RDR / Casebook

At the bench · completed jobs

Each job we finish, set down in full.

Sign-off comes first. Nothing can go up until the customer has reviewed what came back and agreed to it, and the details about the person(s), site(s) and serial numbers are removed at that point. Once this has been done, each entry will reference the technical guide behind the failure, for anyone who wants the method as well as the account of the job.

An engineer answers, and looking is free
0800 6890668

Latest at the top.

Look for it on the home page →

RG · RDG-2026-2007ON FILE ✓

Mismatched drives in a four-bay NAS, and a rebuild that made it worse

Four different sized disks were in this case (no two were the same), which is why SHR had split the volume across two mdadm sets; then LVM sat atop both of these and finally btrfs lay at the top, so placing any one disk on a bench by itself would tell you nothing. The DiskStation had marked the volume failed before dawn, having spent the night rebuilding onto another disk that was quietly losing sectors of its own. Each of the four disks was imaged; each layer of the stack was put back into place; and the shares came up again.

Every shareback online5 days from arrival to return

RG · RDG-2026-2001ON FILE ✓

SQL Server flagged Suspect, and an Earley practice on the phone at 8:55am

Twenty minutes late instead of a week out. A power outage occurred during the night. When the database came back, it showed as Suspect. Then the phone rang as the practice opened, and there was already an available slot that morning. No changes were made to the original. All steps ran from copies. One copy was used to play the transaction log through. On the first try the database opened.

Re-mounted— and nothing dropped24bench hours

RG · RDG-2026-1996ON FILE ✓

A My Book whose bridge had failed, with the disk inside encrypted

On a My Book the encryption is stored on the USB bridge (the little board between your computer and the disk), as opposed to being written to the disk platters. So when you pull the 3.5-inch disk from your My Book and attach it directly to a SATA port on your PC… well, you get a screenful of nonsense. The bridge holds the key. And without that key, the bare disk is useless. The imaging process went through a second bridge of the same type, with the key from the failed original having been read off first. Both of its volumes came back whole: work files on one, a photo library on the other.

Each of thevolumes back in full3 days from arrival to return

RG · RDG-2026-1991ON FILE ✓

A 4TB Barracuda getting slower with every copy

Copying from this was slower each week, even though Windows could see the drive and the manufacturer's own tool still passed it. That was because of shingled recording; on that series of desktop Barracudas the tracks overlap, so to write one you are essentially rewriting its neighbours; and if you have a weak spot on the surface then it will drag the whole of the disk down. The image came off head by head at an intentionally slow rate, with the sluggish areas left for last, and nothing was written back.

100%copied off3 days from arrival to return

RG · RDG-2026-1984ON FILE ✓

An MQ01 with almost nothing left, and a Satellite Pro stuck at its logo

Only one band on the MQ01ABD had stopped giving a good read, and that completely explained the fault, but when the Satellite, hinge slack from years of having been lugged around, stopped one morning at the Toshiba logo, it sure did look like a laptop problem. Not doing anything is what saved this job. Instead of letting a shop run a series of grinding tests on a failing surface, the owner just turned off the power and left it alone. The 2.5-inch disk came out, was imaged head by head using a very slow process, the weak band last of all, and nothing was written back onto the drive.

98%was recoveredNot one thingput back on it

RG · RDG-2026-1977ON FILE ✓

The free tool gave back thumbnails; the wedding needed prints

The free utility had only managed six hundred thumbnail images, and none would print. As no new photos were added to the card after the wedding, the copy came off cleanly. After this each of the CR3 files was rebuilt from its scattered parts, and all 640 images came back at full size.

640frames returned at full resolution72bench hours

RG · RDG-2026-1972ON FILE ✓

Two RAID 5 members gone, and the year-end still filed on time

This appeared as though two disks had failed at once. However, it was not. One member had quietly gone missing from the set months before without anyone noticing, and another member quit working during the rebuild that followed. Imaging found only nineteen bad sectors on that second disk, so three good members and one almost completely good member together were enough to work the stripe out again. The year-end filing went in on time.

