Have you ever wondered what it was like to be one of our data recovery cleanroom engineers? I asked Steve Hruska, a Hardware R&D Engineer at Kroll Ontrack to take a day and document what he does. Here is a glimpse of what it is like to be a cleanroom engineer:
8:00 a.m. – Arrive at office. Continue to acquire raw data from an SSD which is in for Erasure Verification Service. The client in this case has performed an erasure using a proprietary method and would like to know that the data on the SSD is in fact gone and not recoverable. If the data is gone, the client knows that their method was successful. The acquisition process often involves removal and reading of the raw NAND from an SSD. The chips that were started yesterday have concluded reading and the next batch of chips is set up and reading begins. This will take some time so we move on to the next item on the list.
8:30 a.m. – Analysis of jobs which came in late yesterday afternoon and early this morning. The first job picked up is an LG smart phone logic board which was sent in for recovery. No outer casing, screen, or battery; just the main circuit board. After a brief bit of research to determine the phone model, it is decided that the data can be acquired regardless of its current condition. Once data acquisition begins, it is on to the next job until reading has concluded.
9:30 a.m. – The next in line is an iPhone 5S which has seen better days. The screen is cracked and bent significantly. There also appears to be damage to the rear case of the device. Run over by a car perhaps? Regardless, repairs are going to need to be attempted in order to get the data back. The iPhone is disassembled and the main logic board analyzed. There is some component damage as well as outer case damage but not too daunting. With repairs completed, the device is plugged in. Success! The phone boots up and the user data is accessible. Data is then copied out and parsed into a usable format for the client. The phone is reassembled and the data sent to the lab.
10:30 a.m. – Moving on to a USB thumb drive which the customer accidently kicked while it was plugged into their PC. The USB connector has ripped off of the board and minor component damage exists as a result of the shock. Repairs are made and all user data acquired.
11:30 a.m. – Just arrived is an SD card which looks to have been chewed on by a dog. Upon further inspection, it is revealed that the NAND is critically damaged. Unfortunately, there is no chance of recovery for this one. Reassembled and sent out to shipping for return to the customer.
11:45 a.m. – The LG smart phone acquisition from earlier in the day has concluded. The data is parsed into usable format and sent out to the lab for further analysis.
12:45 p.m. – Lunch and an email check. Answered support emails from a few of our global Cleanrooms.
1:30 p.m. – The EVS NAND readings from this morning have concluded. Loaded another batch into the readers
2:00 p.m. – Another iPhone is in. This time it is an iPhone 4S with significant power issues. A custom solution is required for this one. Method tested and implemented, resulting in 100% of the user data recovered.
3:30 p.m. – Email check. Among the emails in my inbox are requests for additional internally developed tools. In this case, another office has been seeing an influx of a particular drive for which we have a custom tool. More tools are needed in order to keep up with their queue. The tools are manufactured and sent to offices.
5:00 p.m. – One last email check before heading out.
As you can see from Steve’s day it takes perseverance and a major ability to multi-task along with the technical knowledge and skills. Not just anyone can be a data recovery cleanroom engineer.