Presentation at CEIC 2015, Las Vegas, Nevada - Water Damaged Devices, Evidence Locker Corrosion. Water Damaged Devices, Evidence Locker Corrosion is project number one is a series of research projects related to water damaged devices. The Damaged Devices projects seeks to investigate the potential for data recovery from severely damaged devices including damage from water, fire, impact and ballistics.

1. www.encase.com/ceic
Water Damaged Devices
Evidence Locker Corrosion
PUBLIC
Presented
21 May 2015
At CEIC 2015

2. The opinions expressed and materials shared in this
presentation are my own and may not reflect the opinions,
policies, procedures or advice of my employer, committees
or groups in which I participate.
Disclaimer
WDD001 – Evidence Locker Corrosion
Page 2

3. How does water damage a phone?
WDD001 – Evidence Locker Corrosion
Page 3

4. FitBit One
Page 4

5. Apple iPhone 4S
WDD001 – Evidence Locker Corrosion
Page 5

6. Problem Statement
• Every agency will encounter a damaged
mobile device.
• Strong, conflicting opinions exist within the
community.
• Little research exists in the digital
forensics space on this topic.
• Most of the information is marketing
materials.
WDD001 – Evidence Locker Corrosion
Page 6

7. Forensics:
1. K. C. Dudeck, T. C. Brennan and D. J. Embury, "Decontamination of blood soaked
electronic devices using ultrasonic technology," Forensic Science International, vol.
214, pp. 88-95, 2012.
2. R. van der Knijff, "Chapter 8 - Embedded Systems Analysis," in Handbook of Digital
Forensics and Investigation, E. Casey, Ed., Burlington, MA: Elsevier Academic
Press, 2009, p. 396.
3. Scientific Working Group for Digital Evidence., DRAFT - SWGDE Best Practices for
Handling Damaged Mobile Devices, USA: SWGDE, 2014.
4. Scientific Working Group for Digital Evidence., SWGDE Best Practices for Handling
Damaged Hard Drives, USA: SWGDE, 2014.
Existing Literature:
Master Title
Page 7

8. Damaged Devices Research
Series of research projects focused on
damaged devices:
1. Liquid (water) damage [WDD]
2. Thermal damage [TDD]
3. Impact damage [IDD]
4. Ballistics damage [BDD]
WDD001 – Evidence Locker Corrosion
Page 8
Photo reference links
(clockwise): 1, 2, 3, 4

9. Damage Project Reference Description
WDD
Water
Damaged
Devices
WDD001 Evidence Locker Corrosion
WDD002.001 Baseline for cleaning, resulting in acquisition.
WDD002.002 Expanded WDD002.001 with LDN water.
WDD002.003 Repeat WDD002.001 with powered on.
WDD002.004 Extend time duration of WDD002.001
WDD003 Water damage longevity study.
WDD004 Efficacy of cleaning products.
WDD05 Efficacy of drying techniques.
WDD006 Transport from scene to lab.
WDD001 – Evidence Locker Corrosion
Page 9
Status/Color
DONE
CURRENT
FUTURE

10. Survey Input
Frequency of Receiving WDD
Frequently 23.08%
Monthly 15.38%
Annually 61.54%
Duration Underwater
1 day 16.67%
3 day 33.33%
7 days 16.67%
30 days 25.00%
365 days 8.33%
Time until Cleaning
12 hours 10%
1 day 10%
3 days 50%
7 days 10%
30 days 20%
Liquid Type
freshwater (as primary liquid) 69.23%
brackish water (secondary liquid) 15.38%
salt water (secondary liquid) 23.08%
blood (secondary liquid) 23.08%
other liquid 7.69%
Cumulative input from
federal, state, local
agencies and supporting
vendors.
WDD001 – Evidence Locker Corrosion

11. WDD001 – Evidence Locker Corrosion
50% of survey responders said 3 days
until device is cleaned to attempt data
acquisition
First responders pulling device from water,
letting the water drip out, then placing in an
evidence bag.
3 days
1 month
6 month
9 months
11
WDD001 – Evidence Locker Corrosion

12. Project Setup
• 10 devices
• 9 submerged, 1 control
• 3 days submersion
• Freshwater pond – water
tested
WDD001 – Evidence Locker Corrosion
Page 12

13. Freshwater Pond
WDD001 – Evidence Locker Corrosion
Page 13
Westminster,
Colorado

14. Phones Used – HTC SDA / Tornado (ST22A)
WDD001 – Evidence Locker Corrosion
Page 14

15. Project Setup
WDD001 – Evidence Locker Corrosion
Page 15

16. WDD001 – Evidence Locker Corrosion
Page 16

17. pH is a quantitative measure of the hydrogen ion concentration in an aqueous solution.
The pH scale ranges from acidic to alkaline or alkalinity of an aqueous solution.
Total dissolved solids (TDS) is a measure of the mineralization in aqueous solutions.
This measure is informative in determining the overall ionic effect in the solutions.
Electrical Conductivity is the ability of a solution to transfer (conduct) electric current.
It is the reciprocal of electrical resistivity (ohms).
Chlorine is a measure of the dissolved chlorine in the aqueous solution.
Temperature measured in Fahrenheit.
Water variables measured in WDD001
WDD001 – Evidence Locker Corrosion
Page 17

18. Date Time pH TDS (PPT) EC (mS/cm) Temp(F) Chlorine
10/13/14 0630 7.66 0.29 0.59 48.8 0
10/16/14 0646 8.61 0.35 0.70 54.5 0
Water Variables
WDD001 – Evidence Locker Corrosion
Page 18
Testing Notes:
• The differences in variables is outside of the bounds for temperature change.
• This is one of the challenges of live water testing. Water variables can change
while devices are submerged.

