Computer Forensics: Computer Crime Scene Investigation (With CD-ROM) (Networking Series)

Over the years, Vogon’s data-recovery laboratories have seen pretty much anything that can happen to a computer, no matter how incredible, whether it is a geologist who, in testing for minerals, inadvertently blew up his own laptop, or the factory worker who covered the computer running the production line in maple syrup. The list is now so long that the incredible has now become almost mundane.

Fortuitously, two in the latest of a long line of incredible recoveries recently arrived, so, it seemed appropriate to include them as case studies.

Case Study One: The Case of the Flying Laptop

Picture the scene: Police rushing into premises on the ninth floor of a building. Almost immediately thereafter, a laptop accelerates rapidly groundward out of the window of the aforementioned premises.

As long ago as 1687, Sir Isaac Newton predicted with uncanny accuracy the inevitable conclusion to this action: Namely, the laptop (or to be strictly accurate, large number of pieces of a former laptop) coming to rest with a singular lack of grace on the floor. Luckily, no one was injured by the impact. The resultant bag of smashed laptop components arrived at Vogon’s laboratory for a forensically sound data recovery.^[xviii]

The laptop computer had impacted the floor across its front edge at an angle, forcing the hard disk drive assembly to go completely through the screen of the laptop. The highly delicate spatial relationship between heads, flexures, platters, and spindle had become disturbed, and the bed of the drive unit was not concave. This imparted an oscillation in two dimensions during drive operation. The drive electronics were destroyed in the impact. After an evening’s work by a highly skilled hardware engineer, it was determined that a full fix was possible, and a perfect image was taken. Vogon had no knowledge whether the chap was guilty; but, they bet he was in shock when the evidence was presented!^[xix]

Case Study Two: The Case of the Burned Tapes

This case does not involve true forensic investigation, but it does highlight the fact that it is important never to give up on a job, no matter how seemingly hopeless it appears.

Sets of digital audio tape (DAT) tapes were sent to Vogon from a loss adjuster.^{[xx ]}The DAT tapes were caught in a fire, which had engulfed a company’s head office, and wiped out the primary trading infrastructure. The company’s IT systems had been at the center of the blaze, and this had unfortunately raised the magnetic media on the surface of the servers hard drives past its curie point. The DAT tapes had, rather inadvisable as it turned out, not been stored off-site. They were, however, stored a little way from the center of the blaze.

Despite this, the DAT tapes arrived in a rather sorry condition. The plastic casing had melted to, around, and onto the tapes, and the whole mechanism was fused into a homologous glob. It is fair to say the tapes were sent to Vogon with the full expectation that they would be declared unrecoverable, and used as the basis from which to make a loss settlement.^[xxi]

This recovery involved hours of work from both hardware and tapes recovery engineers. The tapes were carefully cut away from the molten mass, and treated for fire damage. The next stage was to rehouse the tapes and pass them forward to the tape recovery team. Following a number of complex stages, the recovery team was able to extract a stream of data from the tapes that accounted for some 95% of the original data stored on the company’s tape backups.

The result was a company up and running in a matter of days rather than weeks, or, more likely, never. It also resulted in a significant reduction in the claims settlement by the loss adjuster, and business continuity for the unfortunate company concerned.

^[xviii]Ibid.

^[xix]Ibid.

^{[xx ]}Ibid.

^[xxi]Ibid.