Digital Forensics for Broken Devices

Have a broken device with some unanswered questions?

Broken Device Forensics

The vast majority of the devices a digital forensic investigator encounters in their work are fully functional, except for the occasional smartphone with a cracked screen, or a device with some other sort of superficial damage. Light wear and tear may mean additional hoops to jump through for forensic investigation. But what about a device that’s suffered some real damage? It’s rare, but you may encounter phones or tablets that have been dropped, run over and crushed, submerged in water, burned, or suffered any other kind of grievous injury that stops them from working altogether. In addition, smartphones and tablets aren’t the only things that can be damaged beyond the point of functionality. What do you do with a damaged USB thumb drive or hard disk drive? When you need forensic analysis on storage devices in these conditions, you need to turn to specialists in broken device forensics.

Properly and safely extracting the data from a device and analyzing and documenting its contents is challenging enough when the device works properly. A malfunctioning or broken device is another kind of beast altogether. Digital forensic work for broken devices requires a special set of skills, tools, and techniques.

Broken device forensics

Broken Android and iOS Mobile Phones and Tablets

Mobile phones and tablets in particular are vulnerable to physical trauma. A lot of mobile devices can really take a pounding, because their manufacturers know that people slip up and accidents happen. Phones and tablets get dropped or get water spilled on them all the time, and nobody would buy expensive mobile phones and tablets if their butterfingers could easily turn that $700 iPhone into a useless pile of scrap. But, of course, there are limits to every device’s durability. Everything can break. Phones, tablets, watches, and other smart devices are no exception.

The good news is that while a mobile device may be inaccessible by the usual methods due to severe enough damage, the information stored within it isn’t lost forever. The data on these devices live in flash memory chips inside the device. A phone’s SIM card, eMMC or eMCP chip, and removable microSD card, for example, are often relatively unharmed, even when the phone gets smashed or crushed. The data from these chips can prove vital, and can be extracted and analyzed via chip-off forensic techniques. In some circumstances, a skilled electrical engineer can repair a broken mobile device and extract data from it without needing to physically remove the chips.

"Spiderwebbing" the chip in a monolithic USB drive

Broken Flash Devices

Flash devices, as their name implies, store data using flash memory, just like smart devices. USB flash drives, or thumb drives, are often used to transfer data from “Point A” to “Point B”. SD and microSD cards can typically be found inside just about any device, from mobile phones and tablets to digital cameras, as a form of removable data storage. Portable flash devices such as these are often used and reused, and the data on them and the machines they’ve been connected to can answer a great many questions regarding their use.

But these small, portable devices can also be very fragile. USB thumb drives in particular can suffer enough damage to render them inoperable just from being mishandled when plugged into a device, due to the weak connection between the USB plug and the rest of the device. Thumb drives and SD cards can also suffer electrical damage that may stop them from functioning. Corruption to their filesystem metadata, which can be caused by ejecting these devices too suddenly, can also make them appear inoperable, even if they are still physically healthy.

When a portable flash device is non-functional, repairing it and recovering its data can require the expertise of an electrical engineer. In some cases, the NAND or NOR flash memory chip in these devices must be removed to perform a chip-off analysis.

Hard drive forensics

Broken Hard Disk Drives

Hard disk drives have dominated data storage for decades, and while solid  state drives are steadily encroaching on their territory, they are still the primary—and often secondary—form of data storage in the vast majority of computers today. Users typically store the vast majority of their data on the internal hard drive inside their computer, with many also hooking up portable external hard drives via USB cable for extra storage capacity.

Hard drives have very sensitive moving parts inside them. All of the data contained on a hard drive live within its hard disk platters, which store binary information in the form of magnetic charges on a thin coating of magnetic substrate over aluminum or glass. A brushless spindle motor spins the platters at thousands of revolutions per minute. Read/write heads, like the needle of a record player, transmit data to and from the platters by hovering several nanometers over their surfaces. These moving parts make for a lot of failure points, making hard drives especially vulnerable to damage from physical shock… or just old age.

You’re accustomed to seeing hard disk drives that function more or less perfectly. What do you do when you encounter one that doesn’t?
When a hard disk drive breaks down, it takes special tools and expertise to salvage the data from it for further forensic analysis. Finding people with access to these skills and techniques and sufficient know-how in the field of digital forensics as well might sound like a tall order. But this combination of specialists is exactly what Gillware has to offer.

How Gillware Serves Your Broken Device Forensics Needs

The job of a digital forensic investigator is to safely acquire, extract, and analyze the data found on data storage devices and to interpret, document, and report on their findings. With the data recovery specialists at Gillware on our team, our forensic investigators can help you when you need the data on a broken device to be forensically examined.

We leverage the expertise of specialists from two worlds: the world of digital forensics, and the world of data recovery. We provide unparalleled services in broken device forensics for law enforcement officers, legal firms, corporations, and other clients.

Our data recovery crew has been repairing and salvaging data from broken storage devices for over a decade. With cleanroom facilities and cutting-edge tools, Gillware has made a name for itself as a world-class provider of data recovery services for all kinds of broken devices. Our digital forensics department was established in 2016, combines over 10 years of data recovery expertise from our data recovery lab with the experience of seasoned digital forensics experts, offering over 25 years of combined experience in both fields.

Consult Our Specialists in Broken Device Forensics

Gillware offers forensic assessments for any kind of broken device, including mobile devices, flash devices, hard drives, solid state drives, and other devices capable of storing data. After an initial assessment and consultation, our digital forensic experts extract the data from the device and conduct an in-depth analysis. After thoroughly documenting and reporting on our findings, our forensics experts can also offer expert testimony in court, if needed.

Have a broken device with some unanswered questions?