Malaysian Airlines MH370 contact lost
Join Date: Jun 2009
Location: London, UK
Posts: 1
Likes: 0
Received 0 Likes
on
0 Posts
Data remanence on CVR
A lot earlier in this thread there is various discussion on the feasibility of the recovery of the [allegedly] deleted data on the Captains flight simulator. The conclusion being that it was trivial is just deleted, but still possible [in certain cases] if overwritten.
In general, a determined enough organisation can recover overwritten digital data from hard-disks and tapes, especially if it is known what has been used to overwrite. Most computer data deletion standards mandate the data is overwritten with random data 5 or more times to be absolutely (spy) safe.
My question is, would the same apply for the CVR? If the duration is 2-3 hours, then the potentially interesting part was only overwritten twice - and perhaps overwritten with silence or a known base level of sound (aiding data recovery). Potentially even if only a few sounds or words recovered could be relevant (to define who was present on deck/a struggle).
Any thought on the feasibility of certain agencies recovering more than 2 hours from the CVR?
Of course, we need to find it first.
In general, a determined enough organisation can recover overwritten digital data from hard-disks and tapes, especially if it is known what has been used to overwrite. Most computer data deletion standards mandate the data is overwritten with random data 5 or more times to be absolutely (spy) safe.
My question is, would the same apply for the CVR? If the duration is 2-3 hours, then the potentially interesting part was only overwritten twice - and perhaps overwritten with silence or a known base level of sound (aiding data recovery). Potentially even if only a few sounds or words recovered could be relevant (to define who was present on deck/a struggle).
Any thought on the feasibility of certain agencies recovering more than 2 hours from the CVR?
Of course, we need to find it first.
Join Date: Jul 2006
Location: USA
Age: 41
Posts: 111
Likes: 0
Received 0 Likes
on
0 Posts
Probably asked and answered many many times, but searching in this thread is pointless almost.
In the 777, are the CVR and FDR circuit breakers in the cockpit? are they up above the overhead panel?
It almost seems to me that even if we do find the boxes, it will be meaningless. CVR being worth only 2 hours if we're lucky and it wasn't disabled and the FDR well.. again if it wasn't disabled.
In the 777, are the CVR and FDR circuit breakers in the cockpit? are they up above the overhead panel?
It almost seems to me that even if we do find the boxes, it will be meaningless. CVR being worth only 2 hours if we're lucky and it wasn't disabled and the FDR well.. again if it wasn't disabled.
James890:
Data remanence on CVR?
If they were still using magnetic tape, then there may be a chance to recover earlier recordings, much as overwritten hard drive data can sometimes be recovered if you have a right tools.
However, I would expect that modern cvr systems would record to flash or battery backed up memory. ie: digital rather than analog recording. Earlier contents would be overwritten in a continuous loop from the start of memory once end of memory is reached. There would be no way to recover data that has been overwritten...
Data remanence on CVR?
If they were still using magnetic tape, then there may be a chance to recover earlier recordings, much as overwritten hard drive data can sometimes be recovered if you have a right tools.
However, I would expect that modern cvr systems would record to flash or battery backed up memory. ie: digital rather than analog recording. Earlier contents would be overwritten in a continuous loop from the start of memory once end of memory is reached. There would be no way to recover data that has been overwritten...
Join Date: May 2012
Location: us
Posts: 2
Likes: 0
Received 0 Likes
on
0 Posts
General relativity
Earth's geoid is both non-symmetrical and well-mapped (GRACE and GOCE), Inmarsat may have done a relativistic gravitation Doppler analysis on the transmission to rule out the north arc. Will see if this is true as they give more details.
Join Date: Jul 2009
Location: Atlanta, GA USA
Age: 60
Posts: 183
Likes: 0
Received 0 Likes
on
0 Posts
Would somebody be kind enough to recap ELT and CVR/FDR ULB ranges underwater and if working what type of equipment would be able detect them?
Last edited by Coagie; 25th Mar 2014 at 00:28. Reason: Left out a word.
Join Date: Dec 2006
Location: Florida and wherever my laptop is
Posts: 1,350
Likes: 0
Received 0 Likes
on
0 Posts
The CVR and DFDR underwater locator beacons have a range of ~2 - 3km underwater and are at a high frequency that almost all SONAR systems will not detect, their batteries are pretty wimpy too and may last 30 days 40 if extremely lucky. These design features seem to be at the behest of the airline beancounters.
