Wednesday, December 19, 2012

Can data related to the Sandy Hook shootings be recovered from damaged Lanza hard disk?

As authorities and the public continue ask the question, "Why?," with regard to the Sandy Hook Elementary School tragedy, another question is being asked, as well. Can what might be key evidence in the case be retrieved from a damaged hard drive.

All major mobile carriers on eBay powered by BBYMS
On Monday, authorities announced that a computer at the Newtown, Conn. home where school shooter Adam Lanza lived with his mother was badly damaged. They said the key portion of the computer, its hard drive, appeared to have been badly damaged with a hammer or screwdriver.

However, despite the damaged hard drive, Connecticut State Police spokesman Paul Vance said that officials have "seized significant evidence at [Lanza's] residence," adding that the process of analyzing that much forensic evidence would be lengthy and "painstaking."

The hard drive could in fact hold the key. It could also hold nothing of import. Search evidence on the hard drive, for example, could hold a lot of interest of authorities. What though, are the odds of recovering information from a badly -- and physically -- damaged hard drive.

It is not an impossible task, despite any physical damage. Companies such as IntelliRecovery and The Data Rescue Center advertise that they can recover data from problematic hard drives in a number of situations.

That includes physical media damage, which is precisely the case of the hard drive damage in the Newtown, Conn. shootings.

A traditional hard disk drive -- not one of the new solid state drives -- works (basically) as follows.

Information is stored and retrieved from rapidly rotating discs (platters) coated with magnetic material. Read-and-write heads that operate very close to (often tens of nanometers) "fly" over the magnetic surface. In the old days, a hard drive crash meant just that: the heads failed mechanically, or perhaps even a computer was jarred or dropped, forcing the heads to slam into the platters, literally crashing into them and destroying data.

This is, of course, an oversimplification of the process. But it gives you an idea of how hard drives work.

In terms of data recovery, it's obvious -- or perhaps not -- that any physical damage will result in a loss of at least some data. However, good forensic data recovery companies will be able to recover some of the data, and any data recovered from the Lanza hard drive may prove vital to the investigation.

On Friday, Dec. 14, Adam Lanza killed his mother, then took some of her guns -- including an assault rifle -- along with him to Sandy Hook Elementary School.  There, he forced his way in and killed 20 kindergarten age children and six adults.  He then killed himself, as authorities closed in.

No comments: