Data Recovered From DVD Leads To Conviction, 24-Year Sentence

Lucas123 writes "The Santa Cruz, Calif. DA's office had been counting on a DVD with the recorded testimony of a victim in case against a serial rapist, but when they popped the video into the player, nothing came up — the disc was blank. To make matters worse, the cop who performed the original interview with the victim told the DA she never said she was 'forced,' so the judge wasn't going to allow the witness to testify in a case where her original statement to police was in conflict with her current testimony. After two local data recovery firms said there was no way to restore the data, a third was able to recover the police interview from two years earlier, which led the defendant to plead guilty earlier this month. Close call."

Comments

Only Meta-Data was damaged

[imaginaryelf]

"Our analysis showed there to be damage to the lead-in section of the data," Keith Gnagey, vice president of professional services for i365, said in an e-mail statement about the recovery effort. That meant any attempt "with normal playing software would not be able to get past the beginning of the data."

That's like the directory tree being messed up but the data being intact.

I can't believe the other "two local data recovery firms" got stumped by this simple problem.

Re:Only Meta-Data was damaged

[Compholio]

Almost sounds like a DVD that wasn't finalized in a direct-to-dvd camcorder.

I don't know about that, but I've run into this problem when there's dust on the disk when it's recorded. The laser etches the dust rather than the media, resulting in a disk that's got a small blank section.

Re:Only Meta-Data was damaged

[Belial6]

When my father owned a computer shop, he would regularly get people trying to sell him software that would let him do "data recovery". There was no way my father was qualified to do data recovery. He eventually focused only on printer repair because he found he wasn't really qualified to even do most PC work. That didn't stop the sales guys from trying to convince him that if he bought their software, he would do fine in the "data recovery" field.

So, it doesn't surprise me that two local data recovery firms got stumped. They probably ran the software they bought against the DVD and when nothing came up, they said it was unrecoverable.

Re:Only Meta-Data was damaged

[noidentity]

I've run into this problem when there's dust on the disk when it's recorded. The laser etches the dust rather than the media, resulting in a disk that's got a small blank section.

You may have had that problem with dusty media, but the explanation sounds suspect. The laser beam is focused to a point inside the disc, not at the surface; at the surface, it's wide and dust simply reduces its intensity at the focused point (diagram). Looks like BD discs have much less tolerance of dust, due to the data layer being so close to the surface.

Re:Only Meta-Data was damaged

[The MAZZTer]

I wonder if there's any people out there who intentionally corrupt an ISO image in a controlled way that is known to be recoverable by someone who knows what they are doing (but not perhaps by automated tools) and then sending out burns of the DVD to different companies to see what they can do.

Might be expensive though.

Re:Only Meta-Data was damaged

[Hal_Porter]

Actually that makes me think of a hair brained scheme. The finger print is essentially a mask applied to the data. Your eyes can see it but the DVD drive error corrects it away because there are enough gaps in the mask where the original data 'shows through' for the error correction to correct away the errors.

Now it seems like if you could record raw data you could make a DVD with a pattern visible to the naked eye but invisible to the DVD reader. So rather than waiting ages and buying expensive media for things like Lightscribe or Labelflash you could burn both the data and the label at the same time and on any media. Unlike DiscT@2 which burned logos on the data side of the disk, the space can be used for both logo and data at the same time.

You could do it with arbitrary bitmaps too - take the bitmap and make holes in it through which enough data shows through to make the disk readable. The burning software could do this with a mask cunningly constructed to make enough holes even in a solid bitmap to make the disk readable. Hell you could let the user select the tradeoff between image quality and error margin.

There's a a downside of course, the more solid the image the more the error correction will be stressed even for a disc which can be read perfectly. It seems like a disc burned with this technology would be less resistant to scratches and fingerprints.

Re:Only Meta-Data was damaged

[mcrbids]

Way back when, I bought several such softwares. Most was overblown - lets you "undelete", etc. But then I found some software that perhaps wasn't technically "data recovery" software, but might as well have been...

SPINRITE II. That software was AWESOME!

Back when MFM/RLL was still a consideration, media failures were all too common. Drive sectors would go bad, your FAT table would be corrupted, and your system was horked, often so badly that you couldn't even boot.

But with a copy of SpinRite II and a DOS boot floppy, and a *LOT* of time (often 2-3 days!) and in nearly every case, the computer would be brought back to full operation. I had one system where, whenever the owner had problems with bad sectors, he would rename the file and re-copy from backups. This would cause the area with the bad blocks to become unused, sort of a "manual re-mapping".

