Editor’s note: The loss of data caused by the damage of electronic devices is one of the major problems in this information era and the recovery of those data is a technological barrier expert need to overcome during a forensic investigation. In the pursuit of using forensic technology more efficiently, this article explains how SalvationDATA experts extracted data from a damaged or inaccessible hard drive that was burned and watered in DVR forensics.
Burned and Watered: A Broken Hard Drive
On Mar. 8th, 2017, SalvationDATA technicians received a phone call from a customer who wanted to have data recovered from a burned and watered hard drive urgently. From a hard drive that was partially burned black and its back contaminated by greasy dirt, could data be recovered successfully by SalvationDATA technicians?
Burned and Watered Hard Drive
No Effort Spared: Hard Drive Detection
Technicians took the hard drive to a dust-free laboratory (Level 200) to do opening detection on Oct. 9th. The drive was first cleaned and then opened and fortunately, there were not many stains on the inside disk although part of the colloid for sealing the drive already melted down. After cleaned separately with special detergent, the disk was put into a new disk cavity with the same size as the original one and matched with a new head. The circuit board of the drive was still intact thus the detection was done using the original circuit board.
Burnt Marks on the Hard Drive still Clear after Cleansing
Overcoming Barriers: Recovery Successfully Done
For the damaged hard drive was a CCTV DVR without knowing the brand and model, data should first be forensic imaging to a spare hard drive in order to be extracted and analyzed.
Technicians used our DVR forensics solution VIP(Video Investigation Portable) to create an image file with hash calculation first, which gained access to data stored in almost all sectors. Then the image file was scanned by VIP, and all video clips including lost, deleted, overwritten and even fragmented were recovered and extracted. The DVR forensics process from the damaged CCTV DVR hard drive was completed with a successful extraction and recovery.
Notes for processing hard drives recovered from fire scenes:
1. Do not power on the hard drive (burning will leave impurity in the disk cavity; accessing electricity will damage the hard drive again and lower the possibility of successful data recovery)
2. Have the hard drive detected (such as opening the drive) by professions in specific conditions
3. Complete physical remediation, firmware remediation included, in accordance with malfunction causes
4. Extract and recover data using professional forensic sound tools (SalvationDATA VIP for example)
Notes for processing hard drive after it was watered:
1. Do not power on the hard drive (water will result in impurity in the disk cavity; accessing electricity will damage the hard drive again and lower the possibility of successful data recovery)
2. Remove the circuit board and dry it at room temperature to prevent it from rusting
3. Have the hard drive and its disk detected by professionals (including removing all water stains and impurities)
4. Have the drive processed professionally (by tools such as HPE Pro dismantling equipment for hard drive disks) and then recover data using professional tools (SalvationDATA VIP for example)
Click HERE to learn more about VIP.