Newtown Killer's Ruined Hard Drive Might Still Yield Clues on Motive
Clues to what motivated the shooter in Newtown, Conn., may reside on his damaged hard drive. Recovery depends on how much it was damaged, say experts.A week after the shooting at the Sandy Hook Elementary School in Newtown, Conn., clues about what set the killer on his deadly path may lie on the platters of a damaged hard drive from his personal computer. Investigators found the hard drive in the home of Adam Lanza, the 20-year-old man who, on Dec. 14, killed his mother in her bed, then shot his way into the school, and killed 20 children and six adults. In his home, Lanza apparently attempted to destroy the hard drive from his computer with either a screwdriver or a hammer, according to news reports. Whether the data from the drive can be recovered depends on what sort of damage he did to the storage device, said Tim Ryan, managing director of the cyber-incident response team at Kroll Advisory Solutions, a security services firm. Ryan, a former supervisory special agent with the FBI, said that physical damage to a drive, if not methodically carried out, is far less effective at destroying data than overwriting the drive with multiple passes of random 0s and 1s. "When done correctly, overwriting the drive is highly effective," he said. "The FBI has pulled hard drives off the battlefield in Afghanistan that had sustained battle damage. It depends on whether the actual physical media was destroyed or some other part of the hard drive was destroyed."
If Lanza did try to damage the hard drive with a hammer or screwdriver, it may have been an unplanned act, says Ryan, although the former FBI agent has no insider knowledge of the case. Unless Lanza actually opened the case to damage the hard-drive platters, it's likely that investigators will be able to recover information from the media, he said.