ADR / Casebook

Jobs already closed · written up after

The casebook. Closed jobs, described exactly as they ran.

Approval governs all of it. Nothing is published until the customer has been through the recovered material and told us to go ahead, and at that point every identifying detail comes out — the person, the address, the serial number. Each entry then points out to the technical page dealing with that class of fault, for anyone wanting method rather than narrative.

Put it to an engineer — the first look costs nothing
0203 0868633

Most recent at the top.

Also shown on the home page →

LDN · ADR-2026-3407JOB LOGGED ✓

A halted rebuild, and a SQL database that refused to attach

Batch and QA records at a Croydon food manufacturer sat on a six-bay server, which had quietly been running one member short since the summer. Amber came up on a second carrier, a replacement disk was fitted, and the rebuild started — then stopped half-way through. Offline went the virtual disk, and at the next restart the job database announced itself SUSPECT. The chassis was unplugged that afternoon, and each drive got here with its bay number still written on the carrier. Both weak members were imaged ahead of the others, one of them needing four passes; the remainder read cleanly from one end to the other. What the controller itself recorded about the set was read out of the images, the volume assembled over them, with the .mdf and .ldf lifted off as copies. Each database attached, and each was tested here before a single thing went home.

The pair ofweaker disks imaged ahead of the rest2databases mounted from the clones

LDN · ADR-2026-3401JOB LOGGED ✓

A year of slowing down, and then the EliteBook stopped at the logo

A land agent in Islington kept nine years of tenancy paperwork, valuations and site photography on an HP EliteBook the practice's IT had never once opened. Since the spring, everything had grown slower and slower to open. Then one morning it got as far as the logo and stayed there. The spinning disk was lifted out. Behind a write blocker it read, slowly, though a band round the middle refused to answer at any speed. That band waited while the rest of the surface was safely imaged, and was then worked in short passes over two nights. No file travelled anywhere until every folder had been opened on the bench here, the tenancy agreements and the valuations first, because those were the two named on the telephone.

Every lastfolder opened before going backThe entiredisk cloned before any repair

LDN · ADR-2026-3396JOB LOGGED ✓

A two-bay unit that had been running on a single disk since spring

An engineering firm in Ealing telephoned when the office box would no longer present its data volume. Behind a door nobody opens, a member had dropped out months before, an amber light its only announcement, and the disk left standing had carried the volume by itself ever since — and was beginning to go the same way. Each was imaged on its own, the tired one across two nights of short passes. Whatever that disk would not give up was read off its older partner, and whatever the older partner could not manage was read from the newer side instead. Twenty years of drawings and the job ledger were opened here before the parcel travelled back. Three days, door to door.

The pair ofmembers cloned separately3days here, and back to you

LDN · ADR-2026-3391JOB LOGGED ✓

After a firmware update, a four-bay QNAP with no volumes left

An Ealing pattern-cutter kept two decades of work — nesting files, grading sets, product photography — on a four-bay QNAP that sat beneath the cutting table. After an update the box restarted, and the storage pool had gone: four bays lit green, no volumes, no shares, nothing on the screen. It was unplugged that afternoon and the disks came to us numbered one to four. All four cloned through without a snag, which pointed at the enclosure rather than the disks. The layout of the array was read from the images, the volume brought up over them read-only, and every share was there. Parcel to parcel it took three days, and the patterns went home on a new drive, ordered as the cutting room had always ordered them.

100%imaged sector for sector3days here, and back to you

LDN · ADR-2026-3384JOB LOGGED ✓

A DriveStation Duo that would no longer present its volume

A ground-stability consultant in Westminster kept borehole records, scanned abandonment plans and site photographs on a two-bay DriveStation Duo, the pair configured as one striped volume. Power reached the unit, the fan turned and a code appeared; the network showed nothing and USB showed nothing. Out came both disks, each imaged before it was asked for anything more. One read straight through. The other held a worn band roughly a third of its length in, worked over in short runs across two nights, once everything easy had been secured. Above those images the stripe was reassembled and mounted read-only. Ninety-eight per cent came home, and the report names what did not.

98%of them recoveredThe pair ofdisks imaged before any other step

LDN · ADR-2026-3377JOB LOGGED ✓

Free software gave thumbnails; the wedding album needed full frames

Since the wedding the card had been left alone — no new frames, nothing written to it at all — and that is why the copy lifted off so cleanly. Free software had already had a go and turned out six hundred thumbnails, none of them fit to print. Rebuilding every CR3 from the pieces it lay scattered in returned all 640 at full size.

