Introduction

The loss of data caused by the damage of electronic devices is one of the major problems in this information era and the recovery of those data is a technological barrier experts need to overcome. In the pursuit of ensuring information security by using technology more efficiently, this report explains how SalvationDATA experts extracted data from a broken hard drive that was burned and watered.

Burned and Watered: A Broken Hard Drive

On Mar. 8th, 2017, SalvationDATA technicians received a phone call from a customer who wanted to have data recovered from a burned and watered hard drive urgently. From a hard drive that was partially burned black and its back contaminated by greasy dirt, could data be recovered successfully by SalvationDATA technicians?

1

Burned and Watered Hard Drive

No Effort Spared: Hard Drive Detection

Technicians took the hard drive to a dust-free laboratory (Level 200) to do opening detection on Oct. 9th. The drive was first cleaned and then opened and fortunately there was not much stain on the inside disk although part of the colloid for sealing the drive already melted down. After cleansed separately with special detergent, the disk was put into a new disk cavity with the same size as the original one and matched with a new head. The circuit board of the drive was still intact thus the detection was done using the original circuit board.

2

Burnt Marks on the Hard Drive still Clear after Cleansing

Overcoming Barriers: Recovery Successfully Done

For the damaged hard drive was a CCTV DVR without knowing the model, data should first be cloned to a spare hard drive in order to be analyzed.

3

Technicians used SalvationDATA DRS(Data Recovery System)to create image documents, which gained access to data stored in almost all the sectors. Low-speed image creation was used to overcome the stability problem caused by burning and it took approximately 48 hours to complete the process. The image hard drive was scanned by SalvationDATA VIP(Video Investigation Portable), and all videos and 98 percent of the data cloned were extracted. Data recovery process from the broken hard drive was completed with successful extraction of almost all data.

QQ截图20160624143642_副本

4

Tips:

Notes for processing hard drives recovered from fire scenes

1. Do not power on the hard drive (burning will leave impurity in the disk cavity; accessing electricity will damage the hard drive again and lower the possibility of successful data recovery)

2. Have the hard drive detected (such as opening the drive) by professions in specific conditions

3. Complete physical remediation, firmware remediation included, in accordance with malfunction causes

4. Recover data using professional tools (SalvationDATA DRS for example)

Notes for processing hard drive after it was watered

1. Do not power on the hard drive (water will result in impurity in the disk cavity; accessing electricity will damage the hard drive again and lower the possibility of successful data recovery)

2. Remove the circuit board and dry it at room temperature to prevent it from rusting

3. Have the hard drive and its disk detected by professionals (including removing all water stains and impurities)

4. Have the drive processed professionally (by tools such as HPE dismantling equipment for hard drive disks) and then recover data using professional tools (SalvationDATA DRS for example)

The successful recovery takes both SalvationDATA DRS and VIP system. Sometimes, different systems need to be used in bundle while solving specific problem. And here in SalvationDATA, you can get a whole package needed for computer forensics, cellphone forensics and DVR forensics.

Click HERE to learn more about VIP.

Click HERE to learn more about DRS.