Well, his backups got horked right about the same time that the FAT itself corrupted. The system was gone, the data was gone, and he was in a severe panic. But Spinrite II took over a week to recover everything. But it did. Everything. Even the renamed files read/wrote flawlessly.

Could I have recovered this DVD? Probably not - I never claimed to be a "data recovery expert". I was honest with my clients about what I was qualified to do (diagnose/reformat/reload) and what I wasn't. But I recovered LOTS of data anyway.

Now for the funny part:

I owned a small computer sales/service shop for several years. You know, the friendly neighborhood type. We did *alot* of computer repairs. We gave out free diagnostics, which was an excellent way to get more repairs - the diagnosis was free, the repair was reasonable, customers almost always bought.

Frequently, we'd be asked to fix software woes, etc. We'd warn about the risks of software problems, possible loss of data, offer to backup their data first, and we'd even make them sign release forms that they did NOT want us to back up the data.

And then we'd back up the data anyway, routinely. We used a backpack drive that was big enough to keep a dozen or so drive images on it. (parallel port drive with a driver loaded by floppy or CD - this is before USB was common)

Granted, most of the time, the backup wasn't needed. But when it was, (and it was, maybe 1/4 of the time) we would then charge $150 "data recovery". (to reload the data from our backup) Since our charge for backups was $50, our customers made out slightly in the odds, but we were still the heroes and those who actually needed the data were not too hesitant to pay, especially since, with this method, our success rate was 100%!

how much did that cost?

[Anonymous Coward]

That's great and all but I kinda wonder how much taxpayer money it took to recover the thing when an old school magnetic tape would've done the job with a lot less fuss.

Re:eep

[lysergic.acid]

i was thinking in the same direction too. but when i read this part of the summary:

but when they popped the video into the player, nothing came up -- the disc was blank.

my immediate question was, "did they try a PAL player?"

what's interesting to me is that two "data recovery firms" told them that the data was unrecoverable, but Seagate Recovery Service was able to recover the data without a problem. that makes me wonder if the earlier data recovery firms even tried to diagnose the problem or if they even knew anything about digital media & data storage. perhaps they thought that just by buying some digital forensics or data recovery software that automatically qualifies them to run a data recovery service. though i'm guessing that's what most police departments do as well.

i guess that's the problem with buying off the shelf software to do your job rather than learning how things work for yourself.

protecting your data

[sakura the mc]

a couple questions spring to mind.

what is the best way to "erase" your data on optical media?

toss em into a fire and let them melt? lets see them recover that smoldering mess.

then, what to replace your optical media with?

i can only carry so many usb sticks. isnt data recovery from formatted solid state drives extremely time-consuming, if not difficult?

with the advent of cheap and high capacity hard drives, i have not burnt anything to an optical medium in maybe 2 - 3 years? there is simply no need. i would like to continue this pattern, but i want my data to be quickly and easily disposed of if need be.

Tinfoil hat eh?

[plasmacutter]

in a day where a few people in their basement can render decent cgi, I'm wondering if this "third firm" was not hired to do a little "extraordinary rendering"

For best results, one should loosen their tin-foil hat occasionally.

Just sayin'.

Funny how everyone here is fully aware of the capabilities of our current state of technology in the hands of people with enough resources, yet when someone suggests an actual, real-world possibility for misuse, or the possibility of despotism it's "tinfoil hat" time.

I'm not saying they're doing it to me, or that they're in the walls, but seriously, have those lessons of the mccarthy and now bush eras gone straight out the other ear? I suppose GITMO doesn't exist? I suppose every single protestor is an "anarchist" just like the news says?

HOW was Only Meta-Data was damaged?

[Anonymous Coward]

And, if the DVD was written correctly to begin with, how did JUST the "Directory tree" lead-in get messed up on the DVD?

The real (and more likely) reason?

Maybe someone forgot to hit Finalize after the dvdcam was done recording! The lead-in was never there!

"But it played fine when we watched it back in the camera... I don't know WHY it won't play in the player! It must be corrupted!"

Dust on media

[troll8901]

I've tried. Neither 16X DVD nor 40X CD can fling any dust off. You'll need tissue and physical contact.

Re:hmmm

[Anonymous Coward]

I don't think the problem was decryption, but more of data recovery.

