Data Recovery from liquid damaged devices

Data Recovery from liquid damaged hard drives

At CDS, we handle a large number of liquid damaged hard drives each year. We would like to give you an in-sight into what is involved in recovering data from such devices.

Most drives that we see have failed due to accidental spillage onto a laptop of liquids such as:

• Tea
• Coffee
• Water
• Wine
• Beer
• Other alcoholic drinks

Depending on the time of the year and mother nature, we see flooded drives that have been submersed in river or sea water for prolonged periods. We also handle drives that have suffered fire damage and subsequent water damage from fire-fighting efforts.

In the vast majority of cases, the only significant damage is to the Circuit Board (PCB) on the drive. Specific components can fail and/or corrode.

The first stage in recovering these drives is the decontamination of the drive. We remove the PCB and clean it in an ultrasonic bath with a specialised liquid formula, followed by deionized water. Once cleaned and dried, the PCB is inspected for component damage. With modern drives, it is no longer possible to simple “swap” the board from an identical drive. Modern drives store “adaptive” data within surface mount chips and this unique data must be transferred to a new PCB. If this is not done, the drive will spin but it will never initialise fully and the data area will not be accessible.

The drive body is cleaned externally and once dried, it can be opened in our Class 100 clean-room for internal inspection. The top cover of all drives has a “breather hole” to regulate air pressure inside the drive chamber. This breather hole is protected by an air filter with a desiccant pad to absorb moisture.

If a drive has been subjected to external moisture or “minor” liquid damage such as spillage of coffee across a laptop, it is highly unlikely that any moisture will have entered the drive chamber. The breather hole is very small and the filter prevents any moisture ingression.

However, if a drive has been subjected to sustained liquid submersion, it’s a different story. The picture below shows a Fujitsu 2.5″ Laptop Hard Drive that was submersed in sea water for a period of 4 weeks:

This drive had suffered extreme water damage and has been badly corroded internally. Despite our best efforts with this drive, it was not recoverable. This drive was in a laptop that had been maliciously damaged and then thrown into a river. The platter had been damaged prior to the water submersion.

The following photographs show drives that had been flooded and submersed in river water. These drives spent approximately 48 hours underwater. As can be seen, the water had breached the drive seal and has contaminated the drive. Components inside the drive had begun corroding but the platter

was intact and largely unaffected. The drive was thoroughly cleaned and the platter was swapped into a new housing. The heads and associated components were replaced and the drive was successfully recovered.

Some tips for dealing with liquid damaged hard drives:

• Do not try to power on a liquid damaged hard drive
• Do not try to dry the hard drive out
• Do NOT open up your hard drive under any circumstance
• Do NOT swap or replace any electronic components
• If a liquid spillage occurs on a laptop, turn it upside down (keyboard down) or on it’s side away from the hard drive to drain the liquid away from the hard disk
• Call CDS for advice immediately – a drive will begin to corrode quickly so it is imperative that it is dealt with quickly