Posted on by Marco Caezar Lim

These tips can significantly increase the chances of success in your recovery when submitting items for Damaged Media Recovery

Many people have sent Cyber Forensics Laboratory (CFL) devices that could have been recovered, but their attempts made additional recovery impossible.

Same make/model/size, site code, date code, etc.

Do not attempt to recover data from a damaged device

Please advise if you plan to perform the examination of the data yourself after recovery.

Please advise if you plan to perform the examination of the data yourself after recovery.

Attempt to prevent the device from further damage and contamination from its surrounding environment.

If you are sending a hard drive that has a breach exposing the internal cavity of the drive to the outside environment, attempt to stop continued contamination by sealing the drive in an anti-static bag or other means with equal or greater physical and environmental protection.

Several factors come into play when preparing captured devices for shipment and/or storage if they have been submerged. These factors will determine whether or not the item should remain submerged in its original substance and what other kinds of preparations should be made on the device.

  • How long has it been submerged?
  • What is the substance in which it is submerged?
  • What kind of device is it?