Frozen Forensics: Exploring VTO’s radical new research on water damaged mobile devices

Fatality! This is the first thought that most of us have after dropping our $1000 cell phone in the toilet. Conventional wisdom has taught us that water and our beloved smartphones don’t mix. One could even say water and smartphones are mortal enemies. This volatile relationship can cost consumers thousands of dollars in repair and warranty costs over the course of their lifetimes. Of course, most of us have heard or read about incredulous home remedies for water laden devices – such as putting them in bags of rice or blow drying them until the water has evaporated – but the manufacturing industry has never endorsed these methods because, quite frankly, they don’t work.

Mobile phone manufacturers have attempted to engineer a solution to this water problem ever since they put these devices into our clumsy hands. To this end, manufacturers like Apple have even removed the 3.5mm headphone jack from their devices partially because it’s so difficult to waterproof.

Let’s zoom out even further than the impact of us accidentally dropping our phones in a hotel jacuzzi and focus on the consequences surrounding criminal investigations. I’d wager that every day bad guys around the world are looking to destroy evidence by chucking their cell phones into lakes and ponds. What if law enforcement officials or soldiers chasing the bad guys recovered these water-soaked devices? Is the data recoverable? Is it possible for these phones to work again? What kind of damage is happening to the printed circuit boards? The list of questions goes on, but these are exactly the types of riddles that the researchers at VTO are trying to solve.

In pursuit of trying to turn conventional wisdom on its head, researchers at VTO took eight smartphones, put them in a crude metal basket, and launched them into a frozen pond.

Lying in wait during the dead of a Colorado winter, these phones rested at the bottom of a frozen pond for three weeks.

Before illustrating the recovery of these devices, let’s discuss a bit more about why VTO is performing this experiment. As experts in damaged device forensics and data recovery, VTO researchers used this frozen pond as a conduit to test a few hypotheses:

First, forensic scientists at VTO believe that even under some of the most hazardous conditions, as in this case with freezing temperatures, water will not destroy or affect data on a mobile device.

Second, most circuit boards found in mobile devices have a remarkable tolerance for all forms of water. (Of course, this hypothesis is contingent on devices not being fed power whilst basking in water.)

And lastly, if a mobile device is sanitized and cleaned post-exposure to water, the device will not sustain any major malfunctions.

But in order to move toward proving any of these hypotheses, VTO researchers must first fish these phones out of the frozen pond.

Recovering the phones out of the pond is not a simple task. The frozen canopy of the pond must be forcefully cracked open once again. Nonetheless, VTO researchers broke through the ice and reeled in the metal basket of phones.

These mobile devices endured weeks at the bottom of the pond, accompanied solely by a cheap Bluetooth-connected thermostat that would hopefully document the journey. After pulling the basket ashore, researchers scrambled to connect the thermostat to a tablet in pursuit of recovering the temperature logs. Eureka! The thermostat connected to the tablet and unloaded weeks of data.

The recovered phones initially appeared unscathed. This is, of course, aside from the fact that the phones were caked in murky slime that is native to the bowels of the frozen pond. However, moments after resting on the shoreline, researchers immediately took notice to the true assassin of water-sodden mobile devices: oxidation.

You may be wondering, what is oxidation and why is it concerning for this experiment? Oxidation is a process that occurs after an atom, molecule, or ion loses one or more electrons in a chemical reaction. Why does this matter? It matters because oxidation leads to the onset of rust and corrosion which can cause permanent damage to a printed circuit board (PCB). Therefore, it is imperative to develop a solution to prevent or slow down the oxidation process when trying to salvage and recover mobile devices that have been exposed to moisture.

So, what is the solution to this chemical conundrum? Ironic as it sounds, if a device is in water, leave it in water. Additionally, while a device is in water, do not apply power to the device. Only when you are ready to properly rinse, clean, and dry the device should the device leave a water source.

Equipped with the knowledge of how oxidation could ruin this experiment, VTO researchers collected water from the pond, and the devices from the pond were then transported back to VTO’s lab in this water-filled container.

While the devices from the pond rose to ambient temperatures of the lab, the data from the thermostat was reviewed. The thermostat recorded over 2,600 measurements while living at the bottom of the frozen pond. The devices sustained an average temperature of 40° Fahrenheit, fluctuating between 38° and 44° throughout the course of the project.

After the phones reached ambient temperatures, researchers at VTO began the most crucial phase of this project: the cleaning process. The steps to clean and sanitize a water-soaked device are not complicated. However, it is a time-consuming process, requiring patience and precision.

Guided by experience from previous research projects, VTO scientists developed a game plan and systematically deployed the following steps for this phase: disassemble within sourced water; rinse with deionized water; inspect for damage to inform data acquisition method; clean with ultrasonic cleaner and sanitize with deionized water rinse; and dry in oven overnight.

These devices showed incredible resistance to the wintry elements of the frozen pond; however, this should never be assumed. Researchers in this project were surprised to not see damage to some of the more notoriously sensitive components found in mobile devices like LCD screens and touch sensors. If these external components had been compromised and the PCBs were not damaged, then swapping the PCB with an exemplar device would be the optimal approach for those wanting to restore and recover the device’s data.

But let’s extend this hypothetical situation further and imagine a scenario where there was irreparable water damage to the PCBs. If given these circumstances, data acquisition may require more sophisticated and destructive measures, such as chipping-off the data storage components on the device. Nevertheless, it is important to understand that data on a device is likely recoverable unless its correlating storage components are destroyed (i.e. NAND flash chip burned to ashes).

After completing the exhaustive cleaning process and carefully reassembling the devices, VTO researchers are ready to find more answers to the seminal questions posed at the onset of this project.

The first question VTO sought to answer is what kind of physical consequences will mobile devices sustain if they are left at the bottom of a gnarly water source for weeks? The answer, at least for the smartphones used in this project, is none. At the conclusion of this project, researchers inspected the devices under a high-powered microscope and found no signs of damage to any of the components, internally or externally.

Next question: will weeks of freeze cycles and long-term exposure to water cause operating failures to a mobile device? The answer is no. Every smartphone used in this project powered back on without a hitch. These devices were left in a powered-on state for hours at the conclusion of this project and ultimately showed no signs of operation failure.

For the final and most tantalizing question, will data on a mobile device be affected by long-term exposure to a hazardous environment? The answer, again, is no. Physical acquisitions were performed on these devices before and after they were in the frozen pond. After utilizing some of the leading tools in the digital forensics industry to compare these acquisitions, researchers found no demonstrable changes in the data between them.

This project does not resolve every question in scope, of course, nor did it have such intentions. Rather, the intentions for this project were to explore the undiscovered boundaries of water-damaged device testing while constructing new hypotheses derived from evidence that is both measurable and testable. Yet, the most important observation of this project remains clear: the bits and bytes stored on a mobile device are unyielding and unwavering containers of information, even when confronted by the most hazardous and perilous environments found in nature.