640frames back at their full size72hours at the bench

LDN · ADR-2026-3372JOB LOGGED ✓

Two RAID 5 members down, and the year-end still filed on time

Nineteen bad sectors, and that was all of it. The set looked as though two disks had gone together; in truth one member had dropped out months before without anyone noticing, so once a second stopped partway into the rebuild nothing was left holding the volume up. Copying the pair showed how little of that second disk would not read, and the stripe was worked out from three sound members and a fourth that was very nearly sound. The year-end filing still went in on time.

19unreadable sectors, and no second failed disk6days here, and back to you

LDN · ADR-2026-3366JOB LOGGED ✓

A cache battery gone flat, and a practice database that opened whole regardless

The cache battery had been emptied by a long power cut. With the mains restored, the controller asked the office something nobody there could answer safely, so it went unanswered. Not one member disk was touched directly. Every disk was cloned instead, and the array's own metadata was read from those clones, which fixed the parity order. The rebuild ran across the copies, and what came up at the end was the practice database entire, the write still sitting in the cache included.

That databaseopened up whole5days here, and back to you

LDN · ADR-2026-3361JOB LOGGED ✓

The shop fitted a new disk; every essay was still on the old one.

A shop had reached the end of what its own tools could do, so it fitted a replacement disk and handed the failed one back rather than binning it — which is why any of this was possible. The old drive had been clicking in a drawer for a fortnight by the time it arrived. A donor head stack got it onto the imager, and inside two days the essays and the photographs were sitting on the shop's new disk.

100%of them recoveredUndoingan earlier 'repair'

LDN · ADR-2026-3353JOB LOGGED ✓

A Hackney haulier: no bookings Monday, taking them again Thursday

The call came on the Monday with a rebuild still turning, and the job was moved forward. First thing said: cut the power, and ask the array for nothing else. After that each member got an image to itself, and the reassembly ran on those images, never on the drives. The database came up whole, and by Thursday the firm was booking work again.

The businesstaking bookings on day 4Pushedto the front

LDN · ADR-2026-3338JOB LOGGED ✓

A Passport that ticked, with nine days to a thesis deadline

A tick started in the Passport with nine days left on the deadline. Donor heads were matched and fitted, then the imaging pass was deliberately held at a low speed. Units of this kind keep their encryption keys on the bridge board, not on the platters, and that is where the keys were read. Chapters, references and figures were home with a week in hand.

100%of the thesis returned72hours at the bench

LDN · ADR-2026-3335JOB LOGGED ✓

Two red lights on a Westminster NAS, and a rebuild begun regardless

With two bays showing red the unit was still entirely recoverable. What did the damage was the rebuild begun afterwards, which wrote across the metadata the box holds for itself. Recovery meant a complete copy of every disk, weak sectors included, then putting the mirror back together block by block, drawing each one from whichever disk had read it cleanly. Every share opened exactly as it had before.

100%of them recovered5days here, and back to you

LDN · ADR-2026-3329JOB LOGGED ✓

A wedding evening on one card, and nothing there by morning

A 512GB SanDisk that read as empty at breakfast; by the close of the job every frame was accounted for. Nothing was ever written to the card — a clone was lifted from it, and everything after that ran on the copy. Most of the work was putting the file system back together, and a deep carve turned up the frames whose directory entries had gone. The photographer kept the client.

Every lastframe recovered from the card48hours at the bench

LDN · ADR-2026-3320JOB LOGGED ✓

A fortnight of slowing, then the iMac Fusion Drive stopped

An Apple Store had already given up on the iMac. What sat inside was a Fusion Drive: flash married to a hard disk, the pair shown by macOS under one name, with the mechanical side of it failing. Imaging treated them as two devices, and the join between them was worked back out of the resulting pair of images. A design studio has its last ten years again.

98%of them recovered5days here, and back to you

LDN · ADR-2026-3316JOB LOGGED ✓

A teacher's five years of work, and a laptop on the floor

The laptop was finished; the disk in it did nothing but click. A matching donor supplied the heads, imaging was deliberately run at a crawl, and by the third day the lesson plans, the reports and the marks for five years were all back with her.

100%of the disk's contents3days here, and back to you

LDN · ADR-2026-3311JOB LOGGED ✓

Fifteen years of accounts behind two failed heads

By the time it reached us the drive had been standing idle for weeks, two heads already gone. A matched donor supplied replacements. The very first imaging pass on its own gave back 96%. Once the owner had been through the list, new media carried home the ledgers, the invoices and family photographs going back decades.

