Recovering the “Unrecoverable”
In Santa Cruz California, the applications of forensic best practices led to the conviction this month of a serial rapist. According to a story in Computerworld, a man by the name of Michael Barnes was accused of multiple rapes. One of his alleged victims came forward to the police, and the police taped her account using a video camera. The interview was recorded onto a DVD.
The DVD became unreadable between the victim’s testimony and the trial, and was needed to secure a conviction. The Santa Cruz, California, District Attorney’s Office contacted two data recovery firms and sent them the DVD. They reported back that, yes, the DVD is unreadable. It appears that these two recovery firms did not apply the basic principals of data forensics: If one can get physical access to the media (DVD, hard drive, thumb drive, etc.), and the data is not encrypted, or over-written, one can always recover the data.
The DA’s parents, by chance, had a neighbor that used to work for Seagate, the hard drive maker. Seagate also has a data recovery division. The DA he sent the DVD to them to attempt a recovery.
Seagate discovered that the “lead-in” file at the beginning of the DVD was damaged, making the DVD unreadable using standard DVD software. Seagate forensically imaged the data on the DVD and then repaired the damaged file. The image of the DVD was then playable, and the original interview was recovered.
Barnes, the accused rapist, was convicted, and sentenced to 24 years in prison on Dec. 5 2008.