Authors: Steve Watson (VTO Labs)
DFRWS USA 2019
Abstract
With some regularity, law enforcement agencies encounter devices that have experienced extreme damage. These devices are often dismissed as inaccessible because the damage is deemed too great and the data irretrievable. In this presentation, we will review four studies with extreme damage to devices. Devices that have been soaked in meth lab chemicals, devices that have been exploded, devices that have been soaked in blood and devices that have experienced long term submersions (multiple years) under water. In all of these examples, full data acquisitions were still possible despite apparent catastrophic damage. Throughout the studies, themes emerge in how these devices are handled that are repeatable in defining processes and can inform how to address devices that experienced different kinds of damage. This presentation seeks to display the art of the possible in regard successful data recovery from extremely damaged devices.