Best Practices in Recovering Data from Water-Damaged Devices
Digital Forensics | Oct 16, 2015
Steve Watson, a technologist focused in the areas of e-discovery, forensics, risk and compliance, posed this question to a full house at Enfuse (CEIC 2015) earlier this year. The popularity of his session, “Water-Damaged Devices – An Analysis of Evidence Locker Corrosion,” made a clear statement that EnCase® users are ready and eager to learn how best to tackle the data that resides on damaged devices.
If you missed this popular lecture, you can read a brief summary of it in this blog, and also download the complete slide presentation here: Water-Damaged Devices: An Analysis of Evidence Locker Corrosion. We’d also like to remind you to register early for Enfuse 2016, where you can hear similar topics that will showcase the latest and most innovative tools and techniques to make your job easier as a forensic investigator.
Survey Proves More Research is Needed on Damaged Devices
The survey was used by Watson to launch The Damaged Devices Project—a series of research projects whereby devices are exposed to damage with scientific precision, followed by remediation and documentation. The results are then published to the digital forensics community. The scope of his research is on liquid damage, thermal damage, impact damage and ballistics damage. His session at CEIC (Enfuse), however, focused specifically on the damage that occurs to mobile phones that have been submerged in water.
The majority of forensic examiners said a damaged device sits in an evidence locker room for at least three days before it is retrieved for cleaning in preparation for data acquisition. The problem here, according to Watson, is that as the duration of time increases that a water-damaged phone waits in evidence storage to be prepared for data acquisition, the corrosion and sediment buildup also increases exponentially.
In addition to risks of mold, biological hazards, battery damage, and electric discharge, mobile devices that stay zipped up in a locker room evidence bag will show greater liquid damage, including:
- PCB layer damage
- Pitting on the PCB traces
- Corrosion (galvanic or electrolytic)
- Damage to SMT leads
Top Five Recommendations to Remediate Water-Damaged Phones
- Remove the battery as soon as possible
- Do not attempt a power-on or charge until dry
- The device is more stable if transported in water to the lab for cleaning
- If you can’t transport the device in liquid, disassemble and make a best effort to dry it before shipping or storing
- Do not expect a successful acquisition from devices that have remained in evidence bags for nine months or more