Two men—Derick Almena and Max Harris—were charged with manslaughter. Authorities said Almena rented the warehouse and lived there with his family. Harris was also a building occupant who helped sublet the space to low-income artists seeking housing.
Earlier this year, the two men pleaded no contest to involuntary manslaughter and will each face several years in prison. We are never able to discuss a case that DriveSavers is involved with while it is in progress, so this is our first opportunity to share our side of the story.
The Ghost Ship Story: Data Recovery and Digital Forensics
The Alameda County District Attorney’s office approached DriveSavers for help in recovering electronic evidence from three mobile phones that were destroyed in the fire that consumed the Oakland artist collective known as the Ghost Ship in the early morning hours of Dec. 2, 2016.When the phones arrived at DriveSavers, we found heavy damage done by the fire and fire hoses. With this extent of heat and water damage, our first step toward digital forensic data recovery was to thoroughly clean the internal mechanisms on each phone and replace damaged components in an effort to get the phones to work one last time—just temporarily—so we could make a bit-by-bit copy of the raw data inside.
One phone—an LG Android—was bent, including a bent PCB. There was also corrosion on several connectors and components. This recovery required cleaning the corrosion as well as a chip-off and repair of the flash memory in order to extract data.
A second phone—a ZTE Android phone—was missing the power connector for one of its contact pins and had corrosion on its PCB assembly. For this device, DriveSavers data recovery engineers had to build a custom power connector pin and install that after cleaning the device.
A third phone—a Nexus Android phone—had severe water damage and corrosion throughout the device, as well as several missing components. This data recovery required cleaning and chip-off of the Toshiba memory.
DriveSavers was able to successfully recover data from all three phones, extracting information that proved useful in the case.
What is Digital Forensics?
When a mobile device such as a smartphone or tablet is identified as holding possible evidence, the device must be collected and preserved as soon as possible. Data can change quickly and preserving digital evidence is the highest priority.Historically, DriveSavers has developed a good working relationship with legal counsel, law enforcement and government agencies to pull relevant electronic evidence from mobile devices that can be used in court. This discipline is known as digital forensics.
Here are the types of information that can be collected through digital forensics work on mobile devices, also known as mobile forensics:
- Call logs and history, including calls dialed, calls received, call times, call durations and missed calls
- Text messages (SMS, application-based and multimedia)
- Contacts, including contact names and phone numbers
- Address book, including residential and email addresses
- Calendar entries
- Task lists
- Pictures, videos and audio recordings
- Social network artifacts (Facebook, Twitter, IM)
- Application data
- Timeline of user activity
- GPS data
- Apple Wallet
- iCloud backup
- Emails
- User-created data
- Passwords, passcodes, swipe codes and user account credentials
- Notes and reminders
- Health information
- Cell Tower, GPS coordinates and Location Services
The Whole Story
More and more, smartphones hold information that is not only essential for our daily lives but also for use in investigations. In cases like the Ghost Ship Fire and other tragic events, smartphones often record our loved one’s last moments. More and more, the whole story can’t be told without the data found on a smartphone.The post The Ghost Ship Tragedy: A Look Back on the Two-Year Anniversary appeared first on DriveSavers.
from DriveSavers http://bit.ly/2BS6WcH