PDR / Casebook

The bench · finished work

Every job we close, set down in full.

No entry is published before the customer signs off on what was recovered, and identifying detail — people, places, serial numbers — comes out at that point. Every write-up carries a link to the technical guide covering that fault, so the story comes first and the method second.

You will be talking to an engineer
0800 6890668

Most recent first.

Find it on the home page →

PL · PLY-2026-0857FILED ✓

A four-bay NAS of mismatched disks, undone by its own rebuild

Volume Crashed sat on the screen. Overnight the DiskStation had begun rebuilding onto a member that was quietly shedding sectors itself. No two of the four disks were the same size, so SHR had built the volume across a pair of mdadm sets, with LVM above them and btrfs above that; read one disk by itself and it tells you nothing. Each of the four went onto the imager, the layers were reassembled in sequence, and the shares mounted.

All shares restored5 days start to finish

PL · PLY-2026-0851FILED ✓

A Saltash practice rang at 8:55am with SQL Server marked Suspect

An overnight power cut had left the database marked Suspect. The call arrived as the doors opened, and there was an emergency slot free already. The original was left untouched; copies were taken first, and one of those copies still let the transaction log run through. The database came back on the first go, and the morning list was twenty minutes behind rather than a week.

Reattached — with no losses24 hours on the bench

PL · PLY-2026-0846FILED ✓

A My Book whose bridge had died, with the disk inside encrypted

The enclosure had stopped appearing at all, and the obvious step — pulling the 3.5-inch disk and putting it straight on a SATA port — returned noise and nothing else. For a My Book that is exactly what happens. The encryption sits in the USB bridge, so the bare disk is meaningless without the key held on that board. A matching bridge was used for the imaging, with the key lifted from the original, and the two volumes it carried, one of work files and one a photo library, came off complete.

Both volumes recovered in full3 days start to finish

PL · PLY-2026-0841FILED ✓

A 4TB Barracuda getting slower at every copy

Windows still listed the drive, the manufacturer's own utility still passed it, and each week it took a little longer to copy anything off. Shingled recording went into a run of desktop Barracudas: write to one track and the drive must rewrite the tracks beside it, so a soft area of surface slows the lot to a crawl. Imaging was done a head at a time, deliberately slowly, with the sluggish zones held back to the end and nothing written to the disk.

100% imaged3 days start to finish

PL · PLY-2026-0834FILED ✓

A Satellite Pro frozen at the logo, with an MQ01 nearly gone

A hinge had gone slack after years of being carried about, and then the Satellite came up one morning on the Toshiba logo and stuck. Usually that points at the machine rather than the disk; this time the disk was the problem, with one band on the MQ01ABD no longer giving a clean read. Rather than let a repair shop run test after test over it, the owner powered the laptop off and left it, which is why there was anything to recover. The 2.5-inch drive came out and was imaged a head at a time, very slowly, with the bad band kept until last and nothing written to it.

98% read backNothing written back to it

PL · PLY-2026-0827FILED ✓

A wedding shoot, and the free tool returned only previews

The free tool had only produced thumbnails — six hundred of them, none large enough to print. Nothing further had been recorded onto the card after the wedding, so imaging it was uneventful. Rebuilding each CR3 from its scattered pieces put all 640 back at full size.

640 frames back, printable72 hours on the bench

PL · PLY-2026-0822FILED ✓

Year-end a week off, and a RAID 5 with two disks gone

Two disks looked to have died at the same moment. The truth was slower than that: disk two had left the set in June and gone unremarked, and disk four then stopped part way through the rebuild in August. Nineteen bad sectors were all that imaging found wrong with the fourth, so three sound members and one nearly sound were enough between them to put the stripe back. The year-end filing went in on its due date.

19 bad sectors, not a second failure6 days start to finish

PL · PLY-2026-0816FILED ✓

A dead cache battery, and the practice database intact

The mains had been down long enough to drain the cache battery flat. On restart the controller asked the practice a question none of the staff could safely answer, so it sat there unanswered. Nothing was run on the disks themselves: every member was imaged first, and the array's own metadata came back off those images. The parity rotation followed from that, and the set was assembled on the copies. The practice database opened whole, out to the final write the cache had held.

Database read back whole5 days start to finish

PL · PLY-2026-0811FILED ✓

A new disk, fitted and empty. The student's work was on the old one.

The laptop came back from the shop working, with a brand-new disk fitted and nothing on it. The old disk had been given up on and sat clicking in a drawer in a Plymouth student flat. It went on the bench for a donor head stack. Within two days the essays and photographs were put onto the shop's new disk.

100% read backAfter that 'repair'

PL · PLY-2026-0803FILED ✓

A Penzance haulier down on Monday, back taking bookings by Thursday

It went to the top of the bench list on the first call, which mattered, because a rebuild was already turning when the phone rang. The array itself was left exactly as it stood. Each member disk was copied on its own, and the volume was worked out again from those copies rather than from the disks. The database opened clean, and the booking system was live again by Thursday lunchtime.

