The lab · closed cases
A running record of jobs finished at this bench. Customers confirm the outcome, names come out, and every entry links to the guide for that fault. Open one and you will see how that kind of recovery actually runs.
Run the problem past an engineer
0800 6890668
Two 8TB disks, two 4TB, one member down — the DSM rebuild ran overnight and finished on Volume Crashed. Inside were three distinct mdadm arrays: two healthy, the third degraded but usable. We rebuilt them off the box, wound the btrfs tree back a generation, and every share came back intact.
The mains dropped overnight and the database came up Suspect. An IT contractor had the emergency repair queued; copies taken forensically showed the log would replay after all. We ran it on the copy, it attached on the first go, and the morning's bookings started twenty minutes down rather than a week.
Somebody aimed a tidy-up script at the wrong folder. Nothing wrote to that datastore across the weekend, so both VMDKs stayed whole — just unreferenced. On the Monday we took an image of the VMFS volume, recovered the pair from it and wrote fresh descriptor files. Both machines, payroll included, booted in a sandbox by Tuesday night.
Working on the Friday, chirping at one beat a second by Monday. The spindle had seized; the platters were unmarked. The whole stack came out of its aluminium body and into a matched donor chassis, where it turned steadily enough for one full image at an easy pace.
A video tutorial made it look straightforward. The disk came out of its Home Media Network Drive, went into a SATA dock, and Windows asked whether to initialise it — the answer was yes, and the second thoughts arrived afterwards. Since nothing else was ever written, imaging went smoothly. The Linux volume was reassembled from that image, the shallow damage the initialise had done was repaired in the copy, and fifteen years of family photographs went home.
A free tool had produced 600 files: all embedded previews, none fit to print. Nothing had been written to the card since, so it imaged cleanly. Fragment by fragment the CR3s were rebuilt, and the couple got their gallery back at full size — with forty frames that tool had never found.
Disk two had been down since June and nobody spotted it. In August disk four fell out mid-rebuild. Imaging showed drive four was not dead at all — nineteen bad sectors, no more. Three sound members and that almost-whole fourth put the stripe back together, and the filings went in to deadline.
The UPS gave out before the mains came back, and the Smart Array returned with prompts nobody dared answer. All four members were imaged, the RIS metadata read out and the delayed parity respected. From that rebuild the practice-management database mounted whole — good to the last write the cache had flushed before the power went.
A Milton Keynes student got a laptop back from the repair shop working perfectly — on a new, empty drive. The original disk, dismissed as dead, had sat clicking in a drawer. Two days of donor-head work later, every essay and photo was waiting on the new drive the shop had fitted.
Monday, the RAID beneath the booking system failed — a rebuild had already been attempted, and badly. Tuesday, every member was imaged. Wednesday, the array was reassembled virtually. Thursday lunchtime, a checked database went back into service. Priority queue, no theatrics.
The clicking began nine days out from a dissertation deadline. Donor heads went in, the imaging was taken slowly, and the encryption keys were lifted from the USB bridge — every chapter and every reference came back with days in hand.
Two red lights on a two-bay box, followed by a DIY rebuild that wiped the unit's own metadata. We imaged both disks straight past the bad sectors, then put the mirror back together block by block, keeping whichever copy read cleaner. The shared volume came back whole.
A 512GB SanDisk carried an entire wedding at midnight and read empty by breakfast. We cloned it first, rebuilt the file system on that copy, then ran a deep carve for anything left orphaned. The couple got every shot, and the photographer kept the client.
In a Fusion Drive the spinning half was on its way out, dragging the whole volume with it. Both devices were imaged, the mapping between them rebuilt, and ten years of a design studio's work came home — from a Mac the Apple Store had given up on.
The laptop wasn't worth fixing, and its disk had begun to click. Donor heads went in, the image was taken slowly, and three days later five years of lesson plans, marking and reports were back with her.
The platters had not moved in weeks and two heads were gone. Donor heads went in; 96% came off on the first imaging pass, and every ledger file, invoice and photo went back verified.
A firmware flash went bad and took out the laptop's system SSD. In technical mode we put the translator tables back together, and a photographer's decade of edited catalogues returned intact.
