ADR / Casebook

Jobs already closed · written up after

The casebook. Closed jobs, described exactly as they ran.

Approval controls everything. We do not publish anything until our client has been through their recovered material and told us to go ahead, and at that point we remove all identifying information associated with the job, i.e. the person, the address and the serial number. In addition, each entry is tied directly to the appropriate technical page for that class of fault, for anyone who may want to see how the work was done rather than just being given what happened.

Put it to an engineer — the first look costs nothing
0203 0868633

Most recent at the top.

Also shown on the home page →

LDN · ADR-2026-3407JOB LOGGED ✓

A halted rebuild, and a SQL database that refused to attach

Batch and QA records at a Croydon food manufacturing facility resided on a six-bay server that had quietly operated one member short since the summer. When an amber light came up on a second carrier, a replacement disk was installed, and the rebuild began. Unfortunately, the rebuild halted mid-stream. The virtual disk then went offline, and upon the next restart the job database identified itself as SUSPECT. The server was unplugged later that day, and each individual drive arrived with its bay number still written on its carrier. The two weak drives were imaged prior to imaging the remaining drives; one of them required four passes. All remaining drives read clean from start to finish. What the controller had recorded about the set was read from the images created during recovery, and a volume was built over these images, with the .mdf and .ldf files copied off it. Each database was attached and tested here before anything went home.

The pair of weaker disks imaged ahead of the rest2 databases mounted from the clones

LDN · ADR-2026-3401JOB LOGGED ✓

A year of slowing down, and then the EliteBook stopped at the logo

A land agent in Islington had a collection of tenancy paperwork, valuation documents and site photographs going back nine years, stored on an HP EliteBook that the practice's IT department had never opened. From the spring things began to slow down, and eventually the laptop wouldn't get beyond the logo screen. The hard drive was removed, and behind a write blocker it slowly started to read. However, the hard drive contained a band around the middle that would not respond at any speed setting. This band was left until the rest of the disk had been safely copied, and was then worked in small passes over two nights. No file travelled anywhere until all folders had been opened and reviewed on our workbench, with the tenancy agreements and valuations being reviewed first, due to them both being named in the telephone call.

Every last folder opened before going backThe entire disk cloned before any repair

LDN · ADR-2026-3396JOB LOGGED ✓

A two-bay unit that had been running on a single disk since spring

An engineering firm in Ealing contacted us when their office box would no longer present its data volume. Behind a door nobody opens, one drive in the box had dropped out several months previously; although an amber light indicated that something was wrong, the remaining drive continued to support the volume by itself, and it too had begun exhibiting similar symptoms. Each drive was independently imaged; the weaker drive required two nights of short reads. Any data that the failing disk would not relinquish was extracted from its older partner, and any data that could not be obtained from the older disk was retrieved from the newer one instead. Twenty years of drawings and the job ledger were opened here prior to sending the package back to the firm. Three days door-to-door.

The pair of members cloned separately3 days here, and back to you

LDN · ADR-2026-3391JOB LOGGED ✓

After a firmware update, a four-bay QNAP with no volumes left

The four-bay QNAP under an Ealing pattern-cutter's cutting table stored twenty years of work: nesting files, grading sets and pictures of products. After an update the box rebooted and the storage pool disappeared: four lights lit green but no data volumes existed, no shares could be seen and there was nothing on the screen. That same day, the unit was unplugged and the individual drives were sent to us with numbers assigned to them (one to four). Each of the four clones processed without any issues, which narrowed down our focus to the enclosure rather than the drives themselves. We recovered the configuration of the array by reading from the clone images and created a single read-only volume above them, and when we looked within the volume every share was present. From parcel to parcel it took three days, and the patterns were placed on a new drive and sent back, ordered just as the cutting room had always ordered them.

