An In-Depth Look at Ransomware
May 10, 2016
By the Numbers: A Breakdown of Gillware’s Data Recovery Case Work
May 23, 2016
burned camera

Originally posted on 5/20/2016, and updated on 6/21/2016. This camcorder data recovery case has been completed.

Burned Camcorder and Hard DriveRecovery Type: Camcorder (Hard Drive)
Drive Capacity: 80GB
Manufacturer: Toshiba
Model Number: MK8034GAL HDD1818 H ZK01
Main Symptom: Fire and water damage
Type of Data Recovered: Videos
Gillware Data Recovery Case Rating: 4

Fire Damaged Camcorder Recovery

The camcorder’s Toshiba MK8034GAL hard drive after being removed from the camcorder and with its faceplate removed.

The camcorder’s Toshiba MK8034GAL hard drive after being removed from the camcorder and with its faceplate removed. The fire and water damage to the drive’s exterior and interior is plainly visible.

In a house fire, tens of thousands of dollars of property can be destroyed in an instant. And while a house can be rebuilt, and furniture can be replaced, the objects which hold a family’s memories are wholly and utterly unique—if they go up in smoke, years or even decades of history go up along with them. But when it comes to data recovery, even a devastating fire may not necessarily mean the end for your family’s digital mementos and keepsakes. Hard drives can be surprisingly resilient, although a hard drive which has been in such a disaster will not give up its data without a fight.

In this case, the client’s family had lost their home to a fire. One of the few objects they were able to pull out from the ashes was a camcorder which had been in use for many years and contained years of family videos—things that could not be replaced or recreated. The camcorder was badly damaged in the fire, and that family’s precious and irreplaceable memories were locked away in the device’s charred little hard drive.

burned cameraFor this hard drive, “little” is not just a cute turn of phrase. The hard drive is quite small. While modern music players, cameras, and phones store their data on internal flash memory chips or on removable SD or microSD cards, there was a time when these devices had to rely on traditional hard drives (that is, hard drives with moving parts).

In order to keep the devices conveniently-sized, it was necessary to use a hard drive with a more petite figure. Although not the smallest traditional hard drive ever made (that distinction goes to the postage stamp-sized drive produced by Cornice), the Toshiba hard drive we pulled from the destroyed camcorder is not a type of hard drive we encounter on a regular basis. The vast majority of the hard drives our engineers see day-to-day are desktop-sized hard drives, which have magnetic data storage platters 3.5 inches in diameter, and laptop hard drives, which have platters 2.5 inches in diameter. The hard drive our senior cleanroom data recovery engineer Mike pulled from the burned camcorder had a single platter 1.8 inches in diameter, and only one magnetic read/write head.
burned camera

The hard drive was in rough shape (but perhaps not as rough as the camcorder we pulled it from, which, like many of the fire- and smoke-damaged devices we receive, stank to high heaven). Not only had it been damaged by the fire and smoke; but the efforts by the local firefighters to douse the blazing flames had also led to water seeping into the camcorder. As a result of the water damage, the screws on the drive’s faceplate had rusted. Some of the rust had flaked off and fallen onto the drive’s platter as well. Luckily, Mike was able to clean the debris off of the platter. Data recovery from fire damaged hard drives depends on the condition of the platters. In extreme cases, the platters could be warped or melted by the heat, rendering data recovery impossible.

burned cameraFurther compounding the issues faced in this case, Mike had to deal with parts compatibility issues. At Gillware, we have cultivated a vast “library” of donor hard drives, which can be plundered for parts as needed. Like an organ donor, these hard drives will give their read/write heads or PCBs to salvage data from our ongoing cases. And like an organ donor, these hard drives need to closely match the recipient. Just as a human body will reject an organ transplant from a donor with an incompatible blood type, a hard drive will not function if its parts do not match properly.

Despite the size of our library, every once in a while we will receive a drive that for some reason or another requires us to seek out more donor drives. In this case, the hard drives we had on hand either had the wrong number of platters and read/write heads, or the wrong arrangement of the two. Since this hard drive had only one platter and one head, data was only written to a single side of the platter; if a donor was used which also only had one head, but it was in the opposite configuration, there would be nothing for the head to read.

After obtaining more donor parts, our engineers were able to read more data from the camcorder’s hard drive. There was considerable damage to the magnetic substrate containing the client’s data, but our engineers were able to fully recover around 35% of the videos from the hard drive. There were also some partially-recovered videos. These videos were mostly functional, but due to bad sectors within the files, there was some skipping and corruption.

Will Ascenzo
Will Ascenzo
Will is the lead blogger, copywriter, and copy editor for Gillware Data Recovery and Forensics, and a staunch advocate against the abuse of innocent semicolons.
//]]>