A rebuild was running on the Friday when a second member failed, locking up the server's live data. All four disks were imaged; the stripe went back together from three clean images plus part of a fourth, and the factory started Monday as normal.
Someone stood on it in a site office and the connector tore off entirely. A monolith, so the read had to happen at the test pads once we had mapped the controller pinout ourselves. The tax return went in on time, with seven years of invoices and CIS records behind it.
The owner got it right: nothing was powered up, the damp drive went into a sealed bag and straight into the post. At the bench we cleaned the contacts, fitted a donor board that carried the original ROM, and imaged the whole disk within the week — twenty years of family photos back, no worse for it.
Three years of client shoots sat on one portable drive. It hit a hard floor during a wedding pack-down and was clicking by the first test. A donor head stack, two days on the imager, and every gallery came back — that morning's included.
A firmware update ran overnight and shifted the TPM measurements, so the workstation asked for a key that had never been written down anywhere. We tracked the Recovery Key ID through to the firm's escrow in Entra ID, then used repair-bde to rebuild the broken BitLocker metadata on a clean disk. No project file was lost.
This strain didn't encrypt in place. It copied each file, locked the copy, then deleted what it had copied — leaving the originals in free space for us to carve, plus a NAS snapshot they had missed. The firm traded again a week later. No payment, no contact.
Unplugged mid-write one evening; by morning Windows wanted to format it. The whole drive was imaged first, and the repairs — boot sector, then the damaged MFT mirror — ran only on that image. A translator got back fifteen years of client files, folder structure intact.
One tower, two matching 2TB disks, and the fitter formatted the wrong one — and that was the family archive. Nothing was written to it afterwards, so the original file table stayed intact and every folder came back under the name it always had.
One firm press of a key took twelve months of accounts off an office machine. The disk went on the imager that afternoon; we rebuilt the file table, and the folder came back with every name and date intact.
The power went out overnight. By morning the drive sat silent — no spin, nothing in BIOS. Its TVS diode had gone and taken the board with it. We moved the ROM to a donor PCB and pulled a full image on the day the case opened.
It arrived ticking about once a second, carrying five years of EPOS records. Two donor head assemblies and one long, patient image later, the shop filed its VAT on time and the accountant had a complete ledger.
Footage of a depot collision disappeared from a cab camera overnight. Imaging the card showed the file had been deleted, not written over. The clip came back inside a week, repaired and handed over with hash values — settling the insurance claim and the HR question together.
Two vans hit each other in a yard. Weeks later the insurer wanted proof, by which time the recorder had looped over that day. A manager had exported the clip and then deleted it, leaving nothing else anywhere. We pulled that export back off the disk, hashed it and wrote it up; the claim settled with no hearing.
Someone on the staff binned a batch of 'old clips'. One held a theft. The recorder was switched off that same afternoon, which is why any of it survived: index entries still held four of the five lost days, timestamps and all, and carving brought the fifth back — playable, but with no labels.
The insurer asked for the footage nine days into the loop. We imaged the disk, decoded its index, and lifted the incident window from sectors the overwrite had not yet touched. Back went two exports — one for viewing, one for the claim.
It started when a Towcester employer saw a rival's pitch deck. The digital timeline filled in the rest: files gathered into a single folder, a sign-in to a personal cloud account, then the uploads — twenty days before the resignation letter arrived. Undertakings settled it soon after.
One folder gone, two companies, two accounts that would not line up. Neither version survived the image intact, and the timeline set that out in plain words. The case settled inside a month of the report landing.
The night before handing the laptop back, a leaver set a wiping tool going. The tool's own logs came through in the image: the exact minute it started, and which files it missed. That was enough to assemble the whole sequence.
A client arrived certain that files had been taken. What we found was far more mundane: a badly configured sync had wiped them off the shared drive, and most came back. The plain answer settled the dispute quicker than any accusation would have.
45 anonymised cases, each verified and told in full: what turned up, what was riding on it, what the bench did, and what went back.
Every one of these opened just as yours would, with a free diagnosis.