100% imaged sector for sector3 days here, and back to you

LDN · ADR-2026-3384JOB LOGGED ✓

A DriveStation Duo that would no longer present its volume

A ground-stability consultant working out of Westminster kept bore logs, scanned abandonment plans and site photographs on a two-bay DriveStation Duo, configured as a single striped volume. Power got to the device, the fan spun and a code appeared. There were no resources available when looking at the network or when using USB. Both disks were pulled out and imaged prior to asking them about anything else. Disk one finished processing normally. Disk two had a worn-out area roughly one-third of the way in, and this section was worked over in short runs during two consecutive nights, after all items that were easily recoverable were secured. Above those images the striped volume was then reassembled and mounted read-only. Ninety-eight per cent of the information was able to come home, and the report outlines exactly what didn't make it.

98% of them recoveredThe pair of disks imaged before any other step

LDN · ADR-2026-3377JOB LOGGED ✓

Free software gave thumbnails; the wedding album needed full frames

Since the wedding the card had remained untouched (no additional frames had been added and no information had ever been written to it), and this is why the image of the card copied off so perfectly. Free software had previously tried to process these images and produced six hundred thumbnails, but none of them were good enough quality to print. Processing the scattered pieces of every CR3 image allowed all 640 to be rebuilt at full size.

640 frames back at their full size72 hours at the bench

LDN · ADR-2026-3372JOB LOGGED ✓

Two RAID 5 members down, and the year-end still filed on time

Nineteen bad sectors and that was all of it. It seemed as though two disks in the set had failed together but, in reality, one member had dropped out months ago before anybody noticed. Once another failed partway through a rebuild process, nothing was holding the volume intact. A copy of both disks demonstrated how little of that second disk could not be read, and the stripe was constructed from three good disks and a fourth that was almost good. The end-of-year filing deadline was met.

19 unreadable sectors, and no second failed disk6 days here, and back to you

LDN · ADR-2026-3366JOB LOGGED ✓

A cache battery gone flat, and a practice database that opened whole regardless

The cache battery had run out as a result of a prolonged loss of electricity. Once the power returned, the controller requested information from the office that no one present could have answered safely; therefore, it did not receive an answer. No member disk was accessed or used directly. All disks were duplicated (cloned) instead. The array's own metadata was read from the cloned disks and that data was used to establish the parity order. The rebuild process proceeded across all of the duplicate copies, resulting in the full practice database being rebuilt at the completion of the rebuild. At the same time, the write that had remained in the cache was also completed and written into the final copy of the practice database.

That database opened up whole5 days here, and back to you

LDN · ADR-2026-3361JOB LOGGED ✓

The shop fitted a new disk; every essay was still on the old one.

A shop had exhausted its capabilities to resolve the issue and had installed a replacement disk and handed the failed disk back (instead of disposing of it), thus making this recovery possible. The old disk had been clicking away in a drawer for two weeks prior to its arrival at our facility. We replaced the head stack with a suitable donor component, which got it onto the imager, and within two days we had successfully retrieved the essays and photographs and placed them on the shop's newly acquired disk.

100% of them recoveredUndoing an earlier 'repair'

LDN · ADR-2026-3353JOB LOGGED ✓

A Hackney haulier: no bookings Monday, taking them again Thursday

The call came on the Monday while the rebuild was still active, and the job was moved forward. First thing stated was: shut down power, and do not request anything else from the array. Next, each member received an image to itself and the reassembly process proceeded based on these images (and never based on the physical drives). The database came up whole upon completion, and by Thursday the firm was able to book work again.

The business taking bookings on day 4Pushed to the front

LDN · ADR-2026-3338JOB LOGGED ✓

A Passport that ticked, with nine days to a thesis deadline

A tick began in the Passport with nine days remaining before the deadline. Matched donor heads were installed, and the imaging pass was deliberately run at low speed. Units such as this keep their encryption keys on the bridge board, not on the platters, and therefore it was here that the keys were read. By doing so, the chapters, references and figures were home with a week in hand before the deadline.

100% of the thesis returned72 hours at the bench

LDN · ADR-2026-3335JOB LOGGED ✓

Two red lights on a Westminster NAS, and a rebuild begun regardless

Although two bays were indicating red status, the unit remained completely recoverable. Unfortunately, the damage was done once the rebuild process initiated afterwards, which wrote across the metadata that the box holds for itself. In order to perform recovery, a complete copy of every disk had to be made (including weak sectors), and then the mirror was put back together block by block, drawing each block from whichever disk provided a clean read of it. Every share opened exactly as it did prior to failure.

