Can evidence still be secured - hopeless?

Se
4

The following happened to my colleague:

He owned a laptop with which he was doing things that were illegal… He had encrypted the hard drive.

So… The police were probably observing him and had evidence why the police wanted to catch him red-handed in his machinations and had a raid carried out.

My colleague of course knew that he was at work when the door of his apartment was kicked and put a USB killer into his laptop, which resulted in the laptop being rendered completely unusable.

Can the police save the hard drive or save evidence from the laptop, since the laptop was made unusable by the USB killer and the hard drive was encrypted anyway?

ju

A really irreversible data-shredding of large amounts of data requires a lot of time to delete or change all and every bit.

and it will hardly be enough in the few seconds between breaking the door and plugging in the stick, possibly a few more minutes before discovering this attempt.

The professionals can reconstruct everything else in painstaking detail down to the binary level, e.g. Burned hard drives or hard drives in water.

If you, as a private man, hire such professionals to rescue your half-destroyed hard drive, you pay high 3-digit amounts for 1 GB of saved data, but only as a success bonus.

ce

If the good man didn't have an HDD but an SSD in his computer, it is very likely that if the stick has killed it, it can't be restored. However, this is possible with a hard drive.

Ju

If he has a smart PC, the USB killer doesn't do anything ^^

fo

If the disk was fully encrypted, he used decent software like LUKS or Veracrypt, and the passphrase was long enough, the police have no chance of decrypting anything.

If only parts of the disk were encrypted, there could still be traces lying around in unencrypted areas (swap file, temp, cache, Hybernate file, etc.).