PDR / Casebook

The bench · finished work

Every job we close, set down in full.

No entry is published before the customer signs off on what was recovered, and identifying detail — people, places, serial numbers — comes out at that point. Every write-up carries a link to the technical guide covering that fault, so the story comes first and the method second.

You will be talking to an engineer
0800 6890668

Most recent first.

Find it on the home page →

PL · PLY-2026-0857LOGGED ✓

A four-bay NAS of mismatched disks, undone by its own rebuild

Volume Crashed sat on the screen. Overnight the DiskStation had begun rebuilding onto a member that was quietly shedding sectors itself. No two of the four disks were the same size, so SHR had built the volume across a pair of mdadm sets, with LVM above them and btrfs above that; read one disk by itself and it tells you nothing. Each of the four went onto the imager, the layers were reassembled in sequence, and the shares mounted.

All shares restored5 days start to finish

PL · PLY-2026-0851LOGGED ✓

A Saltash practice rang at 8:55am with SQL Server marked Suspect

An overnight power cut had left the database marked Suspect. The call arrived as the doors opened, and there was an emergency slot free already. The original was left untouched; copies were taken first, and one of those copies still let the transaction log run through. The database came back on the first go, and the morning list was twenty minutes behind rather than a week.

Reattached — with no losses24 hours on the bench

PL · PLY-2026-0846LOGGED ✓

A My Book whose bridge had died, with the disk inside encrypted

The enclosure had stopped appearing at all, and the obvious step — pulling the 3.5-inch disk and putting it straight on a SATA port — returned noise and nothing else. For a My Book that is exactly what happens. The encryption sits in the USB bridge, so the bare disk is meaningless without the key held on that board. A matching bridge was used for the imaging, with the key lifted from the original, and the two volumes it carried, one of work files and one a photo library, came off complete.

Both volumes recovered in full3 days start to finish

PL · PLY-2026-0841LOGGED ✓

A 4TB Barracuda getting slower at every copy

Windows still listed the drive, the manufacturer's own utility still passed it, and each week it took a little longer to copy anything off. Shingled recording went into a run of desktop Barracudas: write to one track and the drive must rewrite the tracks beside it, so a soft area of surface slows the lot to a crawl. Imaging was done a head at a time, deliberately slowly, with the sluggish zones held back to the end and nothing written to the disk.

100% imaged3 days start to finish

PL · PLY-2026-0834LOGGED ✓

A Satellite Pro frozen at the logo, with an MQ01 nearly gone

A hinge had gone slack after years of being carried about, and then the Satellite came up one morning on the Toshiba logo and stuck. Usually that points at the machine rather than the disk; this time the disk was the problem, with one band on the MQ01ABD no longer giving a clean read. Rather than let a repair shop run test after test over it, the owner powered the laptop off and left it, which is why there was anything to recover. The 2.5-inch drive came out and was imaged a head at a time, very slowly, with the bad band kept until last and nothing written to it.

98% read backNothing written back to it

PL · PLY-2026-0827LOGGED ✓

A wedding shoot, and the free tool returned only previews

The free tool had only produced thumbnails — six hundred of them, none large enough to print. Nothing further had been recorded onto the card after the wedding, so imaging it was uneventful. Rebuilding each CR3 from its scattered pieces put all 640 back at full size.

640 frames back, printable72 hours on the bench

PL · PLY-2026-0822LOGGED ✓

Year-end a week off, and a RAID 5 with two disks gone

Two disks looked to have died at the same moment. The truth was slower than that: disk two had left the set in June and gone unremarked, and disk four then stopped part way through the rebuild in August. Nineteen bad sectors were all that imaging found wrong with the fourth, so three sound members and one nearly sound were enough between them to put the stripe back. The year-end filing went in on its due date.