Re:So it's not only the the 3rd world after all!

[bogaboga]

Haha, you make me laugh. Ask yourself...Who is doing the rating? With this corruption, I can trust nobody except the average American who has proven that the Japanese build better cars and have been doing this for decades.

In case you did not know, the American car giants have lost market share...have a look http://www.detnews.com/2005/autosinsider/0501/06/A01-50668.htm.

Those Japanese cars are simply better built, have a good resale value and do not give a lot of headache. Aren't these the folks who endorsed the Malibu as the car of the year until it was tested on the road? It was, you guessed it, almost junk. Some folks will not touch it with a 10 foot pole. In the mean time, the Camry and Accord are doing fine.

Have you driven a Lexus lately? Sit in one...just sit in one and have a look...then compare it with any garbage from Detroit...then you return to educate me.

What else do you need? I doubt these 3 car giants will be around in the next 3 years. And I am not a lone. By the way, I drive a 2007 Lexus GS 450. I cannot ask for a better machine.

try the disk first

[amclay]

I'm still trying to figure out if they tested the disk in a player BEFORE the court room.

Sounds about right

[Gazzonyx]

No doubt, even without a TOC or any kind of analysis other than a raw disk dump, the fact that the thing had structure should have been the first clue.

I used to do the audio booth at my church for live concerts and the such, and those direct to disk recorders are a pain (or at least the one we used). If you pause them and then try to start them again while they're closing the track, or something to that effect, sometimes they'll merge tracks or not close at all - but the stream is always there, if somewhat incoherent.

I regularly forget/neglect to close my audio and data disks and I've found that free-as-in-beer/donationware 'ISOBuster' always does the trick (or 'dd'/'ddrescue', I've pulled data from a scrambled reiserfs before this way, I'd wager it'd work for ISOs, too). At any rate, this task should not have been a challenge for even a freshman CS student with some free tools and an hour to kill.

NOT an anti-MS bash!

[rts008]

"Probably, yeah. In the worst case, though, the disc might have gotten finalized incorrectly (e.g. using a bad optical drive), in which case even the original DVD burner might not play it....

The lead-in area (at least for the first session) is the innermost recordable portion of the media. If something went wrong in media fabrication, I'd expect that to be the second-most likely part to have problems, second only to the outer edge (which fails verification frequently in cheap media). So this could have been a media defect as well."

*disclaimer*
This is only my limited experience, so take with a grain of salt....

I have had this very problem in the past, and can currently reproduce it at will today.

Facts:
1. 100 disc stack of blank CD-R | 1x-52x, 700MB, 80 minute Imation (tm) discs.
2. at the time troubles started:
    a. One PC (500MHz P3 slot A, 768MB PC 100 RAM, CyberDrv CW058D CD-R/Rw @ 32x/12x/48x cd drive, Win XP Pro SP2, Nero 7
    b. Dell desktop: 1.8 GHz AMD Athlon, 1GB PC 2700 RAM, Sony DRUxxx? DVD-+r/rw 4x burner, Win XP SP2, MyDVD-came with drive
    c. P4 Prescott socket 478 3.0 GHz, 1 GB PC 2700 RAM, Lite-on DVD-ROM/CD-+r/rw, Kubuntu 6.10 Dapper Drake, K3b.

Results:
2.a,b. would not even recognize the discs, c. would use and burn with no problem.

The perplexing thing is after I burnt a disc in Kubuntu, it would then 'work' in the other two Win XP machines, but the two XP machines refused to use the Imation blanks.

Since then, b.(above) has been dual boot with XP SP2, and Kubuntu 8.04, and XP refuses to recognize the blanks, while Kubuntu/K3b on the same hardware uses them with no problem.

The MEDIA used CAN make a big difference here, as I have found out the hard way.

If I had mod points, I would have given you some '+1 Insightful' love, but alas, this lame reply is the best I can currently do for now.

Re:eep

[lysergic.acid]

it's interesting that you brought that up. from my personal experience, most brand name NTSC players sold in the U.S. don't support PAL, but most PAL players sold in, say Taiwan, do support NTSC.

also, cheapo $20 DVD players are more likely to support both NTSC and PAL, as well as DivX/MPEG-4 video, etc. than the expensive $100~200 players. they're usually off-brand players, but you can also find these cheap players by major companies like Panasonic or Sony, though you'll have to enter a code to unlock the player.