The lab · the casebook
A running record of what this bench has handled — every name stripped, every outcome verified, each case shelved next to the guide for its fault. Click into any of them to watch that kind of recovery unfold.
Talk it over with an engineer
0800 6890668
Two 4TB disks, two 8TB, one failed member — and by morning the DSM rebuild had ended in Volume Crashed. Under the hood lay three separate mdadm arrays; two were sound, the third degraded yet still workable. We reassembled them away from the box and wound the btrfs tree back by one generation, at which point all of the shares returned.
Power failed in the night and the database woke in Suspect. An IT contractor stood ready with the emergency repair, but forensic copies showed the log would still replay. Working on the copy, we attached it first time, and that morning's bookings slipped by twenty minutes, not by a week.
An admin's clean-up script took out the wrong folder. Because nothing wrote to the datastore all weekend, both VMDKs sat orphaned but whole; on the Monday we lifted them from an image of the VMFS volume, remade the descriptor files, and by Tuesday evening both virtual machines — payroll included — were running in a sandbox.
It worked Friday; by Monday it chirped once a second. The spindle had seized, though the platters were clean. On the bench we lifted the platter pack out of its aluminium housing into a matched donor chassis, and the drive spun sweetly enough for a complete, patient image.
It started with a YouTube tutorial that made it look easy: out came the disk from its Home Media Network Drive and into a SATA dock, and when Windows offered to initialise, the offer was accepted — the doubt showed up later. Nothing more was ever written to it, so the drive imaged without drama; the Linux volume was rebuilt from that image, the light scarring the initialise left was mended inside the copy, and fifteen years of family photos returned whole.
Free software had churned out 600 files, every one an embedded preview, none printable. The card hadn't been touched since, so a clean image came straight off it; the CR3s went back together from their fragments, and the couple received their gallery at full size — forty frames that tool never saw among them.
Disk two had been dead since June; no one noticed until August, when disk four dropped out partway through a rebuild. Under imaging, drive four turned out to hold nineteen bad sectors rather than a full failure. Three good members plus that near-complete fourth rebuilt the stripe, and no filing went in late.
A power cut outlasted the UPS, and when the server came back the Smart Array asked questions no one could safely answer. We imaged all four members, parsed the RIS metadata and honoured the delayed parity — then mounted the practice-management database from the rebuild, intact to the final write the cache had flushed before the lights went out.
An Exeter student's laptop came back from the repair shop running fine — on a fresh, empty drive. The old disk, written off as dead, sat clicking in a drawer. Donor heads and two days of imaging later, every essay and photo landed on the replacement the shop had fitted.
Monday: the RAID under the booking system went down, with one botched rebuild already on the clock. Tuesday we imaged each member in turn; Wednesday the array came together virtually; by Thursday lunchtime a verified database was back in service. Priority scheduling, no drama.
Nine days before a dissertation deadline, the drive started clicking. We fitted donor heads, imaged it gently, carried the encryption keys over from the USB bridge — and every chapter and citation reached her well inside the deadline.
A two-bay unit showing two red lights, then a DIY rebuild that trampled its own metadata. We imaged both disks past their bad sectors, then stitched the mirror back together section by section, always taking the cleaner copy — and handed the shared volume back whole.
Midnight: a 512GB SanDisk holding a whole wedding. Morning: empty. A forensic clone came first; the filesystem was rebuilt on the copy and a deep carve swept up anything orphaned behind it. Every frame went back to the couple, and the photographer held on to the client.
The hard-drive half of the Fusion pair was failing and pulling the volume down as it went. We imaged both halves, rebuilt the mapping across the pair, and a design studio took back ten years of client work — from a machine the Apple Store had already written off.
Repairing the laptop made no sense, and its drive had started to click. New heads from a donor, a careful image, and three days later her lesson plans, coursework marks and reports — five years' worth — were back.
Two of the heads were gone and the platters had sat still for weeks. Once donor heads went in, the opening image pass hit 96%, and every invoice, account file and photo left us verified.
A firmware update went wrong and killed the laptop's system drive. We brought it up in technical mode, rebuilt the translator tables, and a photographer's ten years of edited catalogues came back untouched.