19 unreadable sectors, not a second failed disk6 days from arrival to return

RG · RDG-2026-1966ON FILE ✓

A flat cache battery, and a practice database that opened whole

A long outage left the cache battery flat; when power was restored, the controller asked the practice a question that none of its staff were able to safely answer, so there was no response. None of the member disks were touched; a copy of each was made first, the array's own metadata was read from the copies to establish the parity order, the set was rebuilt across the copies, and access to the practice's database was restored in full, including the last write held in the cache.

The live database opened whole5 days from arrival to return

RG · RDG-2026-1961ON FILE ✓

The repair shop swapped the disk. Every essay was on the one they took out.

The shop installed a new disk and handed the laptop back with nothing on it. The old one, which had been written off at that point, still sat ticking in a drawer in a student flat in Earley, close to the Whiteknights campus. It came to the bench for a donor head stack; just two days later the shop's replacement disk was carrying all of the essays and photos.

100%was recoveredEven after the shop's 'repair'

RG · RDG-2026-1953ON FILE ✓

A Thatcham haulier: no bookings on Monday, taking them again by Thursday

The array had a rebuild still running at the time of the call on Monday; therefore, the job passed right over the queue. Nothing else was asked of the array except to shut off the power and leave it in the same condition. Each disk was then imaged individually and the volume was rebuilt using those images (never the live disks). The database opened clean, and the firm was taking bookings again by the end of Thursday.

Their business running again on day 4Pushed aheadof the queue

RG · RDG-2026-1938ON FILE ✓

A thesis nine days from hand-in, and a Passport that began to tick

Nine days from the deadline, the Passport started to tick. A head stack off a matched donor went in, then the image was pulled deliberately slowly. WD puts the encryption keys on the bridge board of these units, so the keys came off the board and never off the platters. Chapters, figures and references all came back with a week still in hand.

100% of the thesis back72bench hours

RG · RDG-2026-1935ON FILE ✓

Two red lights on a Shinfield NAS, then someone started a rebuild

Two red lights, and the box was still recoverable at that point. The rebuild someone started next is what did the damage, writing over the unit's own metadata. Both disks were then copied in full, weak sectors included, and the mirror was put back together block by block — each one taken from whichever disk still gave a clean read there. Every share opened as before.

100%was recovered5 days from arrival to return

RG · RDG-2026-1929ON FILE ✓

An evening wedding, and a card empty by morning

Every frame came back off a 512GB SanDisk that had shown empty at breakfast. Nothing was attempted on the card itself — a clone was taken and all the work ran on that. The file system went back together first, then a deep carve went after the images that no longer had an entry pointing at them. The photographer kept the client.

Every single frame back off the card48bench hours

RG · RDG-2026-1920ON FILE ✓

A Fusion Drive iMac, two weeks from slow to stopped

The iMac had already been written off at the Apple Store. What sat inside was a Fusion Drive — a flash module paired with a spinning disk, presented by macOS as one volume — and the mechanical half was going. Two separate images were taken, one from each device, the pairing was worked out from those, and a design studio has ten years of work back.

98%was recovered5 days from arrival to return

RG · RDG-2026-1916ON FILE ✓

A teacher's five years of work, and one dropped laptop

The laptop itself was finished; the disk inside was only clicking. Heads off a matching donor went in, the imaging pass was run slowly on purpose, and three days later the marks, the reports and five years of lesson plans were back in her hands.

100% of the drive's contents3 days from arrival to return

RG · RDG-2026-1911ON FILE ✓

Fifteen years of accounts, and two heads gone

Two heads had gone, and the drive had been standing still for weeks before it reached us. Donor heads matched to the model went on, and 96% came off the very first imaging pass. Ledgers, invoices and years of family photographs were checked on screen and posted home.

96%was recovered4 days from arrival to return

RG · RDG-2026-1904ON FILE ✓

Ten years of edits, and an NVMe that stopped mid-update

The laptop's system SSD stopped answering during a firmware update, and nothing would come off it afterwards. An engineer went in through technical mode and rebuilt the translator tables until the controller could map its own flash again. Ten years of a photographer's edits opened on the first attempt.