19. Submersion
WDD001 – Evidence Locker Corrosion
Page 19

20. GoPro HD
• Waterproof case
• Zip-tied to end of cage
• Photos every 30 seconds
until battery ran out.
WDD001 – Evidence Locker Corrosion
Page 20

21. Retrieval
Phones retrieved after 72 hours (3 days).
All phones were present.
All phones were powered off.
GoPro HD had ran out of battery.
Allowed water to run out of phones then
logged in evidence bags.
WDD001 – Evidence Locker Corrosion
Page 21

22. Device Submerged Remediation
WDD001-001 control control
WDD001-002 3 days 0 hours
WDD001-003 3 days 24 hours
WDD001-004 3 days 3 days
WDD001-005 3 days 7 days
WDD001-006 3 days 30 days
WDD001-007 3 days 60 days
WDD001-008 3 days 90 days
WDD001-009 3 days 221 days (TODAY)
WDD001-010 3 days 270 days
WDD001 – Evidence Locker Corrosion
Page 22

23. Potential Damage to WDD
1. PCB Layer Damage
2. Rust
3. Pitting on the PCB traces
4. Corrosion (galvanic or electrolytic)
5. Damage to SMT leads
Water Damage Assessment Scale
PCB Layer Damage -1 to 0
Rust -1 to 0
Pitting on PCB
traces
-1 to 0
Corrosion -2 to 0
Damage to SMT
leads
-2 to 0
Created as part of WDD002.001 to distinguish between the
damage that was being identified on the PCBs.
WDD001 – Evidence Locker Corrosion
Page 23

24. Additional Risks to Consider
1. Mold
2. Biological hazards
3. Battery damage
4. Electric discharge
WDD001 – Evidence Locker Corrosion
Page 24
Photo Reference Link

25. Examples:
• Transport
• disassembly at scene, straight into evidence bag
• transport in liquids, dry off before transport
• Cleaning
• water, isopropyl alcohol, “Scrubbing Bubbles”, industrial cleaners
• ultrasonic cleaners, forced water, brushing debris from PCB
• removing RF shields on PCB?
• Drying
• air dry, forced air dry, heat (oven)
Disagreements on how to address WDD
WDD001 – Evidence Locker Corrosion
Page 25

26. Rule #1
Practice, practice, practice
▫ Don’t practice on pieces of evidence.
▫ Get some phones to practice disassembly.
▫ Practice powering a phone without a battery.
Rule #2
Understand whether you will need to reassemble the phone.
Rule #3
Right tools for the right job.
Demonstration – Disassembly of the phone.
WDD001 – Evidence Locker Corrosion
Page 26

27. 1. Review with microscope at the board level.
2. Identify areas of concern.
3. Suggestions for how to address problem areas.
Demonstration - Identification of damaged areas.
WDD001 – Evidence Locker Corrosion
Page 27

28. Explanation of tools, techniques and processes to clean the device.
Demonstration - Cleaning of the device.
WDD001 – Evidence Locker Corrosion
Page 28

29. Explanation of three methods for cleaning the device.
1. Air dry.
2. Dessicant.
3. Forced air dry.
4. Heated convection air dry.
Presenter’s preferred method?
Demonstration - Drying of the device.
WDD001 – Evidence Locker Corrosion
Page 29

30. 1. Powering the device.
2. Acquisition options.
3. How far is too far gone?
Demonstration - Preparation for acquisition..
WDD001 – Evidence Locker Corrosion
Page 30

31. What information do I want you to take back to your
agency?
1. Remove battery as soon as possible.
2. Do not attempt power-on or charge until dry.
3. Data is indicating device is more stable if transported
in water to lab for cleaning.
4. If you can’t transport in liquid, disassemble and make
best effort to dry before shipping or storing.
5. Do not expect devices in evidence bags for 9 months
to be successful acquisition.
Current Recommendations regarding WDD
WDD001 – Evidence Locker Corrosion
Page 31
My opinion will
continue to change
and evolve as the
data emerges in
these research
projects.

32. 1. Identify organizations who are interested in this research.
2. Practitioners and researchers who are interested in partnership.
3. Funding for equipment, devices, lab supplies, cleaning chemicals,
Research Support
WDD001 – Evidence Locker Corrosion
Page 32

33. Contact Details
Steve Watson
Westminster, Colorado US
forensics@stevewatson.net
www.stevewatson.net
www.damageddevices.com
WDD001 – Evidence Locker Corrosion
Page 33