Onsite Forensic Backup tape restore for internal investigation
The Client
A pharmaceutical company conducting an internal investigation into product liability.
The Situation
The client was confronted with a product liability issue that led to an internal investigation involving product managers and other senior personnel. The internal legal department, along with the internal investigators, had to recover email files from a total of 65 LTO 3 and 4 tapes to an external storage device. A catalog with a searchable listing of items on the recovered tapes was also needed.
The Solution
In collaboration with the pharmaceutical company, Ontrack developed a solution that enabled the customer to maintain the security requirements of the internal investigation while providing the necessary evidentiary data. A team of two forensic computer specialists from Ontrack were sent with their mobile hardware equipment required to carry out the project. This included seven high-end computers, tape drives, and other storage reading equipment. The team inspected all tapes in order of storage sets. They also verified the labels (based on creation dates) and performed a restoration of the backup tapes using proprietary software for data recovery from damaged storage sets and tapes. Our specialists were able to recover most Exchange database files (EDBs) and export several .pst files important to the case.
The Resolution
All recovered data was placed on a new storage device, which was used on-site for the purpose of the investigation. In addition, Ontrack's forensics specialists provided the customer with a catalog and searchable list of items stored on the recovered tapes. This allowed the customer to search not only for emails related to this particular case but also for other files that fell within the timeframe of the backup of the 64 tapes.
More about tape restore and mailbox extraction: https://www.ontrack.com/en-us/tape-services