96%of them recovered4days here, and back to you

LDN · ADR-2026-3304JOB LOGGED ✓

Ten years of edits on an NVMe that stopped mid-update

The laptop's system SSD went silent partway through a firmware update, and nothing more would read off it. Technical mode reopened a route in for an engineer, who put the translator tables back together until the flash underneath could be mapped by the controller once more. A photographer's decade of edits opened first time.

99%of them recovered5days here, and back to you

LDN · ADR-2026-3298JOB LOGGED ✓

A second member dropped out mid-rebuild; Monday's shift still started on time

The rebuild was halfway through on the Friday when a second member went offline, and the live volume would not mount at all. Power down, hands off. All four disks were copied onto storage of ours; three of those copies read sound, and the stripe went back together from them plus whatever the fourth would still yield. Monday's shift opened as it always does.

100%of the live volume back1weekend of work

LDN · ADR-2026-3293JOB LOGGED ✓

Seven years of invoices, and the plug lifted off its board

That stick held seven years of invoices plus the CIS records, and a return was falling due on them. Somebody had stood on the thing across a site-office floor and the connector left the board altogether. Monoliths offer nothing to plug a lead into, so the pinout of the controller had to be mapped first and the reading done at the test pads. The return went in ahead of its deadline.

100%of them recovered3days here, and back to you

LDN · ADR-2026-3202JOB LOGGED ✓

Sealed wet into a bag, and posted the same afternoon

Nobody powered it up to test it and nobody propped it beside a heater, and that is why two decades of family photographs are back. It went into a bag wet and caught the post the same afternoon. The pads were cleaned, the ROM moved onto a donor board, and the full image was done by day four.

100%of them recovered4days here, and back to you

LDN · ADR-2026-3197JOB LOGGED ✓

Three years of weddings, and a drive dropped onto concrete

It went over during the pack-down, and the clicking had started long before it ever reached the bench. On it were three years of paid work, that morning's ceremony among them. Heads came from a matched donor, the copy took two days, and every gallery came home.

99%of them recovered4days here, and back to you

LDN · ADR-2026-3192JOB LOGGED ✓

An overnight update shut a Westminster practice out of its own workstation

The practice had the key all along and did not know it. An overnight update altered the TPM measurements, and the workstation asked at boot for 48 digits nobody had ever noted down. On screen was a Recovery Key ID, and it matched an escrow record the firm already held in Entra ID, which answered the job. Fresh BitLocker metadata went onto a replacement disk using repair-bde, and every project file opened normally again.

100%of them recovered3days here, and back to you

LDN · ADR-2026-3188JOB LOGGED ✓

A Richmond builders' merchant, and ransomware in the night

Nothing at all had been encrypted where it sat. The software worked file by file: read one, put an encrypted version beside it, then delete the original it had just read — which left the real accounts exactly where they had always been. Unallocated, and straightforward to pull back. What that did not catch was sitting in a NAS snapshot that nobody had checked. Nothing was paid, nothing was answered, and the merchant had invoices going out again the same week.

Invoicingagain within that same weekNot one pennypaid, and no demand met

LDN · ADR-2026-3183JOB LOGGED ✓

Pulled out mid-write, and Windows read the volume as RAW

The cable was caught mid-write, and by morning Windows had nothing to suggest but a format. First move was an end-to-end image of the 4TB; from then on every repair was made against that copy — the boot sector to begin with, and after that the MFT's damaged mirror. The original was never touched by a write. Client files stretching back fifteen years returned with the folder tree intact.

100%of them recovered3days here, and back to you

LDN · ADR-2026-3179JOB LOGGED ✓

The format meant for the twin 2TB disk landed on the family archive

One tower held two 2TB disks of the same make, and the wrong one of the two was formatted: the family archive, not the spare. Since a quick format only puts down a new index, everything under it stayed exactly where it had been. Nothing more had been written to that disk, and the archive read back just as it had gone on.

The entirefile tree recovered3days here, and back to you

LDN · ADR-2026-3174JOB LOGGED ✓

A year of bookkeeping went with a single shift-delete on the wrong folder

One keystroke wiped a year of bookkeeping from the office PC. Shift was held over the wrong folder, which is why the recycle bin never came into it. An image of the machine was made that afternoon and the original left alone thereafter. Rebuilding the master file table against the copy returned the folder whole, its names and dates unchanged.