To find the ULBs it is usually necessary to get within 2 km with a towed special purpose SONAR array, one is being transported from the US to the search area. However, the Indian Ocean in that area can be more than 3km deep..... Had the beancounters allowed a couple of hundred dollars more per aircraft then the ULBs could be lower frequency higher powered and a few hundred kilometers range and detectable by almost any ship with SONAR.
I would put the beancounters on deck on the SAR ships in the roaring 40's give them some binoculars and keep them at it till the wreckage was found.
Join Date: Mar 2007
Location: Kent
Posts: 10
Likes: 0
Received 0 Likes
on
0 Posts
I did try a reply before on this subject but my post seemed not to have been approved being my first one on the forum and all. So I will try again since the question of evidence recovery has resurfaced.
Please be gentle with me as I am not a pilot but I am a computer forensics examiner with over 10 years in the field. My original post was in response to a comment about examination of solid state drives that were discussed earlier as they are a whole new ball game in forensic examinations and not so straight forward to examine as traditional hard drives.
There are all kinds of issues with the SSD's that can affect their reliability - data can easily get corrupted if power goes midway through a write cycle. If these are to be used in future to preserve evidence of events, they are going to have to have some kind of power source of their own to ensure that data can be preserved and retrieved otherwise you are likely to recover dead drives. Even if you can resurrect them you will likely find the data corrupted, never a good start to a forensic investigation.
They also run the risk that the garbage process runs and wipes data even if you have the drive plugged into a write blocker. The only way to be absolutely certain that you wont lose data from one of these drives is to remove the drive controller and plug each flash memory chip into the write block hardware. Those interested in this can find more detail here:
Belkasoft - Leading Digital Evidence Extraction Software for Computer Forensic Investigations.
As for the retrieval of data that has been overwritten using the previous write pattern on the disk, yes it is technically possible. But the reality of it is that there are very few organisations that will have the monetary, staff and time resources to put into retrieving that information - basically governments or research institutions. This capability isnt going to be available at your nearest PC World anytime soon
Whether data is retrievable and whether that is meaningful depends on a number of factors such as file system, the kind of overwriting that was done and even things like file size can determine whether the original data can be retrieved from the slack space. It ultimately comes down to how the data is recorded to the disk and whether you can determine what is data being recorded vs what is previously written data.
Its possible to retrieve fragments of old files which have been overwritten. This can be crucial in traditional law enforcement investigations because quite often it can show a file existed and also that it was deleted. A jpeg can be recovered from a very small part of the file remaining if you are lucky to the bytes that flag it as a jpeg - which can be crucial for a paedophile investigation to prove an image existed on the drive. However, audio and video data are far more complex to recover.
Even if you retrieve part of the file, you need other pieces of information to try and determine what part of the file you have. If you are lucky, and have the start, then its likely you will be able to find software that will play what part of the file you have. If you have lost the beginning of the file, thats a lot of time consuming work that needs to be done to try and get it back and recovered.
The simpler solution would be to put in drives that hold much more audio to avoid overwriting anything than to rely on being able to recover overwritten data.
Please be gentle with me as I am not a pilot but I am a computer forensics examiner with over 10 years in the field. My original post was in response to a comment about examination of solid state drives that were discussed earlier as they are a whole new ball game in forensic examinations and not so straight forward to examine as traditional hard drives.
There are all kinds of issues with the SSD's that can affect their reliability - data can easily get corrupted if power goes midway through a write cycle. If these are to be used in future to preserve evidence of events, they are going to have to have some kind of power source of their own to ensure that data can be preserved and retrieved otherwise you are likely to recover dead drives. Even if you can resurrect them you will likely find the data corrupted, never a good start to a forensic investigation.
They also run the risk that the garbage process runs and wipes data even if you have the drive plugged into a write blocker. The only way to be absolutely certain that you wont lose data from one of these drives is to remove the drive controller and plug each flash memory chip into the write block hardware. Those interested in this can find more detail here:
Belkasoft - Leading Digital Evidence Extraction Software for Computer Forensic Investigations.