19 bad sectors, not a second failure6 days start to finish

PL · PLY-2026-0816LOGGED ✓

A dead cache battery, and the practice database intact

The mains had been down long enough to drain the cache battery flat. On restart the controller asked the practice a question none of the staff could safely answer, so it sat there unanswered. Nothing was run on the disks themselves: every member was imaged first, and the array's own metadata came back off those images. The parity rotation followed from that, and the set was assembled on the copies. The practice database opened whole, out to the final write the cache had held.

Database read back whole5 days start to finish

PL · PLY-2026-0811LOGGED ✓

A new disk, fitted and empty. The student's work was on the old one.

The laptop came back from the shop working: a new disk fitted, nothing on it. The old one had been given up on, and it sat clicking in a drawer in a Plymouth student flat. It went on the bench for a donor head stack. Inside two days the essays and the pictures went onto the shop's new disk.

100% read backAfter that 'repair'

PL · PLY-2026-0803LOGGED ✓

A Penzance haulier down on Monday, back taking bookings by Thursday

It went to the top of the bench list on the first call, which mattered, because a rebuild was already turning when the phone rang. The array itself was left exactly as it stood. Each member disk was copied on its own, and the volume was worked out again from those copies rather than from the disks. The database opened clean, and the booking system was live again by Thursday lunchtime.

Business back up in 4 daysPriority job

PL · PLY-2026-0788LOGGED ✓

Nine days to the hand-in, and the Passport started ticking

The ticking started nine days before the hand-in. A matched donor stack was fitted, then the copy was taken at deliberately low speed. On a Passport the encryption keys sit on the bridge board, so that is where they were lifted from. Every chapter and reference came back, with a week left before the deadline.

100% of the thesis72 hours on the bench

PL · PLY-2026-0785LOGGED ✓

A Newquay NAS, and the rebuild that followed

Two red lights showing, and the unit could still have been saved. What finished it was the rebuild someone started next, which wrote over the box's own metadata. Afterwards both disks were imaged, bad sectors and all. The mirror was reassembled a block at a time, each block taken from whichever disk still read cleanly at that spot, and the shared volume came back whole.

100% read back5 days start to finish

PL · PLY-2026-0779LOGGED ✓

A wedding shot at night, and a card empty by morning

Nothing was tried on the card itself. It went to a clone first, and every step after that ran on the copy: the file system was put back together, and a deep carve then went after the pictures that had lost their place in it. A 512GB SanDisk, loaded the evening before and reading empty by breakfast, gave up every frame. The photographer kept the client.

Every frame recovered48 hours on the bench

PL · PLY-2026-0770LOGGED ✓

A Fusion Drive iMac that gave out over two weeks

The owner had already been told at the Apple Store that the iMac was beyond saving. Inside it sat a Fusion Drive — a flash module and a spinning disk, which macOS presents as a single volume — and the mechanical half was failing. Each part was copied on its own, the pairing between them was worked out again, leaving a design studio with ten years of its work.

98% read back5 days start to finish

PL · PLY-2026-0766LOGGED ✓

Five years of a teacher's files, in a dropped laptop

The laptop was scrap, but the disk inside it was only clicking. Donor heads off a matching drive went on, the copy was taken slowly, and three days later she had five years of marks, her reports and her lesson plans back.

100% of what the disk held3 days start to finish

PL · PLY-2026-0761LOGGED ✓

Two dead heads between a firm and fifteen years of books

Weeks had gone by since the disk last turned, and two of its heads had gone with it. A donor stack matched to it went in. The opening imaging pass lifted 96%, and the ledgers, the invoices and a good many family photographs were checked over and posted back.

96% read back4 days start to finish

PL · PLY-2026-0754LOGGED ✓

A firmware update halted, and the NVMe with it

A firmware update was still running when the laptop's system SSD gave up, and nothing would read from it afterwards. Working in technical mode, an engineer put the translator tables back. Ten years of the photographer's edits opened again.