The entirefile tree recovered24hours at the bench

LDN · ADR-2026-3168JOB LOGGED ✓

A TVS diode gone short, and a WD with no spin at all

Morning brought no spin and an empty BIOS listing: a mains spike overnight had ended the board. Its TVS diode read short — that part failing first, exactly as intended, so the motor and the heads do not. The original ROM moved onto a donor board of matching revision, and imaging ran end to end inside the day.

100%imaged sector for sector2days here, and back to you

LDN · ADR-2026-3161JOB LOGGED ✓

A Seagate that had begun to tick, with five years of takings on it

A tick every second, absolutely regular, with five years of takings under it. Nothing would read off the drive until two donor head stacks had been through it, and the reading that followed was spread on purpose across several days. A complete ledger meant the Ealing workshop met its VAT deadline.

97%of them recovered4days here, and back to you

LDN · ADR-2026-3113JOB LOGGED ✓

A driver deleted the clip at a Camden distribution yard

The card itself was left untouched: an image was made of it first and every later step ran against that image. The clip asked for had gone overnight, but the picture data beneath it had not — so it came back off that copy, was hashed and exported, and reached the insurer within the week. Deletion and overwriting are two different things, and the card showed plainly which of them had happened.

The footagecame back entireHash-verifiedcopy handed over

LDN · ADR-2026-3108JOB LOGGED ✓

Both vans on the clip the insurer wanted, and it was gone

Nobody at the yard was asked for footage for weeks; the recorder had passed that date more than once by then. Only one clip had ever existed, exported by a manager and afterwards deleted. It was still down in unallocated space, and came back out of there carved and hashed, with the method briefly documented — enough, in the event, for the claim to settle without a hearing.

The insurer's claimsigned off and closedExhibit-markedcopy handed over

LDN · ADR-2026-3102JOB LOGGED ✓

Deleted through the DVR menu itself, and four days of the five returned

What saved this one was the plug coming out of the recorder within a few hours. A member of staff had deleted footage everyone assumed was long past keeping, and the only record of what happened in the shop went with it. Index entries and timings had survived on four of the five days, so those clips returned carrying camera names and clock times. Day five had to be carved from raw blocks: it plays, but nothing in it says when.

4days of five, timings intact72hours at the bench

LDN · ADR-2026-3096JOB LOGGED ✓

The London shop waited nine days before asking for footage

The insurer left it nine days, and the recorder overwrote itself the whole time. An image existed before anything at all was read from the original. The index, once decoded, placed the incident where the loop had not come round a second time. What went back was two files: one that plays, one for the claim file.

The entire incidentlifted whole off the disk3days here, and back to you

LDN · ADR-2026-3089JOB LOGGED ✓

Uploads over twenty days, and then a resignation

The laptop was the company's own, so authorising an examination raised no argument. The sequence was plain: a folder put together, then a personal cloud sign-in, then an upload, then a resignation letter twenty days on from the last of it. The Croydon employer had begun with nothing but a competitor's pitch deck. Undertakings closed the matter.

At an endafter undertakings were givenThe order of eventsset down within 7 days

LDN · ADR-2026-3084JOB LOGGED ✓

A shared folder between two firms, and a Part 35 report

One shared folder, two firms, and one set of accounts in two versions that nobody could reconcile. A forensic image of each machine showed which edit had been made on which side, and in what order — and the order settled it. The dispute closed within the month.

At an endonce the reports were inCPRPart 35 fully met

LDN · ADR-2026-3077JOB LOGGED ✓

Fifteen minutes of wiping, recorded by the tool itself

A quarter of an hour of wiping, set going one evening by somebody working a notice period, on a laptop due back next day. The tool logged itself as it went; the log survived into the image, carrying the start time and naming folders the run never got to. The sequence stopped being arguable at that point.

The order of eventsworked outThe conclusionssent over on day 8

LDN · ADR-2026-3071JOB LOGGED ✓

A Camden firm certain that its project files had been deleted on purpose

Nothing of the sort had happened. A sync client, wrongly configured, had emptied the share by itself — a far duller explanation than the one the client had assumed — and most of what had gone proved recoverable. The finding settled the argument without a single person being blamed.

The falling-outsettled without blameThe conclusionsreported in six days

Every one of the forty-five.

Forty-five jobs, none written up before its customer approved the text and the identifying detail had gone. Each sets out the hardware that arrived, what depended on it, the work done at the bench, and how much of it went home.

Number forty-six could be yours.

Not one of these forty-five started any other way: an engineer looked at it, and the look was free.

0203 0868633

Get it assessed Sending it to Guildford