As for the retrieval of data that has been overwritten using the previous write pattern on the disk, yes it is technically possible. But the reality of it is that there are very few organisations that will have the monetary, staff and time resources to put into retrieving that information - basically governments or research institutions. This capability isnt going to be available at your nearest PC World anytime soon
Whether data is retrievable and whether that is meaningful depends on a number of factors such as file system, the kind of overwriting that was done and even things like file size can determine whether the original data can be retrieved from the slack space. It ultimately comes down to how the data is recorded to the disk and whether you can determine what is data being recorded vs what is previously written data.
Its possible to retrieve fragments of old files which have been overwritten. This can be crucial in traditional law enforcement investigations because quite often it can show a file existed and also that it was deleted. A jpeg can be recovered from a very small part of the file remaining if you are lucky to the bytes that flag it as a jpeg - which can be crucial for a paedophile investigation to prove an image existed on the drive. However, audio and video data are far more complex to recover.
Even if you retrieve part of the file, you need other pieces of information to try and determine what part of the file you have. If you are lucky, and have the start, then its likely you will be able to find software that will play what part of the file you have. If you have lost the beginning of the file, thats a lot of time consuming work that needs to be done to try and get it back and recovered.
The simpler solution would be to put in drives that hold much more audio to avoid overwriting anything than to rely on being able to recover overwritten data.
Floating debris from this aircraft in itself will give significant clues even without the recovery of the black boxes.
But, I'm not aware of any confirmed identified debris being recovered let's take a deep breath until then.
But, I'm not aware of any confirmed identified debris being recovered let's take a deep breath until then.
777 Emergency Descent Mode?
Barit asked the question in post #2932
Can anyone with technical knowledge of the MAS 777 FMS answer the question definitively - did MH370 have an Emergency Descent Mode or not?
Newer business jets have it fitted.
Can anyone with technical knowledge of the MAS 777 FMS answer the question definitively - did MH370 have an Emergency Descent Mode or not?
Newer business jets have it fitted.
Join Date: Mar 2014
Location: wales
Age: 81
Posts: 316
Likes: 0
Received 0 Likes
on
0 Posts
IAN
With such a powerful "ping" they could already trawled the area and located the wreck
Like you idea for the bean counters make then feel the effects of their decisions, what is that cost compared to the original price of the plane , less than peanuts.
With such a powerful "ping" they could already trawled the area and located the wreck
Like you idea for the bean counters make then feel the effects of their decisions, what is that cost compared to the original price of the plane , less than peanuts.
Join Date: Oct 2013
Location: Victoria
Posts: 83
Likes: 0
Received 0 Likes
on
0 Posts
faraday cage
Would the 406 ELT work inside a faraday cage, with no ability for gps signal reception or comms with sarsat?
Same could be asked of a piece of coax terminated in a dummy/artitifical load.
We use shielded rooms to service sensitive equipment, while hundred KW transmitters run outside.
We use shielded rooms at primary airports to service avionics, when the door is shut with double screened rooms, a cage with a cage nothing gets in not even the nearby NDB.
When you shut the door it shuts out the world,
WIII SAYS
Faraday cages cannot block static or slowly varying magnetic fields, such as the Earth's magnetic field (a compass will still work inside). To a large degree, though, they shield the interior from external electromagnetic radiation if the conductor is thick enough and any holes are significantly smaller than the wavelength of the radiation.
That's why you can look through your microwave door and not get zapped.
However a slight amount fo escaping radiation from case or equipment direct l ine of sight to a satellite maybe only in order of microwatts. anything is possible...
I always tell the story of my aircraft where some rain got in and dripped into the external ELB switch, just enough to allow electricity to conduct through the switch
The eleb light was not on but I got called out of bed at 400am to go to the airport as using a hand held thay had traced it to my plane.
A satellite and subsequent overflying jets had narrowed it to my home base.
The elb was putting out microwatts
Same could be asked of a piece of coax terminated in a dummy/artitifical load.
We use shielded rooms to service sensitive equipment, while hundred KW transmitters run outside.
We use shielded rooms at primary airports to service avionics, when the door is shut with double screened rooms, a cage with a cage nothing gets in not even the nearby NDB.
