The lab · casebook
A rolling record of what's crossed this bench — anonymised, verified, and filed under the page that explains the fault. Click any exhibit to read how that kind of recovery works.
Talk it through with an engineer
01273 964902
Two 4TB and two 8TB drives, one failure, and a rebuild DSM attempted overnight that ended in Volume Crashed. Under the hood: three separate mdadm arrays, two healthy, one degraded-but-derivable. Assembled off-box in order, the btrfs tree stepped back one generation, and every share returned.
Power cut overnight, Suspect by morning, and an IT contractor's finger hovering over the emergency repair. Forensic copies first told a better story: the log was intact enough to replay. Recovered on the copy, attached clean, and the morning's appointments ran twenty minutes late instead of a week.
An admin's cleanup script took the wrong folder. Because the datastore was quiet all weekend, both VMDKs sat unlinked and whole; parsed out of the VMFS image on Monday, descriptors rebuilt, and both machines booted in a sandbox by Tuesday evening — payroll among them.
Working at midnight, 0GB at breakfast — the classic translator collapse, platters untouched. Two service-area modules repaired over the terminal, the translator regenerated, and the drive introduced itself correctly long enough for a complete, unhurried image.
A confident YouTube tutorial, a bare WD disk in a SATA dock, and Windows' initialise prompt accepted before the doubt set in. The original board arrived in the same envelope — keys recovered from the bridge, the small damage from initialisation repaired on the image, and fifteen years of family photos decrypted intact.
Free software had returned 600 files — all previews, none printable. The original card, thankfully unused since, imaged cleanly; the CR3s reassembled from their fragments, and the couple's gallery delivered at full resolution — including the forty frames the free tool never found at all.
Drive two died in June; nobody noticed until drive four followed in August, mid-rebuild. Images told the truth: drive four had nineteen bad sectors, not a failure. The stripe rebuilt from three-and-a-nearly-whole members, and the practice filed on time with everything.
Power cut, UPS exhausted, and on restart the Smart Array wanted decisions nobody could safely make. All four members imaged, the RIS metadata read, delayed parity honoured — and the practice-management database mounted from the rebuild, complete to the last pre-outage write the cache had flushed.
A Brighton student's machine came back from a repair shop working perfectly — with a brand-new empty drive inside. The original, pronounced dead, was clicking in a drawer. Donor heads, a two-day image, and every essay and photo moved onto the new drive the shop had fitted.
Their booking system's RAID went down Monday morning with a rebuild already failed. All members imaged back-to-back through Tuesday, the array rebuilt virtually Wednesday, and the verified database handed over Thursday lunchtime — priority sequencing, no theatrics.
Clicking on power-up and a dissertation due in nine days. Donor heads, a careful image, and the bridge's encryption keys carried across — every chapter and reference file came home with time to spare.
Two red lights on a two-bay unit, then a DIY rebuild that overwrote its own metadata. Both drives imaged past their bad sectors, the mirror reassembled from whichever image held the healthiest copy of each region, and the shared drive came back whole.
512GB SanDisk, fine at midnight, empty by morning. Forensic clone first, file system rebuilt on the copy, a deep carve behind it for anything orphaned — the couple got every frame, and the photographer kept the client.
The mechanical half was dying and taking the volume with it. Both drives imaged, the Fusion logic rebuilt across them, and a design studio's decade of client work returned complete — after the Apple Store had said the machine was beyond help.
The machine was beyond economic repair; the drive inside was clicking. Donor heads, a careful image, and five years of lesson plans, coursework marks and reports were back in her hands in three days.
Two failed heads and a drive that hadn't spun in weeks. Donor heads went in, the drive imaged at 96% on the first pass, and the accounts, invoices and photos all left the lab verified.
A laptop firmware update went wrong and the system drive never came back. The drive was brought up in technical mode, its translation tables rebuilt, and ten years of a photographer's edited catalogues recovered intact.
Production data trapped on a server that had eaten its second drive mid-rebuild on a Friday. All four disks imaged, the stripe reconstructed from three-and-a-bit good images, and the factory reopened on Monday morning.
Stepped on in a site office, connector torn clean off. The monolith was read through its test pads, the controller's layout reversed, and seven years of invoices and CIS records handed back before the tax deadline.
The owner's instinct was perfect: no power-up, sealed wet, posted next morning. Contacts treated, the shorted board replaced with its ROM carried over, and a full image taken the same week — twenty years of family photos, dry side up.
A portable drive holding three years of client shoots, dropped at a wedding load-out and clicking by the time it was plugged in to check. One donor head assembly and a two-day image later, every gallery was back — including the one from that morning.
A firmware update changed the TPM's measurements overnight and the machine demanded a key nobody had written down. The Recovery Key ID led to the practice's Entra ID escrow; damaged BitLocker metadata was rebuilt with repair-bde onto a new drive, and every project file survived.
The strain copied files, encrypted the copies and deleted the originals — so the originals were still carvable from free space, alongside a NAS snapshot the attacker missed. Trading resumed inside a week. Nothing was paid, and nothing was said to the attackers.
Pulled mid-write one evening; by morning it wanted formatting. Imaged in full, the boot sector and a damaged MFT mirror rebuilt on the copy, and fifteen years of a translator's client work returned with its folder tree intact.
Two identical 2TB drives in one tower; the one holding the family archive got the fresh install's format. Nothing else was written — so the old file table was recovered whole, and every folder came back under its own name.
An entire year's bookkeeping removed with one confident keystroke on an office desktop. The drive was imaged that afternoon, the file table rebuilt, and the folder came back with every filename and date intact.
Dead the morning after a power cut — no spin, no BIOS entry. A blown TVS diode and a scorched board; the ROM moved to a donor PCB and the drive imaged completely the same day it was opened.
Clicking once a second by the time it arrived, with five years of EPOS records aboard. Two donor head assemblies and a patient image later, the accountant had a complete ledger and the shop made its VAT deadline.
The clip of a depot collision vanished from the cab camera overnight — deleted, not overwritten, as the card's image showed. Recovered, repaired and packaged with hashes the same week, it settled both the insurance question and the HR one.
A disputed warehouse collision, an insurer asking questions, and a recorder that had already looped past the incident — except for the deleted export a manager had made and binned. Recovered from the drive, hashed, documented, and the claim closed without a hearing.
A staff member cleared 'old clips' that included a theft. The recorder was stopped the same afternoon — the decision that saved the case. Index remnants restored four of the five deleted days with timestamps; the fifth came back by carving, playable but unlabelled.
By the time the insurer asked for footage, the recorder had been looping for nine days. The drive was imaged, the index parsed, and the incident window recovered from sectors the loop hadn't yet reached — exported twice, once for people and once for the claim.
A Worthing employer's suspicion started at a rival's pitch deck. The timeline said the rest: files staged into one folder, a personal cloud account signed in, uploads completed — twenty days before the resignation letter. The matter resolved on undertakings, quickly.
Two businesses, one deleted folder, two theories. The imaged drive supported neither side's favourite story — and said so, with the timeline to prove it. The matter settled within a month of the report being exchanged.
A leaver ran a wiping tool the night before returning their machine. The tool's own logs, the run window, and the files it missed were all recovered from the image — and the timeline of what happened first told the rest of the story.
Files a client insisted had been stolen turned out, on the timeline, to have been deleted from a shared drive by a sync misconfiguration — and most were recoverable. The honest answer ended the dispute faster than the suspected one would have.
45 case files, anonymised and verified — each one the full story: what arrived, what it meant, what the bench did, and what came back.
Every case above started with the same free diagnosis yours would.