The lab · case files
An ongoing log of the work that has passed over this bench: names removed, outcomes checked, each one filed beside the page covering that fault. Open any exhibit to see how such a recovery is done.
Speak to an engineer about it
0800 6890668
A pair of 4TB disks, a pair of 8TB, one dead member, and an overnight DSM rebuild that finished in Volume Crashed. Beneath that sat three distinct mdadm arrays: two intact, the third degraded but still derivable. Reassembled in sequence off the box, with the btrfs tree wound back a single generation, every share came back.
The power went overnight; by morning the database sat in Suspect and an IT contractor was poised to run the emergency repair. Copies taken forensically told a kinder story — the log could still be replayed. Recovery ran on the copy, it attached cleanly, and the morning's bookings slipped twenty minutes rather than a week.
A tidy-up script run by an admin deleted the wrong folder. Nothing touched the datastore over the weekend, so both VMDKs lay unlinked but intact; we pulled them from the VMFS image on Monday, rebuilt the descriptors, and had both machines running in a sandbox by Tuesday evening — payroll one of them.
Fine on the Friday, chirping once a second by the Monday — a seized spindle, with the platters themselves unmarked. The mechanism came out of the aluminium shell, the platter pack was moved across to a matched donor on the bench, and the drive then turned steadily enough to take a full, unhurried image.
A YouTube guide watched with confidence, then the disk out of a Home Media Network Drive pushed into a SATA dock and Windows' invitation to initialise accepted — the doubt came later. Nothing had been written to it since, so the drive imaged cleanly: the Linux volume was rebuilt from that copy alone, the light damage that initialising caused mended within it, and fifteen years of family photographs came back whole.
A free tool had produced 600 files — every one a preview, none fit to print. The card itself was untouched since, so it imaged cleanly; the CR3s rebuilt from fragments, and the couple's gallery went out at full resolution — including the forty frames that tool missed entirely.
The second disk failed in June and nobody spotted it until the fourth dropped out in August, mid-rebuild. Imaging revealed the truth: drive four held nineteen bad sectors, not a dead disk. The stripe came back from three members and a near-whole fourth, and the practice still filed everything on time.
The mains failed, the UPS ran dry, and at restart the Smart Array wanted choices nobody could make safely. All four drives imaged, the RIS metadata parsed, delayed parity respected — and the practice-management database mounted off the rebuild, whole to the last write the cache flushed before the power went.
A student in Southampton collected a machine from a repair shop that ran perfectly — fitted with a blank new drive. The original, declared dead, lay clicking in a drawer. Donor heads, two days of imaging, and every essay and photo went onto the replacement the shop had installed.
The RAID under their booking system fell over on Monday, a failed rebuild already behind it. Members were imaged one after another through Tuesday, the array assembled virtually on Wednesday, and a verified database went back by Thursday lunchtime — priority sequencing, nothing dramatic.
A clicking drive, and nine days until a dissertation was due. Donor heads went on, a patient image followed, and the bridge's encryption keys moved across — every chapter and reference came back with days in hand.
A two-bay box showing two red lights, then a home-made rebuild that wrote over its own metadata. Each disk was imaged through its bad sectors, the mirror rebuilt region by region from whichever image held the cleanest copy, and the shared volume returned intact.
A 512GB SanDisk, full at midnight and blank by breakfast. We cloned it forensically, rebuilt the file system on that clone, then carved deep behind it for anything orphaned — the couple had every frame back, and the photographer kept the client.
The spinning half of the pair was failing and dragging the volume down with it. Both drives were imaged, the Fusion mapping rebuilt across them, and a design studio got ten years of client work back in full — after the Apple Store had written the machine off.
The machine wasn't worth repairing, and the drive inside had begun clicking. A donor head swap, a patient image, and five years' worth of coursework marks, lesson plans and reports were in her hands three days later.
Two heads had failed and the platters hadn't turned for weeks. With donor heads fitted, the first imaging pass reached 96%, and the invoices, accounts and photos all went home verified.
