Case Study 2 — The Dying Evidence Drive

A departing engineer is suspected of walking out with the company's source code, and the proof lives on his old workstation drive — which is failing. Here the goal is not just to get the data back but to get it back in a way that survives a motion to exclude. This is the same failing-drive problem as Case 1, seen through the forensic lens, where every intervention is a chain-of-custody event.

Background

A mid-size hardware startup discovered, the week after a senior firmware engineer resigned to join a competitor, that a private repository's entire history had been cloned to an external device days before his departure. The company opened an internal investigation and placed a litigation hold. The central piece of evidence was the engineer's company workstation, a desktop with a 1 TB 3.5-inch drive that had been pulled and bagged by IT on his last day and sat in a drawer for three weeks.

When the examiner went to acquire it, the drive was sick. It spun up and was detected, but smartctl showed an ugly picture: 812 reallocated sectors, 144 current-pending, and a climbing offline-uncorrectable count. It read, but slowly, with errors clustered in patches. This was a degrader — the one physical-failure case where careful, immediate imaging by the examiner is both possible and urgent. It was also, potentially, the whole case: the artifacts that would prove or disprove intentional theft — USB device history in the registry, the $FILE_NAME MFT timestamps that reveal timestomping, browser history of cloud uploads, and the tell-tale residue of an anti-forensic tool — all lived on this dying platter.

The investigation

The examiner did everything by the book, because she assumed from minute one that this image would be challenged in court. She attached the drive through a hardware write-blocker to an Atola Insight Forensic imager — chosen deliberately over a host-attached ddrescue session because the drive was evidence: Atola combines robust damaged-drive imaging with built-in write-blocking, automatic hashing, and report generation, which is exactly what an evidence drive demands. She imaged good-data-first, captured a mapfile of every region, and let the imager handle the bad patches with bounded retries rather than letting the OS reset the bus.

   Atola Insight Forensic — acquisition summary
   ────────────────────────────────────────────
   Source: WDC WD10EZEX (1,000,204,886,016 bytes)  via write-blocker
   Image:  EVID-2026-0412-01.e01    Sectors: 1,953,525,168
   Recovered: 1,953,484,900 sectors (99.9979%)
   Unreadable: 40,268 sectors in 3 regions (logged in mapfile)
       region near LBA 1,142,300,000  (overlaps $LogFile / $UsnJrnl)
   Acquisition hash (whole image): SHA-256 e3b0c4...  (recorded)

Two of the three unreadable regions fell in unallocated space and slack — annoying but survivable. The third was the problem: it overlapped the NTFS $UsnJrnl` and part of `$LogFile, the change-journal structures that would help corroborate the timing of the engineer's file activity. And the engineer had been careful: file-access timestamps in $STANDARD_INFORMATION` had been altered (timestomped) to make the repository clone look like routine old activity. The defense against that — the `$FILE_NAME attribute timestamps in the MFT, which the user-facing timestomping tools do not touch — was intact and already told the truer story. But the journal region in the bad zone would have nailed the sequence down to corroborating detail, and the examiner wanted it.

Pushing Atola's retries harder began to make the drive worse — it slowed further and a head started weakening, the read errors spreading slightly outward from the bad zone with each pass. This is the decision point the chapter is built around. The examiner stopped. She had a 99.998% image and its hash; the smart move was not to kill the drive chasing the last 0.002% in-house. She escalated to a forensic recovery lab — and treated the handoff as the chain-of-custody event it was.

Before the drive left the building: she documented the current state and the acquisition hash of the image already captured; she packaged the drive in ESD-safe, tamper-evident materials with a documented seal; she completed and signed a chain-of-custody form; she shipped by tracked carrier; and — the step that mattered most later — she pre-agreed in writing with the lab on the protocol: the imaging method, the hashing, a written record of every intervention performed on the drive, and the form of the returned image and report. She also wrote a short justification memo: a head swap will alter the original, and she recorded in advance why that alteration was necessary and proportionate (the alternative was loss of corroborating evidence the court might want).