99% read back5 days start to finish

PL · PLY-2026-0748LOGGED ✓

The second member went on Friday, and Monday still ran

On the Friday a second member dropped out mid-rebuild, and the live volume stopped being readable. The array was switched off and left that way. Each of the four disks was imaged onto our own hardware, and the stripe was read back from three sound copies plus what little the fourth would still hand over. The Monday shift started on time.

100% of what was live1 weekend

PL · PLY-2026-0743LOGGED ✓

Seven years of invoices, and a connector off the board

Someone trod on it on the floor of a site office, and the connector came away from the board. Seven years of invoices sat on that stick, the CIS records beside them, and a tax return was due in. A monolith offers no socket to work through, so the pinout of the controller was traced and the read lifted off the test pads. The return was filed on the day.

100% read back3 days start to finish

PL · PLY-2026-0652LOGGED ✓

A soaked drive from a home office, bagged and posted the same day

Two things saved it: nobody powered it up to see, and nobody tried drying it out. It went into the post that same afternoon, still wet, sealed inside a bag. On the bench the pads were cleaned, the ROM moved across to a donor board, and a few days later a full image came off it. Twenty years of family photographs went home.

100% read back4 days start to finish

PL · PLY-2026-0647LOGGED ✓

A wedding shoot packed away, and a drop onto concrete

The drop came as the kit was being packed away, and it was clicking by the time it reached the bench. Three years of paid shoots were on that drive. A donor stack was fitted, two days went on the imaging, and every gallery came back — that morning's ceremony among them.

99% read back4 days start to finish

PL · PLY-2026-0642LOGGED ✓

A Newquay practice, locked out of its workstation by an update that ran overnight

The key existed. Nobody at the practice knew that. An update had run in the night and shifted what the TPM measures, so the machine came up wanting a key nobody there had thought to record. Its Recovery Key ID matched an entry already held in the firm's Entra ID escrow, and that was the whole answer. repair-bde then put fresh BitLocker metadata on a new disk, and the project files opened as before.

100% read back3 days start to finish

PL · PLY-2026-0638LOGGED ✓

A Cornish builders' merchant, and ransomware in the night

The lock had been applied to copies, not to the files themselves: each original was read, a scrambled duplicate written, and the original then deleted — so what mattered was still lying in free space, waiting to be carved out. The remainder sat in a NAS snapshot nobody had thought to check. The firm was trading again within the week, having paid nothing and answered nothing.

Trading again inside the weekNothing paid to anyone

PL · PLY-2026-0633LOGGED ✓

The lead went during a write, and the volume read as RAW

The lead came out while the disk was being written to. By morning Windows had one suggestion, and it was to format. The 4TB was imaged in full before anything else, and every repair after that was made to the copy — the boot sector first, then the ruined mirror of the MFT. Nothing at all went back to the original. Fifteen years of client work returned, folder tree intact.

100% read back3 days start to finish

PL · PLY-2026-0629LOGGED ✓

A pair of matching disks, and the format hit the wrong one

Two 2TB disks of the same model were sitting in the one tower, and the format landed on the one carrying the family archive instead of the spare. A quick format writes a fresh index and leaves the rest alone, which is the only reason any of it survived. Nothing new had been saved to the disk in the meantime, so the archive came out exactly as it went in.

Whole tree came back3 days start to finish

PL · PLY-2026-0624LOGGED ✓

Twelve months of ledgers gone, and Shift on the wrong folder

Shift was held down over the wrong folder, so a year of bookkeeping vanished from the office PC without going near the recycle bin at all. Imaging of the tower started that same afternoon and every step afterwards ran against the copy: the master file table was reassembled and the folder showed up again, names and dates just as before.

Whole tree came back24 hours on the bench

PL · PLY-2026-0618LOGGED ✓

A shorted TVS diode, and the WD would not spin

A surge in the night took out the board. The TVS diode had failed short — exactly the job it exists to do, dying so that the motor and heads survive. Come morning there was no spin and nothing listed in the BIOS. Its ROM was transferred to a matching donor board, and from there the disk read right through inside the day.