100% of them recovered5 days here, and back to you

LDN · ADR-2026-3329JOB LOGGED ✓

A wedding evening on one card, and nothing there by morning

A 512GB SanDisk that read as an empty device at breakfast; however, by the end of the job every single frame was accounted for. No information was ever written to the original card (a duplicate of the card's contents was made instead); therefore, all processing could take place against the duplicate. Much of the time spent was recovering the file structure (and reconstructing it), while a deep carve found the missing frames whose directory entries had disappeared. The photographer retained the client.

Every last frame recovered from the card48 hours at the bench

LDN · ADR-2026-3320JOB LOGGED ✓

A fortnight of slowing, then the iMac Fusion Drive stopped

An Apple Store had already determined that the iMac was beyond repair. Inside was a Fusion Drive, which is actually two devices: flash memory married to a hard disk, both shown under one name by macOS, with the mechanical component failing. Imaging treated them as separate devices and restored their join (the point where they meet) out of the resulting pair of images. A design studio has access to its last ten years of materials again.

98% of them recovered5 days here, and back to you

LDN · ADR-2026-3316JOB LOGGED ✓

A teacher's five years of work, and a laptop on the floor

The laptop was dead; the single disk inside would do nothing but click. A matching donor supplied suitable heads; imaging was deliberately run at a crawl, and by the third day she had five years' worth of lesson plans, reports and marks back.

100% of the disk's contents3 days here, and back to you

LDN · ADR-2026-3311JOB LOGGED ✓

Fifteen years of accounts behind two failed heads

Prior to arrival at our facility the disk had been standing idle for weeks, and two heads had already gone. A matched donor supplied new heads. The very first imaging pass alone yielded 96%. Once the owner had been through the list, new media carried home the ledgers, the invoices and family photos spanning decades.

96% of them recovered4 days here, and back to you

LDN · ADR-2026-3304JOB LOGGED ✓

Ten years of edits on an NVMe that stopped mid-update

During a firmware upgrade process, the laptop's system SSD stopped functioning and no data would read from it. Technical mode allowed an engineer to access a path and reassemble the translator tables for the controller until it could map out the flash again. This enabled a photographer to open their decade-long history of edit files first time.

99% of them recovered5 days here, and back to you

LDN · ADR-2026-3298JOB LOGGED ✓

A second member dropped out mid-rebuild; Monday's shift still started on time

The rebuild was half-complete on the Friday when another member became unavailable, and the live volume would not mount at all. It was powered down immediately and left alone. We copied all four disks onto our storage. Three of these copies yielded good data, and the striped array was rebuilt using those plus whatever data was still available from the fourth disk. The firm's Monday shift opened as usual.

100% of the live volume back1 weekend of work

LDN · ADR-2026-3293JOB LOGGED ✓

Seven years of invoices, and the plug lifted off its board

This stick contained seven years' worth of invoice files and CIS records, and a return was due on them soon. Someone stepped on the stick on a site-office floor and broke the connector clean off the board. Monolithic units have no connectors to attach cables to, so we needed to create a mapping of the controller pinout first, and the reading was then done directly from the test pads. The return went in prior to the deadline.

100% of them recovered3 days here, and back to you

LDN · ADR-2026-3202JOB LOGGED ✓

Sealed wet into a bag, and posted the same afternoon

No one powered it up to check if it worked properly, nor did anyone place it near a heat source, and that is why two decades of family photos were restored. It was placed in a bag while still wet and posted the same afternoon. After cleaning the pads and moving the ROM to a donor board, we successfully completed the full image by day four.

100% of them recovered4 days here, and back to you

LDN · ADR-2026-3197JOB LOGGED ✓

Three years of weddings, and a drive dropped onto concrete

It fell over during the packing-down process, and the clicking had started long before it ever reached the bench. It held three years' worth of paid work, including that morning's ceremony. Replacement heads came from a matched donor, it required two days for the copy to be prepared, and every single gallery returned home.