When you shut the door it shuts out the world,
WIII SAYS
Faraday cages cannot block static or slowly varying magnetic fields, such as the Earth's magnetic field (a compass will still work inside). To a large degree, though, they shield the interior from external electromagnetic radiation if the conductor is thick enough and any holes are significantly smaller than the wavelength of the radiation.
That's why you can look through your microwave door and not get zapped.
However a slight amount fo escaping radiation from case or equipment direct l ine of sight to a satellite maybe only in order of microwatts. anything is possible...
I always tell the story of my aircraft where some rain got in and dripped into the external ELB switch, just enough to allow electricity to conduct through the switch
The eleb light was not on but I got called out of bed at 400am to go to the airport as using a hand held thay had traced it to my plane.
A satellite and subsequent overflying jets had narrowed it to my home base.
The elb was putting out microwatts
Join Date: Nov 2006
Location: Yorkshire
Posts: 150
Likes: 0
Received 0 Likes
on
0 Posts
Beancounting is neither here nor there. ELT's are lifesaving equipment that transmit on internationally standardised frequencies to enable life saving, not underwater wreck recovery.
Join Date: Mar 2014
Location: Arizona
Age: 76
Posts: 62
Likes: 0
Received 0 Likes
on
0 Posts
ELT's - more info
Too add to the ELT info. I don't know the specifics of the 777 ELT's (some others on here have more info on this). However, the following is general information that will apply to detection and localization of them.
Modern ELT's transmit a periodic 5 watt data burst on 460.25, which is received by low earth orbiting SAR satellites. They also transmit a lower power continuous "whoop-whoop" on the old ELT frequencies of 121.5 and 243, for direction finding during the final phase of localization.
The 5 watt ELT signal, even inside an aircraft like a 777, should be detectable at quite a range, even with the shielding effect of the aircraft hull. I suspect the SARSAT's would pick it up.
ELT's are frequently disabled by crashes (as mentioned by another poster earlier). The antenna can be severed, reducing the range to tens of meters, or the ELT can be destroyed. They are really designed for survivable crashes. They often have G-switches. The batteries are supposed to last a couple of days. I once found an older (121.5) ELT in an aircraft that had crashed and burned on landing - the heat from the fire had moved the ELT well off frequency, but it was still whooping.
Until 2009, COSPAS/SARSAT monitored 121.5 and 243.0. Now they only monitor 406.025. The latter frequency is sent with much higher power and better carrier stability, so the ELT location, derived from doppler as perceived by the satellite, is more accurate than with the older ELT's. ELT's on 463.0 are now monitored by both geosynchronous satellites and low earth orbit satellites (which do doppler processing, decode the digital beacon, and transmit the results to ground stations). Note that the geosynchronous satellites can provide near instantaneous notification of ELT activation, but may not give position.
Newer ELT's may also have GPS's and thus transmit GPS coordinate. They are also registered, so reception of a signal identifies the ELT. I once found one which was also shouting MAYDAY on 121.5 (recorded voice), making us think there was a pilot in distress, when in reality it was an accidentally triggered ELT in an parked aircraft. Grrr.
I suspect an ELT in the 777, built into the vertical stabilizer, might have much higher crash resistance than those in smaller aircraft, and the tail may stay intact.
Modern ELT's transmit a periodic 5 watt data burst on 460.25, which is received by low earth orbiting SAR satellites. They also transmit a lower power continuous "whoop-whoop" on the old ELT frequencies of 121.5 and 243, for direction finding during the final phase of localization.
The 5 watt ELT signal, even inside an aircraft like a 777, should be detectable at quite a range, even with the shielding effect of the aircraft hull. I suspect the SARSAT's would pick it up.
ELT's are frequently disabled by crashes (as mentioned by another poster earlier). The antenna can be severed, reducing the range to tens of meters, or the ELT can be destroyed. They are really designed for survivable crashes. They often have G-switches. The batteries are supposed to last a couple of days. I once found an older (121.5) ELT in an aircraft that had crashed and burned on landing - the heat from the fire had moved the ELT well off frequency, but it was still whooping.
Until 2009, COSPAS/SARSAT monitored 121.5 and 243.0. Now they only monitor 406.025. The latter frequency is sent with much higher power and better carrier stability, so the ELT location, derived from doppler as perceived by the satellite, is more accurate than with the older ELT's. ELT's on 463.0 are now monitored by both geosynchronous satellites and low earth orbit satellites (which do doppler processing, decode the digital beacon, and transmit the results to ground stations). Note that the geosynchronous satellites can provide near instantaneous notification of ELT activation, but may not give position.