Business back up in 4 daysPriority job

PL · PLY-2026-0788FILED ✓

Nine days to the hand-in, and the Passport started ticking

Nine days before the hand-in date, the drive's ticking started. A matched donor stack was fitted and the copy was run at an intentionally slow rate. Since the encryption keys on a Passport are stored on the bridge board, that is where they were pulled from. All chapters and references came back, leaving a week to go until the deadline.

100% of the thesis72 hours on the bench

PL · PLY-2026-0785FILED ✓

A Newquay NAS, and the rebuild that followed

At that point there were two red lights on display and the unit may still have been recoverable. The rebuild that someone else started is what finished it, because it wrote over the box's own metadata. After that both disks were imaged (bad sectors included), and the mirror was put back together one block at a time, taking each block from whichever disk still had clean data at that spot, and the shared volume came back whole.

100% read back5 days start to finish

PL · PLY-2026-0779FILED ✓

A wedding shot at night, and a card empty by morning

Nothing was attempted on the card itself. First it was cloned, and all actions after that used the clone: the file system was rebuilt, then a deep carve was run to find the pictures that had lost their place in it. The 512GB SanDisk, loaded the night before and completely empty by morning, gave up every single frame. The photographer kept his client.

Every frame recovered48 hours on the bench

PL · PLY-2026-0770FILED ✓

A Fusion Drive iMac that gave out over two weeks

The owner had already been told at the Apple Store that the iMac could not be recovered. Inside was a Fusion Drive with a failing mechanical half; it is a flash module and a spinning disk that are paired under macOS as a single volume. Each part was copied separately and the pairing between them recreated, which gave a design studio back ten years' worth of its work.

98% read back5 days start to finish

PL · PLY-2026-0766FILED ✓

Five years of a teacher's files, in a dropped laptop

The laptop was scrap, but the disk inside it was only clicking. Donor heads off a matching drive went on, the copy was taken slowly, and three days later she had five years of marks, her reports and her lesson plans back.

100% of what the disk held3 days start to finish

PL · PLY-2026-0761FILED ✓

Two dead heads between a firm and fifteen years of books

Weeks had gone by since the disk last turned, and two of its heads had gone with it. A donor stack matched to it went in. The opening imaging pass lifted 96%, and the ledgers, the invoices and a good many family photographs were checked over and posted back.

96% read back4 days start to finish

PL · PLY-2026-0754FILED ✓

A firmware update halted, and the NVMe with it

A firmware update was still running when the laptop's system SSD gave up, and nothing would read from it afterwards. Working in technical mode, an engineer put the translator tables back. Ten years of the photographer's edits opened again.

99% read back5 days start to finish

PL · PLY-2026-0748FILED ✓

The second member went on Friday, and Monday still ran

On the Friday, in the middle of a rebuild, a second member failed and the live volume could no longer be read. The array was shut down and left in that condition. Each of the four disks was then imaged on our own hardware and the stripe rebuilt from three good copies plus whatever little data the fourth failed disk still had. The Monday shift began on time.

100% of what was live1 weekend

PL · PLY-2026-0743FILED ✓

Seven years of invoices, and a connector off the board

In a site office someone stood on it, and the connector broke loose from the board. This stick held seven years' worth of invoices and the CIS records with them, and the tax return was due. Since you can't plug into a monolith, the controller pinout was traced using the test pads, and the data was pulled. The tax return was filed on the same day.

100% read back3 days start to finish

PL · PLY-2026-0652FILED ✓

A soaked drive from a home office, bagged and posted the same day

Two things saved it: nobody plugged it in to take a look, and nobody attempted to dry it out. That same afternoon it went in the post, wet, in a sealed bag. On the bench the pads were cleaned and the ROM transferred to a donor board, and after a few days a complete image came off it. Twenty years' worth of family pictures went back home.

100% read back4 days start to finish

PL · PLY-2026-0647FILED ✓

A wedding shoot packed away, and a drop onto concrete

It was dropped while the kit was being packed up, and by the time it got to the bench it was clicking. Three years' worth of paid shoots were on that drive. A donor stack was fitted, two days went on imaging, and every gallery came back, including that morning's ceremony.

99% read back4 days start to finish

PL · PLY-2026-0642FILED ✓

A Newquay practice, locked out of its workstation by an update that ran overnight

The key was never missing. No one at the practice realised that. After an overnight update the TPM changed what it measured, so when it booted up it asked for a key nobody there had thought to record. The Recovery Key ID matched an entry in the firm's existing Entra ID escrow, and that was all there was to do. Then repair-bde put new BitLocker metadata on a new disk, and the project files opened again as if nothing had happened.