99% of them recovered4 days here, and back to you

LDN · ADR-2026-3192JOB LOGGED ✓

An overnight update shut a Westminster practice out of its own workstation

The practice had an internal recovery key all along and did not know it. An overnight update had changed the TPM measurements, and the workstation prompted at boot for a 48-digit code that was never recorded. The Recovery Key ID appeared on the screen, and it matched an escrow record the firm already held in Entra ID, which answered the job. The repair-bde tool created fresh BitLocker metadata on a replacement disk. All project files were able to open as normal.

100% of them recovered3 days here, and back to you

LDN · ADR-2026-3188JOB LOGGED ✓

A Richmond builders' merchant, and ransomware in the night

Nothing was encrypted where it sat. The encryption software worked on a file by file basis: read one file, produce an encrypted version of that file and place it next to the original, then delete the original it had just read (which left the actual accounts in their exact location, in unallocated space and easily recoverable). What that did not catch was sitting in a NAS snapshot that nobody had checked. Nothing was paid, nothing was answered, and the merchant had new invoices going out the same week.

Invoicing again within that same weekNot one penny paid, and no demand met

LDN · ADR-2026-3183JOB LOGGED ✓

Pulled out mid-write, and Windows read the volume as RAW

The cable was caught while it was writing to the disk, and by morning Windows could only suggest that the drive be reformatted. As soon as possible, an image of the entire 4TB was taken. From that point forward, every repair action was based upon that image. Repair actions included repairing the boot sector first and then fixing the damaged mirror of the MFT. No writes occurred to the original disk. Client files going back fifteen years were returned with the folder tree intact.

100% of them recovered3 days here, and back to you

LDN · ADR-2026-3179JOB LOGGED ✓

The format meant for the twin 2TB disk landed on the family archive

One tower contained two 2TB disks from the same manufacturer. Unfortunately, the incorrect disk was formatted. This disk contained the family archive, whereas the other was the spare. Because a quick format operation does little more than generate a new index, everything located underneath it remained in the exact location that it previously occupied. No further writes had taken place to that disk. The family archive was successfully restored, reading back just as it had gone on.

The entire file tree recovered3 days here, and back to you

LDN · ADR-2026-3174JOB LOGGED ✓

A year of bookkeeping went with a single shift-delete on the wrong folder

One keystroke inadvertently wiped the accounting records for an entire year from the office computer. The reason that the Recycle Bin never became involved is because shift was held down while deleting the wrong folder. That afternoon, an image of the affected machine was generated and the original machine was not modified or accessed in any way thereafter. Reconstructing the Master File Table using this image caused the original folder to be fully restored, with all names and dates remaining unchanged.

The entire file tree recovered24 hours at the bench

LDN · ADR-2026-3168JOB LOGGED ✓

A TVS diode gone short, and a WD with no spin at all

By morning there was no spinning motion and an empty BIOS listing; the drive's board had suffered damage due to a mains power surge that occurred during the night. The TVS diode on the board read short, having failed first (as designed); therefore, the motor and the heads remained intact. The original ROM was transferred to a donor board of matching revision and imaging was completed end to end within the day.

100% imaged sector for sector2 days here, and back to you

LDN · ADR-2026-3161JOB LOGGED ✓

A Seagate that had begun to tick, with five years of takings on it

A tick every second, perfectly consistent, with five years' worth of takings underneath it. None of the items on the drive could be accessed until two donor head assemblies had been run through the device; and once those were run through, the reading was deliberately split across several days. Once all of the entries in the ledger were accounted for, the Ealing workshop submitted its VAT return before the deadline.

97% of them recovered4 days here, and back to you

LDN · ADR-2026-3113JOB LOGGED ✓

A driver deleted the clip at a Camden distribution yard

The card itself was left untouched: an image of the card was obtained first. Every action subsequently taken to examine and report upon this evidence was conducted relative to that image. The clip that had been asked for had disappeared overnight; however, the picture data associated with that clip had not been erased and therefore could be recreated from the image. The recreated clip was then hashed, exported and forwarded to the insurer within the week. There is a distinct difference between deleting data and overwriting data, and the card clearly showed which of the two had happened.