99%was recovered5 days from arrival to return

RG · RDG-2026-1898ON FILE ✓

A second member out mid-rebuild, and Monday's shift on time

A second member dropped out part-way through the rebuild on the Friday, and the live volume stopped mounting. The array was powered down and left alone. All four members were cloned to our own storage, and the stripe was reassembled from three good clones plus the fragments the fourth still returned. The Monday shift ran as normal.

100% of the live volume1weekend on the bench

RG · RDG-2026-1893ON FILE ✓

The plug came off the board, and seven years of invoices with it

That stick carried seven years of invoices, with the CIS records beside them and a return due in. Trodden across the floor of a site office, it had lost the connector off the board entirely. A monolith offers no socket to work with, so the controller pinout was mapped and the data lifted from the test pads themselves. The return went in before its deadline.

100%was recovered3 days from arrival to return

RG · RDG-2026-1802ON FILE ✓

Still wet, sealed in a bag, and posted that afternoon

Twenty years of family photographs came home because of two things nobody did: nobody switched it on to check, and nobody tried to dry it out. Sealed in a bag and still wet, it was posted that afternoon. On the bench the pads were cleaned and the ROM was read across to a donor board, and the full image came off on day four.

100%was recovered4 days from arrival to return

RG · RDG-2026-1797ON FILE ✓

Three years of weddings, and a fall onto concrete

It went over as the bags were being packed down, and it had begun clicking before the bench ever saw it. Three years of paid work sat on that drive, the morning's ceremony included. A matched donor stack went in, two days went on the copy, and every gallery came back.

99%was recovered4 days from arrival to return

RG · RDG-2026-1792ON FILE ✓

An overnight update, and a Shinfield practice locked out of its own workstation

The key was already there — the practice simply did not know it. An overnight update changed what the TPM measures, so the workstation booted asking for 48 digits nobody had thought to write down. The Recovery Key ID on screen matched an escrow entry the firm already held in Entra ID, and that was the whole job. repair-bde wrote fresh BitLocker metadata onto a new disk, and every project file opened as it always had.

100%was recovered3 days from arrival to return

RG · RDG-2026-1788ON FILE ✓

A Theale builders' merchant, and ransomware overnight

Nothing had been encrypted in place. The software opened each file, wrote a scrambled copy beside it and deleted the original — which left the real accounts sitting in free space, ready to be carved back out. What that missed was still in a NAS snapshot nobody had looked at. The merchant was invoicing again inside a week, with no ransom paid and no reply sent.

Taking orders again before the week was outNot one thing handed over to anyone

RG · RDG-2026-1783ON FILE ✓

The cable came out mid-write, and the volume showed as RAW

Someone caught the cable while the disk was mid-write. By morning Windows had exactly one suggestion: format it. The 4TB was imaged end to end before anything else was touched, and every repair after that went onto the copy — boot sector first, then the damaged mirror of the MFT. Not one byte was written back to the original. Fifteen years of client files came home with the folder tree intact.

100%was recovered3 days from arrival to return

RG · RDG-2026-1779ON FILE ✓

Two identical 2TB disks, and the format went to the family archive

Two 2TB disks of the same model sat in the one tower, and the format went to the one holding the family archive rather than the spare. A quick format only writes a new index; everything underneath it stays where it was, which is the whole reason there was anything left. Nothing had been written to the disk since, so the archive came back exactly as it went on.

The full folder tree returned3 days from arrival to return

RG · RDG-2026-1774ON FILE ✓

Shift-delete on the wrong folder, and a year of bookkeeping with it

A year of bookkeeping left the office PC in one keystroke — Shift held down over the wrong folder, so the recycle bin never saw any of it. The tower was imaged the same afternoon and nothing afterwards touched the original: working from the copy, the master file table was put back together and the folder returned with its names and dates intact.

The full folder tree returned24bench hours

RG · RDG-2026-1768ON FILE ✓

The TVS diode did its job, and the WD stopped turning

By morning there was no spin and the BIOS listed nothing, an overnight surge having done for the board. Its TVS diode was short, which is the diode doing precisely its job — it goes first, and leaves the motor and the heads intact. A donor board of the same revision took the original ROM, and the disk imaged right through before the day was out.

