Page 1

DAMAGEDMEDIA · A GUIDE FOR UK LAWYERS Damaged Computers and Data Recovery Physically Broken Devices, the Recovery That Is Possible, and the Damage That Is a Clue COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES DAMAGED-DEVICE RECOVERY CHIP-LEVEL EXTRACTION CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: broken does not mean empty 03 Types of damage and what each does to the data 04 The recovery techniques: from board repair to chip-off 05 Recovering defensibly: integrity, encryption and honest limits 06 Accidental or deliberate: reading the damage as evidence 07 Deployment: spoliation, insurance and the estate around the wreckage 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: ABROKENDEVICEISRARELYANEMPTYONE: MUCH DATA SURVIVESPHYSICALDAMAGEANDCANBERECOVEREDBYTECHNIQUESFROMBOARD REPAIRTOCHIP - LEVEL EXTRACTION, ANDTHEPATTERNANDTIMINGOFTHEDAMAGE OFTENTELLTHEIROWNSTORYABOUTWHETHERITWASACCIDENTORADELIBERATE ATTEMPTTODESTROYEVIDENCE

§ 02 · FIRST PRINCIPLES The problem in plain English: broken does not mean empty

§ 03 · TYPESOFDAMAGE Types of damage and what each does to the data