Saving Data on a Hard Drive

¶ … Preservation

The author of this report has been asked to assess a brief and fairly simple case study. Basically, the author is theoretically at the scene of an arson. At the scene of the arson is a computer with a ten gigabyte hard drive. The author is in the process of creating an image of that hard drive. However, the fire has apparently rekindled and there are only a few minutes to get the hard drive's data to safety. The author of this report has been asked to offer options as to what can be done to save the data before it is too late. While there are not a ton of options given the situation involved, there are indeed a few and at least one of them (if not more) should be viable.

Analysis

The first option, if possible, would be to let the image complete. However, there is a good chance that is not possible. Ten gigabytes is not a ton of data but it is not a small amount either. If the image can be completed before getting out of the building, that would be the obvious and easy way to go. The second option would be to just unplug the computer or whatever the drive is in and carry the entire unit out of the building. If the drive is in a laptop or a desktop computer, that would be the way to go. It should take no more than thirty seconds to unplug the cords from the back of the computer and get it out of the building. Turning off the computer in a "hard" fashion is not the best of ideas but it beats having the entire drive incinerated and thus making it impossible to get anything off the drive.

If the computer is locked in place and cannot be removed so easily, another option would be a dump onto a USB flash drive. Preferably, the drive would be a USB 3.0 drive and the computer would hopefully be compatible with that standard. If the computer has USB 2.0 or older, there is little to no chance that the drive can be emptied in time. An option that is somewhere in the middle would be whether the computer case can be opened. Indeed, if the case of the computer is locked but the hard drive is accessible, then the driver can simply be popped out. For example, if the hard drive is in a laptop and it is locked to a desk using a lock port on the side of the unit, all that should be required to get the hard drive out is flipping over the laptop and popping out a few screws. The RAM, hard drive and other oft-changed or upgraded components are typically removable in this way. However, the only real useful of those would be the hard drive as the RAM is wiped upon shutdown and is not where the important data is stored.