Damaged Computers And Data Recovery

DAMAGEDMEDIA · AGUIDEFORUKLAWYERS Damaged Computers and Data Recovery Physically Broken Devices, the Recovery That Is Possible, and the Damage That Is a Clue COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES DAMAGED-DEVICE RECOVERY CHIP-LEVEL EXTRACTION CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: broken does not mean empty 03 Types of damage and what each does to the data 04 The recovery techniques: from board repair to chip-off 05 Recovering defensibly: integrity, encryption and honest limits 06 Accidental or deliberate: reading the damage as evidence 07 Deployment: spoliation, insurance and the estate around the wreckage 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : ABROKENDEVICEISRARELYANEMPTYONE : MUCHDATA SURVIVESPHYSICALDAMAGEANDCANBERECOVEREDBYTECHNIQUESFROMBOARD REPAIRTOCHIP - LEVELEXTRACTION , ANDTHEPATTERNANDTIMINGOFTHEDAMAGE OFTENTELLTHEIROWNSTORYABOUTWHETHERITWASACCIDENTORADELIBERATE ATTEMPTTODESTROYEVIDENCE § 0 2 · FIRSTPRINCIPLES The problem in plain English: broken does not mean empty § 0 3 · TYPESOFDAMAGE Types of damage and what each does to the data § 0 4 · THERECOVERYTECHNIQUES The recovery techniques: from board repair to chip-off § 0 5 · RECOVERINGDEFENSIBLY Recovering defensibly: integrity, encryption and honest limits § 0 6 · ACCIDENTALORDELIBERATE Accidental or deliberate: reading the damage as evidence § 0 7 · DEPLOYMENT Deployment: spoliation, insurance and the estate around the wreckage § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION COUNTERPART EVIDENCE LOCAL- DAMAGED CLOUD SERVER-SIDE DEVICE BACKUP PLATFORMS SYNCED / PHYSICAL DELETED / COPIES LAYER ONLY § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THELAPTOPTHATWOULDNOTPOWERONANDHELDEVERYTHING EXAMPLE2 · THEHOUSEFIRETHATWASREALLYAHAMMER EXAMPLE3 · THEGENUINELYDESTROYEDDRIVEANDTHEESTATETHATSAVEDTHECASE § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider DA M AG EANA LY SIS § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The damaged-device checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions The laptop will not turn on. Is the data gone? The phone was smashed or soaked. Can anything be recovered? How can you tell if a device was broken deliberately? Does recovering a damaged drive also decrypt it? Is recovered data admissible, given the device was broken? The drive is genuinely destroyed. Is the case lost? § 1 4 · REFERENCE Glossary Sources and authoritative references 35 and CrimPR Part 19 reporting): cflab.uk/digital-forensics-services · guides library: cflab.uk/guides DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY