Question 1

The laptop will not turn on. Is the data gone?

Accepted Answer

Almost never, if the fault is power or board failure, which is the commonest presentation (§3): the storage is untouched and only the path to it is broken, so the drive is transplanted into working hard w are or read directly and the data recovered intact (§4, Example 1). Broken usually means the machine failed, not the storage. Send it for forensic recovery unaltered, do not let a repair shop tinker with it first.

Question 2

The phone was smashed or soaked. Can anything be recovered?

Accepted Answer

Often yes: the screen and board may be destroyed while the memory chips survive, and where the board is dead the chips are removed and read directly (chip-off, §4). A wet phone should be powered off and sent promptly, drying and switching it on risks corrosion and can destroy what a proper recovery would retrieve (§5). The honest exceptions are a genuinely burned or shattered chip, where the data is gone.

Question 3

How can you tell if a device was broken deliberately?

Accepted Answer

From the pattern, the timing and the account (§6): general damage suggests an accident, targeted damage to the storage suggests method; damage dated against the dispute is suspicious; and a claimed cause that the physical evidence contradicts, a "fire" that is really impact (Example 2), is a classic tell. Where a device was wiped before being smashed, the digital and physical evidence together tell the story (guide 110).

Question 4

Does recovering a damaged drive also decrypt it?

Accepted Answer

No: physically recovering the storage and decrypting it are separate problems (§5). A chip-off of an encrypted phone yields encrypted data that still needs the key (guides 117 to 118), so a recovery commissioned without an encryption plan is only half done. Plan both from the start: recover the storage, then obtain the key by the recovery-key or compulsion routes.

Question 5

Is recovered data admissible, given the device was broken?

Accepted Answer

Yes, when the recovery preserves integrity: the recovered image is hashed and the recovery method and any repairs documented as its provenance (§5), so data pulled from a broken device is as sound and admissible as an image of a working one. The recovery and the forensic exam in at i on are distinct stages, and the documented recovery answers any challenge to how the data was obtained.

Question 6

The drive is genuinely destroyed. Is the case lost?

Accepted Answer

Usually not: the wreckage is rarely the only source (§8, Example 3). Backups made before the damage, synced copies, server-side mailbox and SaaS data, and counterparts' copies frequently hold the same material untouched, so a genuinely unrecoverable drive does not mean lost evidence. And a deliberately destroyed device becomes spoliation evidence in its own right (§6, §7): the destruction itself part of the case. cflab. u k · e-disc ove r y. u k ©2026 Computer Forensics Lab Ltd ·cflab.uk ·e-discovery.uk ·info@cflab.uk ·+44 (0)20 7164 6915 Page 15 of 17

Damaged Computers And Data Recovery