rule is to not turn on the phone after immersion — a short circuit can irreparably damage the memory chips (eMMC or UFS). Remove the battery if possible, do not plug in a charger, and bring the device to a specialized laboratory as soon as possible.
In the laboratory, our technicians completely disassemble the device, ultrasonically clean the components, and directly extract the data from the memory chip. The success rate exceeds 80% when the smartphone reaches us within 24 to 48 hours following the water damage.
Yes. The internal memory of an iPad is separate from its touchscreen. A cracked or completely failed screen does not prevent the recovery of stored data.
For recent iPads (Face ID), a replacement screen is often required in the lab to bypass authentication. For older models (Touch ID), connecting to a trusted computer via Lightning or USB-C is usually sufficient.
If USB debugging was enabled and a trusted computer was already paired, extraction can be done without manipulating the screen. In the most complex cases (completely inert iPad), our technicians proceed with a direct extraction of the NAND memory chip.
Partially, yes. Overwriting a hard drive does not instantly destroy all data. Several mechanisms allow for partial recovery:
- Partially overwritten files — if only the header or end of a file has been overwritten, the rest can often be reconstructed
- File carving — a forensic technique that searches for file signatures (magic bytes) directly in the raw sectors, regardless of the file system. Effective even after reformatting.
- Spare sectors and HPA zones — some drives keep copies in areas inaccessible during normal use
- Magnetic remanence — on older HDDs, traces of previous writes can sometimes be detected with specialized equipment
A secure overwrite with multiple passes (DoD 5220.22-M or Gutmann standard) makes recovery practically impossible. A simple quick format or a standard deletion is not enough.
Yes, recovering deleted photos and videos from a smartphone is technically possible, even without a prior backup. Deleting a file does not immediately erase it from the internal memory: the data remains present until the space is reused by new files.
The faster you stop using the phone after deletion, the higher the chances of recovery. Every new photo taken, application installed, or update downloaded can overwrite the deleted data.
Our technicians extract data directly from the device's eMMC or UFS chip using professional tools (JTAG, ISP, chip-off). This method allows us to recover files even when the file system is corrupted or the phone no longer starts.
Absolutely. We sign a Non-Disclosure Agreement (NDA) with every client. Our premises are secure, and all recovered data is encrypted. After delivery, your original media can be destroyed upon request.
Absolutely. Each piece of media is received with acknowledgment of receipt, recorded in our tracking system, and stored in a secure safe between each stage of intervention. Our premises are protected by a video surveillance system, access by nominative badge, and an alarm connected to a security center. Tesweb SA is authorized to process confidential data for Swiss federal institutions and is CyberSafe certified. Your data never leaves Swiss territory.
Yes. SOS Data Recovery (Tesweb SA) is CyberSafe certified and a CyberSafe partner (Swiss cybersecurity label, cyber-safe.ch) and compliant with the nLPD (RS 235.1). Your data is processed exclusively in our laboratory in Ins (Anet), Switzerland. The premises are secured by cameras, access badges and alarm, with media stored in a safe.
Yes. The diagnostic analysis is included with every case and delivered in less than 3 hours upon receipt of your media. It allows us to determine the nature of the failure, the chances of recovery, and the exact cost of the intervention.
Yes, the diagnostic analysis is systematically free and delivered within 3 hours of receiving your media. It determines the exact nature of the failure (software or physical), the chances of recovery, and the precise cost of the intervention. No commitment is required at this stage.
Yes. The diagnostic analysis is free and delivered in less than 3 hours upon receipt of your tape. It determines the nature of the failure and the exact cost of the data recovery.