|
Rescue for Pine Grove: Data Recovery Resurrects a Library By Steve Burgess, 2014 On the morning of May 21, something happened. Suspicion fell first on kids playing with matches. But a Fire Department investigation soon revealed that it was faulty wiring in the walls that started the fire. The temporary building that permanently housed the Pine Grove Elementary School’s library in the town of Orcutt, California was no more. The formerly bright interior had taken on the cast of a coal mine. Well before the investigation was concluded, community members and organizations donated thousands of dollars in cash and services to help rebuild. But there was a problem. The building still stood, but its entire contents had been destroyed – books, shelves and desks turned to ash and embers. While the contents were insured, the data cache containing a listing of the contents was in a laptop on a burned desk in the building. The plastic of the laptop bore a strong resemblance to volcanic ejecta. There was no way to turn the computer on, and the backup for the data had been kept on a CD. The CD had been kept in the drawer of the desk on which the laptop sat. And the CD was now a puddle of melted plastic. Fortunately, this is when Burgess Consulting & Forensics entered the scene. Using a mask and gloves, the first part of the project, after peeling the remains off the desk, was an archaeological expedition to the location of the hard disk inside the laptop. Knowing where was half the battle. A Dremel tool with various attachments allowed the excavation to proceed apace. A careful cleaning of the outside of the drive allowed further inspection to proceed without contaminating the drive. Once the grit & smoke residue was removed, it became clear that several of the traces connecting the guts of the hard disk with the electronics outside the hard disk had burned through. These were repaired with small jumpers soldered onto the exposed traces of the membrane cable as it emerged from the hard disk’s insides. The drive was opened in a clean room environment and miraculously, the smoke had stayed out of the enclosed portion of the drive. With delicate machinery, and clearances measured in microns, this was an important factor in the potential success of the recovery. Smoke particles can be larger than the clearance between read/write head and platters, making the process of reading the platters impossible. The drive was attached to a write-blocker and every byte of the drive was transferred to another device. The partition structure was carefully rebuilt, and the file structure recovered. In the end, Burgess recovered all of the data – for free. The school district’s alternative would have been to go through the costly process of examining decades of purchase orders and receipts in order to have even an estimate of the library’s charred inventory. But instead, a complete and up to date record could be presented to the insurance company. And finally, the recovery was complete. What is the moral of the story? There are two. The first is about backups. Keep your backups current. And keep a copy off site. The second is about community. Communities come together to make rebuilding from a disaster possible. Even with the resources of the school district, and funds from insurance, the reason the library could get back on its feet quickly, replacing its 8,000 book inventory and providing badly needed services to the children of Pine Grove once again was due to generous contributions of funds and services. It took one fire to wreck a library, but it took one community to rebuild. Burgess Forensics: Computer forensics, data recovery, expert witness – Since 1985
Related Articles -
Data Recovery, School fire, computer crash, computer fire,
| 