The footage came back entireHash-verified copy handed over

LDN · ADR-2026-3108JOB LOGGED ✓

Both vans on the clip the insurer wanted, and it was gone

It took many weeks before anyone at the yard was asked for any video recordings from the cameras in use at that time. The recording equipment had exceeded its retention period many times by then. Only one clip of footage had ever existed, exported by a manager, and it was then deleted. However, that clip still existed in unallocated space on the recording device and was therefore recoverable. Data representing that one clip of footage was extracted from unallocated space using carving techniques, hashed for authenticity verification purposes and submitted to the insurer, with the method briefly documented. In the event, that was enough for the claim to settle without a hearing.

The insurer's claim signed off and closedExhibit-marked copy handed over

LDN · ADR-2026-3102JOB LOGGED ✓

Deleted through the DVR menu itself, and four days of the five returned

Fortunately, the plug was pulled out of the video recording equipment within a few hours. A member of staff had deleted footage that everyone assumed was long past keeping, and the only record of what happened in the shop went with it. Fortunately, index entries and timestamps had survived for four of the five days of activity captured by those cameras. Therefore, the video recordings for those days came back with information identifying the cameras and showing the actual dates and times captured. For day five, however, all blocks of data representing that day had to be recovered using raw block carving techniques, since no indexes or timestamps existed to identify individual video segments. While the resulting videos exist and can play back content, no timestamp information exists for that specific day.

4 days of five, timings intact72 hours at the bench

LDN · ADR-2026-3096JOB LOGGED ✓

The London shop waited nine days before asking for footage

Nine days elapsed before the insurer asked for the footage, and during that time period the recording device continued to overwrite itself repeatedly. Prior to any reads occurring from the original media, an image of that media existed in digital form. Decoding the index entries from that image placed the incident in a part of the recording where the loop had not yet completed another pass around. Two files ultimately went back: one that plays the actual video footage and one designed for the claim file.

The entire incident lifted whole off the disk3 days here, and back to you

LDN · ADR-2026-3089JOB LOGGED ✓

Uploads over twenty days, and then a resignation

Because the laptop belonged to the company there was no issue or disagreement with regards to allowing someone to examine it. There was also a clear progression of events: a collection of documents (a folder) was put together, followed by a login to a personal cloud account, followed by uploading those documents, and then a resignation letter twenty days after the last of it. The Croydon employer had started with nothing but a competitor's pitch deck, and undertakings concluded the case.

At an end after undertakings were givenThe order of events set down within 7 days

LDN · ADR-2026-3084JOB LOGGED ✓

A shared folder between two firms, and a Part 35 report

One shared folder was accessible by two firms, and one set of accounts within that folder existed in two versions that nobody could reconcile. Forensic images of each of those machines demonstrated which changes were made by which party and in what order those changes occurred, and that order settled the differences in opinion between the parties. The dispute was closed within the month.

At an end once the reports were inCPR Part 35 fully met

LDN · ADR-2026-3077JOB LOGGED ✓

Fifteen minutes of wiping, recorded by the tool itself

A quarter of an hour of erasing data, set going one evening on a laptop by someone who was working through their notice period, with the laptop due back the very next day. During this time, the wiping tool documented each step it took. The documentation remained intact within the image and included both the start time as well as the names of the folders that the tool did not get to. At that point, based upon the documentation found in the image, there was no longer any dispute regarding the sequence of events.

The order of events worked outThe conclusions sent over on day 8

LDN · ADR-2026-3071JOB LOGGED ✓

A Camden firm certain that its project files had been deleted on purpose

None of that had occurred. A wrong sync client configuration had independently wiped out the share, certainly a less exciting reason than the client had assumed. Most of what had gone was able to be restored. This discovery resolved the issue without anyone receiving blame for anything.

The falling-out settled without blameThe conclusions reported in six days

Every one of the forty-five.

Forty-five jobs, none of which was written up before its customer approved the text and the specific identifying information had been removed. Each document outlines the hardware received, what relied upon it, the work performed at the bench, and how much of it went home.

Number forty-six could be yours.

Each of these forty-five jobs began in this manner: an engineer reviewed it, and there was no cost associated with the review.

0203 0868633

Get it assessed Sending it to Guildford