100% imaged2 days start to finish

PL · PLY-2026-0611LOGGED ✓

Five years of till records, behind a ticking Seagate

A single tick a second, as steady as a metronome, and five years of till records underneath it. Donor head stacks went in twice over, and the imaging was drawn out across several days on purpose. A shop on Mutley Plain got its VAT return away on time with a complete ledger.

97% read back4 days start to finish

PL · PLY-2026-0563LOGGED ✓

A Cattedown haulage firm, and the clip its driver wiped

Nothing was done to the card until a copy of it existed, and every step after that ran on the copy. The clip the insurer had asked for went overnight; the picture data behind it did not. The file was rebuilt from the copy, hashed and exported, and it reached the insurer inside a week. A deletion is not an overwrite, and the dashcam card settled which one this had been.

Footage came back intactVerified export

PL · PLY-2026-0558LOGGED ✓

A deleted clip, two vans, and an insurance claim

The yard was not asked about it until the recorder had rolled past that date several times over. A manager had pulled the clip weeks before and then removed the file, and nowhere else held a copy. It was carved back out of unallocated space, hashed, and set out in a brief report. No hearing was needed to close the claim.

Claim settledCourt-ready export

PL · PLY-2026-0552LOGGED ✓

Footage cleared off the recorder, and four of five days back

A member of staff had cleared out footage that looked well past its use. The theft sat in the middle of what went. What saved it was the recorder going off within a few hours: four of the five days that had gone still held their index entries and times, so those clips came back named and dated. The fifth was carved out of the blocks — it plays, but nothing labels it.

4 of the five missing days, timestamps intact72 hours on the bench

PL · PLY-2026-0546LOGGED ✓

Nine days round the loop, after a Plymouth shop break-in

The insurer left it nine days, and all that while the recorder kept writing over itself. No read was taken from the original before an image existed. Once the index was decoded, the break-in proved to be held on sectors that the loop had yet to return to. Two copies were issued — one for viewing, one to go in the claim file.

The break-in window came back3 days start to finish

PL · PLY-2026-0539LOGGED ✓

The uploads ran twenty days ahead of the resignation

The laptop was the company's own, which made the examination easy to authorise. The order of events on it was plain: the files were collected in one place, a private account was opened in the cloud, and the transfer went from there. The resignation letter came twenty days after the last upload. The Falmouth employer had begun with a rival's pitch deck and little else. Undertakings closed the matter.

Closed on undertakingsTimeline set out inside 7 days

PL · PLY-2026-0534LOGGED ✓

Two Cornwall firms sharing one folder, and a Part 35 report

One folder was shared between two companies, and the accounts in it existed in two versions that did not tally. Imaging showed editing on both, and the order in which those edits ran settled it. The matter closed inside the month.

Closed post-exchangeCPR 35 throughout

PL · PLY-2026-0527LOGGED ✓

Fifteen minutes of wiping, logged by the tool itself

The laptop was due back the next day, and on that last evening somebody heading out started a wiping tool. It ran about a quarter of an hour. The tool logged its own activity, that log came through in the image showing when it began and which folders it had not touched, and the order of events was no longer arguable.

Timeline fixedFindings by day 8

PL · PLY-2026-0521LOGGED ✓

Project files gone, and a south Devon firm certain of theft

The client came to us expecting to be shown a theft. What the evidence showed was duller than that: a sync client had been set up wrongly and had cleared the shared folder by itself. Most of what went was still there to be recovered. The finding closed the dispute, with nobody accused.

Dispute resolvedFindings back in six days

All of them, in order.

Forty-five entries, each anonymised and cleared with its customer first. They say what came in, what was depending on it, the way the job was worked, and how much of the data came home.

Your job could be number forty-six.

Every one opened where yours would: with a diagnosis costing nothing.

0800 6890668

Book a free look Sending it in to us