100% read back3 days start to finish

PL · PLY-2026-0638FILED ✓

A Cornish builders' merchant, and ransomware in the night

The encryption was applied to the copies, not the actual files: each original file was read, an encrypted duplicate was written, and the original deleted. So what they needed most was still on the disk, in free space, ready to be carved out. The rest was in a NAS snapshot nobody had thought to check. Within one week the business was up and running again, without paying or answering anything.

Trading again inside the weekNothing paid to anyone

PL · PLY-2026-0633FILED ✓

The lead went during a write, and the volume read as RAW

The lead fell out while the disk was being written to. By the morning Windows had one suggestion, which was to format the drive. The 4TB was fully imaged before anything else was tried, and every repair after that was made to the image (the boot sector first, then the ruined mirror of the MFT). Nothing at all was written back to the original. Fifteen years of client work came back, with the folder tree intact.

100% read back3 days start to finish

PL · PLY-2026-0629FILED ✓

A pair of matching disks, and the format hit the wrong one

There were two 2TB disks of the same model in the one tower, and the format hit the one holding the family archive rather than the spare. A quick format just writes a new index and leaves everything else alone, which is the only reason any of it survived. Nothing new had been saved to the disk since, so the archive came back exactly as it went in.

Whole tree came back3 days start to finish

PL · PLY-2026-0624FILED ✓

Twelve months of ledgers gone, and Shift on the wrong folder

Shift was held down over the wrong folder, so a year of bookkeeping went from the office PC without ever going near the recycle bin. Imaging of the tower began that same afternoon and every step after that was run on the copy: the master file table was put back together and the folder appeared again, with its names and dates as before.

Whole tree came back24 hours on the bench

PL · PLY-2026-0618FILED ✓

A shorted TVS diode, and the WD would not spin

A surge in the night took out the board. The TVS diode had failed short, which is exactly what it is there for, dying so the motor and heads survive. By the morning there was no spin and nothing showing in the BIOS. The ROM was moved over to a matching donor board, and from there the disk read right through within the day.

100% imaged2 days start to finish

PL · PLY-2026-0611FILED ✓

Five years of till records, behind a ticking Seagate

A single tick a second, as steady as a metronome, and five years of till records underneath it. Donor head stacks went in twice over, and the imaging was drawn out across several days on purpose. A shop on Mutley Plain got its VAT return away on time with a complete ledger.

97% read back4 days start to finish

PL · PLY-2026-0563FILED ✓

A Cattedown haulage firm, and the clip its driver wiped

Nothing was done to the card until a copy existed, and every step after that was done on the copy. The clip the insurer had asked for disappeared overnight, but the picture data behind it didn't. The file was rebuilt from the copy, hashed and exported, and it got to the insurer within a week. A deletion is not the same as an overwrite, and the dashcam card showed which one this had been.

Footage came back intactVerified export

PL · PLY-2026-0558FILED ✓

A deleted clip, two vans, and an insurance claim

The yard was not asked about it until the recorder had rolled past that date several times over. A manager had pulled the clip weeks before and then removed the file, and nowhere else held a copy. It was carved back out of unallocated space, hashed, and set out in a brief report. No hearing was needed to close the claim.

Claim settledCourt-ready export

PL · PLY-2026-0552FILED ✓

Footage cleared off the recorder, and four of five days back

A member of staff had cleared out footage that looked well past its use. The theft sat in the middle of what went. What saved it was the recorder going off within a few hours: four of the five days that had gone still held their index entries and times, so those clips came back named and dated. The fifth was carved out of the blocks — it plays, but nothing labels it.

4 of the five missing days, timestamps intact72 hours on the bench

PL · PLY-2026-0546FILED ✓

Nine days round the loop, after a Plymouth shop break-in

The insurer left it nine days, and all that while the recorder kept writing over itself. No read was taken from the original before an image existed. Once the index was decoded, the break-in proved to be held on sectors that the loop had yet to return to. Two copies were issued — one for viewing, one to go in the claim file.

The break-in window came back3 days start to finish

PL · PLY-2026-0539FILED ✓

The uploads ran twenty days ahead of the resignation

The laptop was the company's own, which made the examination easy to authorise. The order of events on it was plain: the files were collected in one place, a private account was opened in the cloud, and the transfer went from there. The resignation letter came twenty days after the last upload. The Falmouth employer had begun with a rival's pitch deck and little else. Undertakings closed the matter.

Finalised on undertakingsTimed sequence set out inside 7 days

PL · PLY-2026-0534FILED ✓

Two Cornwall firms sharing one folder, and a Part 35 report

One folder was shared between two companies, and the accounts in it existed in two versions that did not tally. Imaging showed editing on both, and the order in which those edits ran settled it. The matter closed inside the month.

