Cyber Forensics Laboratory (CFL)
Digital Forensics2Digital ForensicsDamaged Media Recovery Tips

Damaged Media Recovery Tips

 

These tips can significantly increase the chances of success in your recovery when submitting items for Damaged Media Recovery


 

 Do not attempt to recover data from a damaged device


Many people have sent CFL devices that could have been recovered, but their attempts made additional recovery impossible.

Send a donor device that matches the original as closely as possible

    

Same make/model/size, site code, date code, etc.

 Include a drive for the data when you submit your package


Please advise if you plan to perform the examination of the data yourself after recovery.

 If device is visibly broken, collect and send all pieces


Even very small pieces may have critical components, or contain information and clues that can be very useful in the repair of the device.

Send all power cables and unique data interface cables  

     

 Stabilize the device as much as possible


Attempt to prevent the device from further damage and contamination from its surrounding environment.

 Hard drives that contain platters are extremely sensitive to any kind of particles in the air


If you are sending a hard drive that has a breach exposing the internal cavity of the drive to the outside environment, attempt to stop continued contamination by sealing the drive in an anti-static bag or other means with equal or greater physical and environmental protection.

   

 Submerged Items

Several factors come into play when preparing captured devices for shipment and/or storage if they have been submerged. These factors will determine whether or not the item should remain submerged in its original substance and what other kinds of preparations should be made on the device.
 
  • How long has it been submerged?
  • What is the substance in which it is submerged?
  • What kind of device is it?