At the lab, the drive needed a head-stack swap on PC-3000 to read the failing surface; the lab disabled the weak head, installed a matched donor stack, regenerated the translator, and imaged the previously unreadable region by head. They logged the swap, the donor's identity, the firmware/translator work, and the exact byte ranges newly recovered. They returned a hashed image of the recovered region, their intervention log, and the chain-of-custody form, sealed.

Back in the lab's image, the journal region read cleanly and corroborated the $FILE_NAME` timeline (Chapter 21 builds these timelines). The USBSTOR registry keys recorded the external device's connection at the matching window; the `$FILE_NAME MFT timestamps exposed the timestomping for what it was; and the residue of CCleaner — its own Prefetch and AmCache artifacts, the very traces the tool's use left behind — showed an attempt to wipe activity after the clone. The story held together.

At deposition, opposing counsel did exactly what the examiner had braced for: moved to challenge the evidence as altered — "your own lab opened the drive and swapped its heads; how can you call this the original evidence?" The challenge failed, and it failed on documentation. The image acquired before shipment was hashed and unchanged. The lab's intervention log accounted for every action taken on the drive. The pre-agreed protocol and the justification memo showed the alteration was a documented, necessary exception, performed to recover evidence, not to change it — with a hash before, a record during, and a justification after. The court accepted necessity because it was documented. The rule, as the examiner put it on the stand, "was never never touch the original — it was never touch the original without a hash before, a record during, and a justification after."

The analysis

  1. For evidence, the tool choice is a legal choice. ddrescue would have recovered the data, but the examiner used an Atola imager (write-blocking, automatic hashing, reporting) precisely because the drive was evidence. Recovery asks "how do I get the bytes?"; forensics asks "how do I get the bytes defensibly?" — and the second question chose the tool.

  2. Knowing when to stop protects the evidence, not just the drive. Pushing in-house retries was making the drive worse and risking total loss of the corroborating region. Escalating at the right moment — with a complete image and its hash already in hand — was the move that preserved both the data and its admissibility.

  3. Shipping evidence to a lab is a chain-of-custody event, not a logistics decision. The seal, the signed form, the tracked transit, and especially the pre-agreed written protocol (method, hashing, intervention log, report form) are what turn a third-party lab into a documented, defensible link in the chain rather than a contamination event.

  4. A documented alteration survives; a silent one does not. A head swap alters the original — and that was fine, because there was a hash before, a record during, and a justification after. The motion to exclude failed not because nothing was altered, but because every alteration was accounted for and justified.

  5. The drive nearly cost the timeline, but the artifacts were resilient. Even with the journal region temporarily unreadable, the $FILE_NAME MFT timestamps already defeated the timestomping, and CCleaner's own residue exposed the cleanup attempt. Anti-forensics rarely beats a thorough examiner (Chapter 30) — and good acquisition discipline meant a failing drive didn't either.

Discussion questions

  1. The examiner reached for an Atola imager instead of free ddrescue. List the specific properties of an evidence drive that justified the more expensive forensic imager, and explain what ddrescue would not have given her.

  2. The lab's head swap altered the original evidence drive. Walk through exactly why that did not get the evidence excluded — name each piece of documentation that defeated the challenge and what it proved.

  3. Two unreadable regions were in unallocated space and one was in the $UsnJrnl`/`$LogFile. Explain why the examiner cared so much more about the third region than the first two, and connect it to building a defensible timeline.

  4. ⭐ Suppose the failing region had overlapped the only copy of the decisive artifact, and the lab had honestly estimated the head swap at 50/50. How would you advise the client and counsel? Discuss the proportionality and spoliation tensions: a party cannot declare data "lost" without showing reasonable recovery efforts, but recovery is uncertain and the alteration is irreversible.

  5. Contrast this case with Case Study 1. Both were failing drives; one was a photographer's library and one was litigation evidence. Identify three points where the correct action diverged because one was a recovery job and the other a forensic one — and one principle that was identical in both.