Finalised post-exchangeCPR 35 throughout

PL · PLY-2026-0527FILED ✓

Fifteen minutes of wiping, logged by the tool itself

The laptop was due back the next day, and on that last evening somebody heading out started a wiping tool. It ran about a quarter of an hour. The tool logged its own activity, that log came through in the image showing when it began and which folders it had not touched, and the order of events was no longer arguable.

Timed sequence fixedThe analysis by day 8

PL · PLY-2026-0521FILED ✓

Project files gone, and a south Devon firm certain of theft

The client came to us expecting to be shown a theft. What the evidence showed was duller than that: a sync client had been set up wrongly and had cleared the shared folder by itself. Most of what went was still there to be recovered. The finding closed the dispute, with nobody accused.

Dispute resolvedThe analysis back in six days

All of them, in order.

PLY-2025-0308A Drop, and Two Wedding SeasonsTravel hard drives PLY-2025-0903The Heads Were Worn, and It Clicked TwiceDesktop disks on mains PLY-2025-1103RAID 5 Out, Tender MondayRAID and NAS volumes PLY-2025-1106Fifteen Years of Teaching, and No LightTravel hard drives PLY-2025-0603Power Came Back, No Drive DetectedCircuitry faults PLY-2025-1110Ten Years of Work on a 2011 MacBook ProApple machines PLY-2025-0907Three Clips That Would Not ImportCamera & memory cards PLY-2025-0311A Redundancy Check Halted Every CopyMissing or corrupt files PLY-2025-0607It Fell in Its Rubber ShellApple machines PLY-2025-1113It Fell, and Seemed UnharmedMissing or corrupt files PLY-2025-0611One Power-Up, and It Never Came BackDesktop disks on mains PLY-2025-0911The SD Card That Lost a CornerCamera & memory cards PLY-2025-1117I Deleted It and Walked AwayMissing or corrupt files PLY-2025-1120The Disk Itself Was Never FaultyDesktop disks on mains PLY-2025-0914A Surveyor's Archive on an IomegaRAID and NAS volumes PLY-2025-0614The Cover Came Off After a VideoCircuitry faults PLY-2025-1124Scanned With DMDE, Then GrindingDesktop disks on mains PLY-2025-1127One Beep, and the Copy StoppedWhen nothing came back PLY-2025-0315A Beeping d2, and a Shifting SizeDesktop disks on mains PLY-2025-0918Saves Stopped, Then the Disk DidSSD & flash media PLY-2025-0618A Fall Mid-Copy, Connector and AllCircuitry faults PLY-2025-0319It Dragged, and Then It Would Not OpenTravel hard drives PLY-2025-0322The LED Lit, and Nothing TurningTravel hard drives PLY-2025-0621Slow to Appear, Then Pulled Out EarlyApple machines PLY-2025-0326The Health Test Passed, the Long Scan FailedLaptops & towers PLY-2025-0921One Disk, and the PC Barely MovesDesktop disks on mains PLY-2025-1131Spinning, Lit, and Still Not MountedTravel hard drives PLY-2025-1134Five Starts, Then It Gave UpTravel hard drives PLY-2025-1138Every Client Job Was On It, and Yesterday It WorkedTravel hard drives PLY-2025-0330The Fingerprint Would No Longer Unlock ItWhen nothing came back PLY-2025-0925A Rattle in the Case, and No Sign of ItTravel hard drives PLY-2025-0928A Silent Cloud Drive, Then Odd BehaviourRAID and NAS volumes PLY-2025-0932Names in the Folder, Sizes All ZeroMissing or corrupt files PLY-2025-0334The Noisy Drive Was Not the ProblemDesktop disks on mains PLY-2025-0625Fine at Boot, Then Windows HungTravel hard drives PLY-2025-0935Every Folder Gone From the ListingDesktop disks on mains PLY-2025-1141The Laptop Was Gone, the Disk Was NotApple machines PLY-2025-0628A New PSU, and the Board Was GoneCircuitry faults PLY-2025-0632A Worn Barrel Plug, and a Dead BoardCircuitry faults PLY-2025-0337Everyone Blamed the Port, Not the DiskTravel hard drives PLY-2025-0635Told It Was a Bent HeadTravel hard drives PLY-2025-0639The SSD That Would Not BootSSD & flash media PLY-2025-0939Five Machines, and Not One Saw ItSSD & flash media PLY-2025-0341Two Failed Bays of FourRAID and NAS volumes PLY-2025-0642A RAID 5 With Two Drives DownRAID and NAS volumes

Forty-five entries, each anonymised and cleared with its customer first. They say what came in, what was depending on it, the way the job was worked, and how much of the data came home.

Your job could be number forty-six.

Every one opened where yours would: with a diagnosis costing nothing.

0800 6890668

Book a free look Sending it in to us