Newer ELT's may also have GPS's and thus transmit GPS coordinate. They are also registered, so reception of a signal identifies the ELT. I once found one which was also shouting MAYDAY on 121.5 (recorded voice), making us think there was a pilot in distress, when in reality it was an accidentally triggered ELT in an parked aircraft. Grrr.
I suspect an ELT in the 777, built into the vertical stabilizer, might have much higher crash resistance than those in smaller aircraft, and the tail may stay intact.
Join Date: Nov 2013
Location: California
Posts: 154
Likes: 0
Received 0 Likes
on
0 Posts
This would be an extremely weak effect. Even the baseline for GR time dilation between Earth's surface and the satellite in a geosynchronous orbit is ~50 microseconds/day (5*10^-10), equivalent to frequency shift of just 1 Hz in the microwave band. Fluctuations in the geoid aren't going to be visible without sophisticated equipment.
Join Date: Mar 2014
Location: Toronto
Age: 69
Posts: 41
Likes: 0
Received 0 Likes
on
0 Posts
Doppler analysis of flight MH370
Once the trigonometry of flight MH370 has been figured out, it is possible to do a few calculations to assess the effect of the airplane's speed on the frequency of the signals it used to communicate with the Inmarsat-3F1 satellite. I have assumed that MH370 flew for 6.83 hours along a great circle route from its last known position to a point over the debris field. I have also assumed that it flew at a constant airspeed of 850 kilometers per hour. It is possible to calculate the velocity of MH370 (both speed and direction) at every point along this route. It is then possible to divide this velocity into two components, one along the line-of-sight to the Inmarsat and the other at right angles to this line-of-sight. The following graph shows the component of MH370's velocity along the line-of-sight. At the start of its silent flight, MH370 was flying at a speed of 219.3 kph (kilometers per hour) directly towards the satellite and 821 kph directly perpendicular to the line-of-sight. Therafter, the airplane flew in a direction further and further away from the satellite, and the component of the velocity along the line-of-sight decreased. By the time the airplane reached the debris field, it was travelling radially away from the satellite at a speed of 500.5 kph and directly across the satellite's field-of-view at a speed of 687 kph.
We have all heard the Doppler effect. It affects radio waves in pretty much the same way as it affects sound waves. The Doppler effect arises when there is relative motion between the source of the wave (a fire truck or MH370, for example) and the receiver (you or the satellite, respectively). The Doppler effect does not change the speed at which the waves travel. Instead, it changes the apparent frequency. The frequency of the wave transmitted by the source is not the same as the receiver heard by the receiver. When the source and receiver are travelling towards each other, the apparent frequency received is higher. The degree to which the apparent frequency is raised or lowered depends on the relationship between the speed with which the wave travels through the material between and source and receiver and the relative closing speed between the two. In the case at hand, the speed of the wave is the speed of light: 1,080,000,000 kph. The relative closing speed (above graph) ranges from 219.3 kph at the start of the silent flight to negative 500.5 kph (negative closing speed resulting in a lowering of the frequency) at the end. Expressed as a percentage of the speed of light, these two closing speeds are 219.3 / 1.08E9 = 0.00002% and -500.5 / 1.08E9 = -0.00005%.
These are very small shifts in frequency. Big passenger airplanes use at least four frequency ranges, called "bands", in their communications. When the pilots talk to ground control, they use frequencies a little bit above 100MHz, just above your FM radio. The "Primary Channel Worldwide" for the ACARS reporting system is 131.55MHz. Much has been heard in the aftermath of MH370 about the use of satellites to relay the ACARS information, but the bulk of ACARS messages do not pass through satellites. When airplanes fly over land, the ACARS communications go over a land-based, cheaper network. The transponders about which we have heard so much are sent at frequencies near 1030MHz. When airplanes are far out over the sea, and communicate their ACARS data through satellites, they use even higher frequencies. The Inmarsat-3F1 satellite transmits at 1630MHz and receives at 1530MHz. One assumes that the Inmarsat study into the Doppler effect used data exchanged at these higher frequencies. Since the airplane's speed is such a small fraction of the speed of light, the percentage shift in frequency will be almost proportional to the relative speed percentages described above. The following graph shows the frequency shift (in Hz) which would be experienced by a continuous radio wave transmitted at 1600MHz by MH370 to the satellite during its silent flight.