100%copied off2 days from arrival to return

RG · RDG-2026-1761ON FILE ✓

A steady tick from a Seagate, and five years of takings behind it

Five years of till records under a noise like a metronome, one tick per second and never varying. Two donor head stacks were needed before the disk would image at all, and the imaging itself was stretched deliberately over several days. The School Road shop in Tilehurst filed its VAT return on time, ledger complete.

97%was recovered4 days from arrival to return

RG · RDG-2026-1713ON FILE ✓

A Woodley distribution yard, and the clip its driver deleted

A copy came first; nothing touched the card itself, and every step after that ran on the image. The clip the insurer wanted had gone overnight — the picture data under it had not. It was rebuilt from the copy, hashed, exported, and with the insurer inside the week. Deleting is not overwriting, and the card settled which of the two had happened.

The clipscame off wholeHashedclip

RG · RDG-2026-1708ON FILE ✓

Two vans, one deleted clip, and an insurer wanting proof

Weeks went by, and the recorder came round to that date more than once, before anyone at the yard was asked for the footage. The only copy that had ever existed was a clip a manager exported and then deleted. Carving it back out of unallocated space, hashing it and writing it up briefly was enough: the claim settled without a hearing.

Their claim concludedCourt-gradeclip

RG · RDG-2026-1702ON FILE ✓

Cleared through the recorder menu, and four days of five came back

A member of staff had deleted footage that looked long past its use, and the record of the theft went with it. What saved the job was the recorder being unplugged inside a few hours: four of the five missing days still held their index entries and their times, so those clips returned with names and dates on them. The fifth had to be carved out of raw blocks — it plays, but nothing tells you when.

4 days of the five, timestamps intact72bench hours

RG · RDG-2026-1696ON FILE ✓

A shop in Reading, and nine days before anyone asked for the footage

It was nine days before the insurer asked for anything, and the recorder wrote over itself the whole time. Nothing was read from the original until an image of it existed. Decoding the index put the burglary on sectors the loop had not yet come round to a second time. What went out was one copy to watch and another for the claim file.

The whole break-in window was still on the disk3 days from arrival to return

RG · RDG-2026-1689ON FILE ✓

The uploads began twenty days before the resignation letter

Because the laptop was company property, authorising the examination raised no argument at all. What it held ran in a plain order: a folder assembled, a personal cloud account signed into, an upload — and a resignation letter twenty days after the last of it. All the Didcot employer had to begin with was a competitor's pitch deck. The matter ended in undertakings.

Wound up once undertakings were givenOrder of events in writing inside 7 days

RG · RDG-2026-1684ON FILE ✓

A Part 35 report on a folder two firms shared

Two firms shared one folder, and the accounts inside it existed in two versions that would not reconcile. Forensic images of both machines showed where each edit had been made, and the sequence of those edits answered the question. The dispute closed inside the month.

Wound upafter the exchangeCPR Part 35 followed

RG · RDG-2026-1677ON FILE ✓

A wiping tool that recorded its own quarter of an hour

Fifteen minutes or so of wiping, started one evening by somebody on the way out, on a laptop due back the following day. The tool kept a log of its own work; that log came through into the image, giving the time it began and the folders it never reached, and the sequence stopped being arguable.

Order of eventsnailed downOur findings in hand on day 8

RG · RDG-2026-1671ON FILE ✓

Missing project files, and a Woodley firm certain they were taken

Nobody had taken anything. A badly configured sync client had emptied the shared folder by itself — duller than the theft the client arrived expecting — and most of what went was still recoverable. The finding ended the dispute with no one accused.

The matter closed, nobody accusedOur findingswithin six days

Every one, in order.

Forty-five jobs, each written up only after the customer had cleared the entry and the identifying detail had come out. Every one records what arrived, what depended on it, what was done at the bench, and how much came back.

Yours might be job forty-six.

Every one of them opened where yours would: with a diagnosis that costs nothing.

0800 6890668

Get it looked at Posting it to Oxford