Data recovery from logically and physically damaged or corrupted storage media - Angielska wersja językowa - Policja Kujawsko-Pomorska

The training has been completed as part of the project „Specialized training as an opportunity to increase effectiveness of law enforcement agencies in the fight against organised crime”. The project has been financed with Norwegian Financial Mechanism`s means and a state budget within the programme „Internal Affairs”. The programme is under supervision of Interior and Administration Ministry.

Nowadays, data storage is extremely important. Every day we generate huge amounts of data that are stored on the hard drives of our devices. Companies use data collected in databases stored on drives arrays. Unfortunately, any device can fail, resulting in data loss that can be of great importance in criminal cases and affect the investigation process.

The training in Katowice took place at the headquarters of the “Mediarecovery” company – a leader in computer forensics. The trainer was an experienced specialist with many years of practice in the field of recovering data from damaged media. During the classes, participants learned about technologies and methods used in the process of recovering data from file systems such as NTFS, FAT, ReFS, Ext, UFS, HFS, APFS located on HDD and SSD hard drives. Each of the participants was acquainted with the modules of service area (SA – service area) and methods of their repair in order to gain access to the information on the medium. In addition, employees and officers of the Provincial Police Headquarters in Bydgoszcz, as part of the workshops, could practice the replacement of disk electronics, copying ROM content and replacing damaged heads in various types of hard drives. Another practical issue implemented as part of the training was the detection of damage to SSD drives and the disassembly of memory chips using the precise soldering process. With the use of specialized software and adapters for reading data directly from the memory chip, we were able to read the data could not be accessed from the drive’s electronics.

Summing up the above training, we can say that for the participants of the training it was a great opportunity to gain new skills and knowledge in the field of data recovery, which will significantly improve their qualifications and increase the detection capabilities of the Forensic Laboratory in Bydgoszcz.