These frequency shifts range from an increase of about 325Hz to a decrease of about 750Hz. I will say this: the Inmarsat people must be very good engineers to detect such small changes in a 1600MHz carrier, particularly when their radio equipment was probably designed to overcome and ignore such noise.
We have all heard the Doppler effect. It affects radio waves in pretty much the same way as it affects sound waves. The Doppler effect arises when there is relative motion between the source of the wave (a fire truck or MH370, for example) and the receiver (you or the satellite, respectively). The Doppler effect does not change the speed at which the waves travel. Instead, it changes the apparent frequency. The frequency of the wave transmitted by the source is not the same as the receiver heard by the receiver. When the source and receiver are travelling towards each other, the apparent frequency received is higher. The degree to which the apparent frequency is raised or lowered depends on the relationship between the speed with which the wave travels through the material between and source and receiver and the relative closing speed between the two. In the case at hand, the speed of the wave is the speed of light: 1,080,000,000 kph. The relative closing speed (above graph) ranges from 219.3 kph at the start of the silent flight to negative 500.5 kph (negative closing speed resulting in a lowering of the frequency) at the end. Expressed as a percentage of the speed of light, these two closing speeds are 219.3 / 1.08E9 = 0.00002% and -500.5 / 1.08E9 = -0.00005%.
These are very small shifts in frequency. Big passenger airplanes use at least four frequency ranges, called "bands", in their communications. When the pilots talk to ground control, they use frequencies a little bit above 100MHz, just above your FM radio. The "Primary Channel Worldwide" for the ACARS reporting system is 131.55MHz. Much has been heard in the aftermath of MH370 about the use of satellites to relay the ACARS information, but the bulk of ACARS messages do not pass through satellites. When airplanes fly over land, the ACARS communications go over a land-based, cheaper network. The transponders about which we have heard so much are sent at frequencies near 1030MHz. When airplanes are far out over the sea, and communicate their ACARS data through satellites, they use even higher frequencies. The Inmarsat-3F1 satellite transmits at 1630MHz and receives at 1530MHz. One assumes that the Inmarsat study into the Doppler effect used data exchanged at these higher frequencies. Since the airplane's speed is such a small fraction of the speed of light, the percentage shift in frequency will be almost proportional to the relative speed percentages described above. The following graph shows the frequency shift (in Hz) which would be experienced by a continuous radio wave transmitted at 1600MHz by MH370 to the satellite during its silent flight.
These frequency shifts range from an increase of about 325Hz to a decrease of about 750Hz. I will say this: the Inmarsat people must be very good engineers to detect such small changes in a 1600MHz carrier, particularly when their radio equipment was probably designed to overcome and ignore such noise.
Join Date: Jun 2001
Location: UTC +8
Posts: 2,626
Likes: 0
Received 0 Likes
on
0 Posts
GQ2 . . .
There have been numerous idiotic comments in this thread blaming the crew, directly or indirectly. Since most of the so-called 'facts' implicating the crew seem to have faded-away,
Join Date: Mar 2014
Location: Toronto
Posts: 7
Likes: 0
Received 0 Likes
on
0 Posts
As an forensics professional, you are aware that magnetic force microscopy has never been used to recover data off once-overwritten magnetic media. I assume you are also aware of the 2006 NIST Special Publication which stated that using magnetic force microscopy to recover data from magnetic media of any considerable density is impossible. Since you would know all this, I wonder why you would make such a statement.
It is also irrelevant since the CVR/FDR would not be recording to magnetic tape on the accident aircraft.
Join Date: Nov 2008
Location: Flyin' low and feeling mean
Posts: 194
Likes: 0
Received 0 Likes
on
0 Posts
Yes, and if we do, there may be no data on it.
Someone might have pulled the C/B to shut it down
Someone might have pulled the C/B to shut it down
And no, there is Emergency Descent mode in the FMS.
Last edited by Hogger60; 25th Mar 2014 at 01:54.