Ontrack computer forensics team assists pharmaceutical company with onsite tape cataloguing and restoration
Feb 14, 2020
The situation
The client encountered a product liability issue which led to an internal investigation involving product managers as well as other management staff. The internal legal department, together with the internal investigators, needed email files to be restored from a total of 65 LTO 3 and 4 tapes to an external storage device. A catalogue was also required with searchable listings of items on the recovered tapes.
The solution
Working with the pharmaceutical company, Ontrack developed a solution which allowed the client to maintain the security requirements of the internal investigation while providing the evidenciary data required.
A team of two computer forensic specialists from Ontrack were sent with their mobile hardware devices required for carrying out the project. This included seven high-end computers, a tape reader and other storage reading devices.
The team inspected all the tapes in order of save sets. They also verified the labels (based on creation dates) and performed a tape restore of the backup tapes using proprietary data recovery software in order to partially read damaged save sets and tapes. Our specialists were able to restore most of the Exchange database files and export several .pst files that were significant to the case.
The resolution
All the restored data was extracted on to a new storage device, which had been deployed on-site for the purpose of the investigation.
Additionally, Ontrack computer forensic specialists provided the client with a catalogue and searchable listing of items that were stored on the recovered tapes. This allowed the client to search for not only emails regarding this specific case, but also others that were within the backup timeframe covered by the 64 tapes.