From Fathoms Below: Digital Forensics of a Black Box

By MELISSA GOTHARD, Digital Collections, Analysis and Integration Laboratory, U.S. Army Combat Readiness Center, Fort Rucker, AlabamaJune 7, 2021

Data recovery
1 / 2 Show Caption + Hide Caption – Tim Ashcom of the U.S. Army Combat Readiness Center’s Digital Collections, Analysis and Integration Laboratory opens the Crash Survivable Memory Unit from a U.S. Navy MH-60S Seahawk that crashed off the coast of Okinawa, Japan, in January 2020. (Photo Credit: USACRC) VIEW ORIGINAL
Mishap animation
2 / 2 Show Caption + Hide Caption – An example of a mishap recreation animation video created from recorded flight data and audio developed by the U.S. Army Combat Readiness Center’s Digital Collections, Analysis and Integration Laboratory. (Photo Credit: USACRC) VIEW ORIGINAL

In January 2020, a Navy MH-60S Seahawk on a routine training flight crashed into the Philippine Sea off the coast of Okinawa, Japan. All five crewmembers were rescued and survived, but the helicopter sank to the seabed about 19,075 feet below. This past March, nearly 14 months after the mishap, the Navy was able to haul the aircraft to the surface. However, this record-breaking underwater recovery proved only to be the first challenge as the Navy attempted to determine what led to the mishap.

Following the successful retrieval, a Navy vibrations technical expert/health and usage monitoring system (HUMS) team responsible for flight data recorder recovery reached out to the U.S. Army Combat Readiness Center’s (USACRC) Digital Collections, Analysis and Integration (DCAI) Laboratory for assistance. A flight data recorder — or black box, as it’s often called — had never been retrieved from such a great depth. In addition, data recovery from a black box submerged for such an extended period of time had never been successful. In this case, information recovery would result in firsts for both the Navy and Army.

This aircraft’s digital source collector (DSC) devices included an integrated vehicle health and usage monitoring unit (IVHMU), which is comprised of a HUMS compact flash memory card and a cockpit voice flight data recorder (CVFDR). In addition to the IVHMU, the DSC included a HUMS Personal Computer Memory Card International Association (PCMCIA) card. These devices were subjected to extreme pressures on the sea floor, so great consideration was given to protect them during recovery. If not protected, corrosion can form on the metal storage components, degrading their integrity.

The potential for damage was anticipated on the DSC devices due to exposure to pressure at depth, as well as compression and decompression effects of the electrical components. The key to preserving the data stored on a submerged DSC is limiting its exposure to oxygen, thereby reducing the chance of corrosion. To do this, the IVHMU was packaged in seawater and delivered to the USACRC in a leak-proof container. Upon receipt, it was disassembled down to its circuit-board-level components, cleaned and dried in an oven for 72 hours.

Once dried, the time-intensive and delicate process of cleaning and testing for connectivity of components at the microscopic level was conducted. The techniques and guidance provided by the original equipment manufacturer, as well as the skill of DCAI SME Tim Ashcom, ensured the integrity and continuity were critical to successful data recovery. Navy SMEs Jonathan Wiley and William (Jason) Denny worked alongside the DCAI team. The Navy was appreciative of the collaboration and that the effort provided some data for its safety investigation board assessment into the mishap.

The DCAI Lab’s mission to support recovery, analysis and integration of device data for safety investigations is unique. It is the only laboratory in the Army that performs data recovery on analog and DSC devices. The most commonly known DCS devices are flight data, cockpit voice, or combined flight data and voice recorders. These systems record data using digital or tape-based media and electronics. The retrieved data is a critical element in mishap investigations, and in some cases represents the only witness to the event.

The USACRC has had some ability to download digital and analog recorders since the early 1990s. Originally called the Flight Data Recorder (FDR) Office, two technicians working at the then-U.S. Army Safety Center were responsible for data recovery of mishap flight data recorders. At the time, the OH-58D and some fixed-wing airframes were the only aircraft with recorders. As technology increased and more aircraft were equipped with DSCs, the lab began producing animations recreating mishaps based on recovered data.

The first rotary-wing mishap animation technicians developed was for an OH-58D crash at Fort Rucker in February 1999. The aircraft’s data transfer unit flight telemetry data recorder was based on data collected from a PCMCIA digital-based system. The first fixed-wing animation was developed two years later following a C-23 Sherpa mishap in Umatilla, Georgia. The C-23 information was collected from an analog tape-based flight data recorder and cockpit voice recorder.

When the Army’s Military Flight Operations Quality Assurance program was introduced and former Secretary of Defense Donald Rumsfeld challenged the armed services with reducing mishaps by 50% by 2005, more airframes were fitted with flight data recorders. That same year, the FDR Office was renamed the DCAI Laboratory. Led by Bill Rhode, a veteran Army aviator, the lab began a transformation to collect and exploit the emerging technology and opened a new chapter in digital forensics and data analysis.

The DSC devices continue to evolve and are now capable of recording a staggering number of specific telemetry and performance parameters such as altitude, airspeed, compass headings, pitch, attitudes, instruments, controls and other important system information for condition-based maintenance. All this information is critical to support mishap investigations and can provide insight into aerodynamic characteristics of flight as well as capture input to flight controls. Additionally, some devices also record cockpit audio of crew interactions, communications and external noises.

Early DSC devices were not designed to survive a crash. In early mishaps, post-crash fires and excessive heat, impact damage or water immersion caused component degradation that often resulted in the loss of critical recorded data and information. Today’s DSC devices are designed to withstand the physical damage from significant crash impacts while protecting the valuable recorded data, allowing the DCAI Laboratory to reconstruct mishaps in its state-of-the-art facility.

The DCAI Lab supports Armywide Installation Army Investigations and Centralized Army Investigations conducted by the USACRC and continues to expand its services to ground programs of record as digital HUMS develop and replace analog systems. The facility also supports and collaborates with its sister laboratories (Navy, Coast Guard and Air Force) and works with higher-level project management offices across aviation platforms, including foreign military sales.

Every recovery is unique, and we have learned in the lab to expect the unexpected; but patience and critical thinking are necessary tools of the trade. The analysis of data recovered from DSC devices serve to provide readiness through analysis, training and the development of systems that support loss prevention programs and initiatives for our Army.