Mid-rebuild on a Friday, a second drive gave out and the server's production data was stuck. Every one of the four disks was imaged, the stripe rebuilt from three sound images and part of a fourth, and by Monday the factory was back at work.
Crushed underfoot in a site office, connector torn right off. The monolith had to be read through its test pads, its controller pinout mapped from nothing. Seven years' worth of invoices and CIS paperwork were back ahead of the tax deadline.
Full marks to the owner: no power applied, sealed in a bag still damp, posted first thing. On the bench we washed up the contacts, fitted a donor board carrying the original ROM, and had the whole drive imaged inside the week — two decades of family photos back, none the worse.
One portable drive held three years of client shoots. It hit the floor during a wedding load-out, and by the first test it was clicking. Two days on the imager with a donor head stack returned every gallery, including that morning's.
A firmware update overnight shifted the TPM measurements, so the machine demanded a key nobody had recorded. The practice's escrow in Entra ID held the key, found through its Recovery Key ID; on a new disk, repair-bde rebuilt the broken BitLocker metadata and every project file survived.
Rather than encrypting in place, this strain copied every file, locked the copy and deleted the original — so the originals still lay in free space where we could carve them, alongside a NAS snapshot the attacker had missed. Seven days later the firm was back trading. Nobody paid, nobody spoke to them.
Pulled out mid-write one evening, and by morning it wanted formatting. We imaged the whole drive, then repaired the boot sector and damaged MFT mirror on the copy — and a translator's client work, fifteen years of it, came back with the folder tree in one piece.
Two identical 2TB disks in one tower, and the installer put the format on the wrong one — the family archive. Since not a byte was written afterwards, the old file table survived whole, and each folder came home under the name it had always had.
A single confident keystroke took a year of accounts off an office PC. The drive was imaged the same afternoon; once the file table was rebuilt, every filename and date in the folder was exactly as it had been.
A power cut overnight left it dead by morning: no spin, invisible to BIOS. The culprit was a scorched PCB with a blown TVS diode. We moved the ROM onto a donor board and had a complete image the very day the job was opened.
It came in ticking about once a second, and five years of the shop's EPOS records were on it. One slow, gentle image — after two donor head assemblies — gave the accountant the whole ledger, and the VAT deadline was met.
A cab camera's record of a depot collision vanished overnight. An image of the card showed deletion rather than overwriting. Within the week the clip was back, repaired and delivered with hashes — answering the HR question along with the insurance claim.
Two vehicles met in a warehouse yard, the insurer wanted proof, and the DVR had overwritten the day weeks earlier. One manager's export — deleted since — was the only copy. We recovered it from the disk, hashed it and reported it, and the claim never reached a hearing.
A staff member cleared out 'old clips' — one of which showed a theft. What saved it was powering the recorder down the same afternoon. Four of the five missing days returned through surviving index entries, timestamps intact; the fifth came back by carving, playable though unlabelled.
Nine days of looping had passed on the recorder by the time the insurer asked for the footage. The disk was imaged, its index decoded, and the incident window lifted from sectors the overwrite hadn't yet reached — two exports made: one for viewing, one for the claim.
The first clue was a competitor's pitch deck landing in front of a Barnstaple employer. Digital timelines told the story from there: a single folder assembled from scattered files, a personal cloud login, the uploads done — all twenty days before any resignation letter went in. Undertakings closed it down quickly.
Two firms, one missing folder, and two stories that didn't agree. The image supported neither side's telling outright; the timeline said so in plain terms. Within a month of the report being served, the matter settled.
An employee on their way out ran a wiping tool the evening before the laptop went back. The image gave up the tool's own logs, exactly when it ran and which files it missed — and from there the whole sequence of events fell into place.
One client was sure files had been stolen. The evidence pointed somewhere duller — a mis-set sync had stripped them from the shared drive, and most were recoverable. An honest answer ended the row faster than any accusation could have.
45 cases, anonymised and verified, each told start to finish: what arrived, what was at stake, what we did, and what made it home.
Every case above began exactly as yours would: with the free diagnosis.