A botched firmware update on a laptop left the system drive dead. We woke it in technical mode, rebuilt the translation tables, and pulled back ten years of a photographer's edited catalogues, intact.
A Friday rebuild that swallowed a second drive left production data stranded on the server. We imaged all four disks, rebuilt the stripe from three-and-a-bit usable images, and the factory was running again by Monday.
Trodden on in a site office, connector ripped clean away. Reading the monolith meant going in via its test pads, with the controller's layout worked out from scratch. Seven years of invoices and CIS records went back before the tax deadline.
The owner got it exactly right: left unpowered, bagged while still wet, in the post by morning. We cleaned the contacts, swapped the shorted board with its ROM moved over, and imaged the whole disk that week — twenty years of family photographs, safe and dry.
Three years of client shoots lived on one portable drive, which was dropped during a wedding load-out and had begun clicking by the time anyone tested it. A donor head stack and two days of imaging brought every gallery back — the morning's included.
Overnight a firmware update altered the TPM measurements, and the machine asked for a key nobody had noted down. Its Recovery Key ID pointed to the practice's Entra ID escrow; repair-bde rebuilt the damaged BitLocker metadata onto a fresh disk, and no project file was lost.
This variant duplicated each file, locked the duplicate and wiped what it had copied from — which left the real files sitting in free space, ready to carve, next to a NAS snapshot the intruder overlooked. The business was trading again within seven days. No ransom, no contact.
Unplugged during a write one evening; by daybreak it asked to be formatted. A full image was taken, the boot sector and a broken MFT mirror rebuilt on that copy, and a translator's fifteen years of client files came back, folder tree whole.
One tower, two matching 2TB disks; the installer formatted the wrong one — the disk carrying the family archive. Nothing further was written to it, so the previous file table came back intact and every folder returned under its proper name.
One decisive keypress on an office desktop wiped twelve months of accounts. We imaged the drive that same afternoon, rebuilt the file table, and the folder returned with all its filenames and dates untouched.
The morning after a power cut it was lifeless — no spin-up, nothing in BIOS. A burnt TVS diode and a charred board were to blame; the ROM went onto a donor PCB and a full image came off the same day it was opened.
It was ticking at roughly one click a second when it reached us, carrying five years of EPOS records. After two donor head assemblies and a slow, careful image, the accountant had the full ledger and the shop hit its VAT deadline.
Footage of a depot collision disappeared from the cab camera overnight. Imaging the card showed it deleted, not overwritten. Recovered, repaired and handed over with hashes inside the week, it settled the HR question as well as the insurance one.
A warehouse shunt in dispute, an insurer pressing for answers, and a recorder that had long since taped over the moment — bar one export a manager made, then threw away. Pulled back off the disk, hashed, written up, and the claim settled without a hearing.
Someone on the team deleted what they took for 'old clips', a theft among them. Switching the recorder off that afternoon is what rescued the job. Leftover index entries brought back four of the five lost days complete with timestamps; carving retrieved the fifth, watchable but without labels.
Nine days of looping had passed before the insurer requested the footage. We imaged the disk, read the index, and pulled the incident window out of sectors the loop had not yet touched — then exported it twice: one copy to watch, one for the claim.
It began when a Salisbury employer read a rival's pitch deck. The timeline filled in the rest: documents gathered into a single folder, a private cloud account logged into, uploads finished — twenty days ahead of the resignation letter. Undertakings settled the matter, and fast.
One deleted folder, two companies, two competing accounts. The disk image backed neither party's preferred version, and the timeline set that out plainly. The dispute settled a month after the report changed hands.
The night before handing back their laptop, a departing employee ran a wiping utility. From the image we pulled its own logs, the window in which it ran, and the files it never reached — then the sequence of events filled in everything else.
A client was certain files had been stolen. The timeline showed something duller: a badly configured sync had removed them from a shared drive, and most could be brought back. That truthful finding closed the argument sooner than the accusation would have.
45 write-ups, names stripped out and results checked; every one tells the whole thing — what turned up, why it mattered, what we did, what went back.
Each of these began exactly where yours would: a diagnosis costing nothing.