Title: Forensic analysis and data recovery from water-submerged hard drives

Authors: Alicia Francois; Alastair Nisbet

Addresses: Cybersecurity Research Laboratory, ITSE Department, School of Engineering, Computer and Mathematical Sciences, Auckland University of Technology, Auckland, New Zealand ' Cybersecurity Research Laboratory, ITSE Department, School of Engineering, Computer and Mathematical Sciences, Auckland University of Technology, Auckland, New Zealand

Abstract: In many digital forensic investigations, a common location to recover files as evidence of wrongdoing is a computer hard drive. Hard drives have increased greatly in storage capacity since their introduction in computers in the 1950s making them a rich source of evidence for the forensic investigator. This awareness may also lead to the destruction of hard drives or entire computers by throwing them into water in an attempt to prevent recovery of data. This research looks at the solid state hard drives alongside platter hard drives in particular and the time water will take to enter the hard drive once it is submerged. Experiments show that once water has entered the drive, various components will be affected by the water and the drive will become inoperable. A guide for forensic investigators is constructed indicating the likely time required to recover the drive before water ingress occurs, and the various parts of the drive that may be damaged and whether repairs or replacement of those parts is possible.

Keywords: forensics; security; hard drive; water damage.

DOI: 10.1504/IJESDF.2021.113374

International Journal of Electronic Security and Digital Forensics, 2021 Vol.13 No.2, pp.219 - 231

Received: 27 Jul 2019
Accepted: 01 Mar 2020
Published online: 02 Mar 2021 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article