Don't Touch that Computer!

Fire, flood, earthquakes, landslides and other catastrophes often result in damaged computer equipment and loss of electronic data. For claims managers and adjusters, this data loss can manifest into an overwhelming amount of insurance claims, costing insurers millions of dollars each year.

The improper handling of computers immediately following a catastrophic event is the leading cause of data loss, and once a hard drive has been improperly handled, the chances of data retrieval plummet. Adjusters may assume a complete loss when, in fact, there are methods to salvage data from even the most damaged computers.

Data Salvage Methods
One of the first steps toward salvaging computer data is to focus on the preservation of the hard drive. Hard drives are highly precise instruments, and drive components that are warped by even fractions of a millimeter will cause damage to occur in the first moments of booting up. During this time the drive head can shred the surface of the platters, rendering the data unrecoverable.

Hard drives are preserved in different ways depending on the damaging event. If the drive is submerged in a flood, it should be removed and re-submerged in clean, distilled water and shipped to an expert. It is important that this is done immediately. Hard drive platters that are allowed to corrode after being exposed to water, especially if the drive experienced seepage, will oxidize and data will be destroyed. A professional can completely disassemble the drive to ensure that all of its parts are dry, to determine what level of damage has already occurred, and then decide how to proceed with the recovery. Care must always be taken during removal from the site to prevent the drive from breaking open and being exposed to dust.

Fire or Smoke Damage
After a fire or flood, the hard drive should not be moved or powered up under any circumstances. A certified computer forensic expert with experience handling damaged drives should be contacted immediately. Typically, these experts will be able to dismantle the drive and move it without causing further damage. Like triage, they assess the external damage and arrive at a decision for further steps to recovery. Fire-damaged drives should never be moved or handled by laymen.

Shock Damage
Shock damage can occur when someone drops a computer or it is damaged in an automobile accident. In more catastrophic scenarios, shock damage can result when servers fall through floors during a fire or from bulldozers during debris removal. This type of crushing damage often results in platters bending, and can be quite extensive. As in fire and flood circumstances, the drive should be isolated and power should not be applied.

A drive that has been damaged by shock presents a unique challenge: from the outside, the computer may look fine. This is typical of many claims involving laptop computers damaged during an automobile collision. If a computer consultant can verify that the drive was powered down at the time the accident occurred, most will be comfortable attempting to power up to begin the data capture process. At the first sign of a change in the dynamics of the drive, such as a head clicking or a drive spinning down, power should be cut off. Restoration would then continue in a clean room where the drive can be opened up and protected from harmful dust.

The Importance of Offsite Computer Backup
One of the best ways to maximize computer data recovery efforts is to have offsite computer backup. For adjusters arriving at the scene, this should be one of the first questions asked of the insured. An offsite backup can take many forms, and companies often employ the services of special data centers that constantly synchronize data. Prices for these services vary widely depending on how much data needs to be backed up and how often. For smaller companies, offsite backup may be as simple as removing a tape of critical data from the site on a daily basis.

John, the insured, owns and operates a home-based IT business. After the insured’s home burned down, he submitted a $500,000 loss of business income claim and a $75,000 claim for damaged computer equipment. He also claimed $60,000 for the three months he spent recovering data from the drives. Because he only was able to recover 25 percent of the data, he presented an additional claim for the cost of reconstructing Web sites he hosted from his home.

For the computer forensic consultant, this case raised several questions. As an IT professional, the insured should have known better than to touch the hard drive and attempt to recover any of the data himself. Also, when an insured intentionally or unintentionally inflicts damage to his or her own property after an event, who is responsible? After a thorough evaluation of the circumstances and intense questioning of the insured, the claim was eventually reduced to a substantially smaller amount.

Scenario 2
The insured, Sammie’s Flowers, has 113 retail outlets and one central headquarters where photography, custom software, catalog masters, etc, are kept. There is no offsite backup. Everything is either on CDs or on the hard drive of the server at the insured’s premises.

One night lightning struck the headquarters building and it burned down. An IT professional who lacked the appropriate computer forensic skills evaluated the computer equipment after the fire. No attempts were made to recover data from the hard drives or to start the computers; because of their damaged physical condition, they were simply thrown into a dumpster.

One year later, the insured filed a claim for $37 million for valuable papers and business personal property losses. The policy limit for valuable papers was small and easily reached. The coverage limit for business personal property, on the other hand, was sufficient to cover the $37 million claim. While this case is still pending, the cost of resolving this claim could be significant. Had the insured contacted a computer data recovery expert, business data thought to have been lost potentially could have been recovered, therefore significantly reducing the insured’s claim.

The insured, a professional photographer, was in a car accident that damaged her laptop computer. Prior to the accident she had been using the laptop computer while parked at a rest stop. Later, she reported to the adjuster that when she booted it up after the event she heard “a strange clicking and clacking sound.” Unfortunately, that was the sound of data being destroyed. Under her business owner’s policy she submitted a $500,000 claim to her insurance company—a claim which included the cost of 2,000 lost images, equipment, and site, model and agency fees for a one-day photography shoot. The laptop computer had a noticeable crack likely caused by the accident. Had the computer been professionally handled, chances are good that the data could have been recovered and sustained damages minimized.

Computer equipment is always at risk of being damaged—whether by flood, fire, lightning or other catastrophic means. However, damage does not always necessarily result in data loss. Companies should be careful not to write off damaged storage media when, in fact, recovery may be possible. Insurers can minimize their exposure on an insured loss by taking immediate precautionary measures to protect the computers from touch and power, and by calling in professional computer forensic experts to assess the damage.

Scott Ellis is a manager in the Forensic Technology Practice at RGL – Forensic Accountants & Consultants. He welcomes conversations about data recovery and computer handling safety, and can be reached at sellis@us.rgl.com.