RDR / Casebook

At the bench · completed jobs

Each job we finish, set down in full.

Sign-off comes first: nothing goes up until the customer has read what came back and agreed to it, and the identifying detail — people, sites, serial numbers — is stripped at that point. Each entry then points at the technical guide behind the fault, for anyone who wants the method after the account of the job.

An engineer answers, and looking is free
0800 6890668

Latest at the top.

Look for it on the home page →

RG · RDG-2026-2007ON FILE ✓

Mismatched drives in a four-bay NAS, and a rebuild that made it worse

Four disks, no two of them the same size, which is why SHR had spread the volume over a pair of mdadm sets with LVM stacked on those and btrfs above that — put any one member on a bench by itself and it tells you nothing. The DiskStation had marked the volume failed before dawn, having spent the night rebuilding onto a member that was quietly losing sectors of its own. Imaging took all four, the stack went back together layer by layer, and the shares came up.

Every shareback online5 days from arrival to return

RG · RDG-2026-2001ON FILE ✓

SQL Server flagged Suspect, and an Earley practice on the phone at 8:55am

Twenty minutes late rather than a week out. Power had gone off in the night and the database came up Suspect; the phone rang as the practice opened, and a slot that morning was already free. The original was not touched at any point — every step ran on copies, and the transaction log played through on one of them. At the first attempt the database opened.

Re-mounted— and nothing dropped24bench hours

RG · RDG-2026-1996ON FILE ✓

A My Book whose bridge had failed, with the disk inside encrypted

On a My Book the encryption lives in the USB bridge rather than on the platters, which is why the sensible-looking move — take the 3.5-inch disk out, hook it to a SATA port — produces a screenful of nonsense. Without the key held on that little board, the bare disk means nothing. Imaging therefore went through a bridge of the same type, the key having been read off the failed original first. Both volumes it carried, work files on one and a photo library on the other, came back whole.

Each of thevolumes back in full3 days from arrival to return

RG · RDG-2026-1991ON FILE ✓

A 4TB Barracuda getting slower with every copy

Copying anything off took longer every week, though Windows still listed the drive and the manufacturer's own utility still passed it. Shingled recording is the reason: on that run of desktop Barracudas the tracks overlap, so writing one means rewriting its neighbours, and a weak patch of surface drags the whole disk down with it. The image came off head by head at a deliberately low speed, the sluggish zones left until last, with not a byte written back.

100%copied off3 days from arrival to return

RG · RDG-2026-1984ON FILE ✓

An MQ01 with almost nothing left, and a Satellite Pro stuck at its logo

One band on the MQ01ABD had stopped giving a clean read, and that was the entire fault — though the Satellite, hinge slack after years of being carried about, looked every inch like a laptop problem when it stopped one morning at the Toshiba logo. Doing nothing is what saved this job. Rather than let a shop grind test after test across a failing surface, the owner cut the power and left it alone. The 2.5-inch disk came out, was imaged head by head at a crawl, the weak band last of all, and nothing was ever written back to it.

98%was recoveredNot one thingput back on it

RG · RDG-2026-1977ON FILE ✓

The free tool gave back thumbnails; the wedding needed prints

Six hundred thumbnails was all the free utility had managed, and not one of them would print. No new frames had landed on the card after the wedding, so the copy came off cleanly. Each CR3 was then reassembled from its scattered fragments, and all 640 came back at full size.

640frames returned at full resolution72bench hours

RG · RDG-2026-1972ON FILE ✓

Two RAID 5 members gone, and the year-end still filed on time

It read as two disks failing at once. It was not. One member had quietly left the set months before, unnoticed, and a second stopped midway through the rebuild that followed. Imaging put only nineteen bad sectors on that second disk, so three sound members and one very nearly sound were enough between them to work the stripe out again. The year-end filing went in on time.

19 unreadable sectors, not a second failed disk6 days from arrival to return

RG · RDG-2026-1966ON FILE ✓

A flat cache battery, and a practice database that opened whole

A long outage left the cache battery with nothing in it. Power returned, and the controller asked the practice a question no one on the staff could safely answer, so it went unanswered. None of the member disks was touched: each was cloned first, and the array's own metadata was lifted from the clones. That gave the parity order, the set was rebuilt over the copies, and the practice database opened whole — including the final write the cache had been holding.

The live database opened whole5 days from arrival to return

RG · RDG-2026-1961ON FILE ✓

The repair shop swapped the disk. Every essay was on the one they took out.

A repair shop fitted a new disk and handed the laptop back empty. The old one, written off by then, sat ticking in a drawer in a student flat in Earley, near the Whiteknights campus. It came to the bench for a donor head stack, and two days after that the shop's replacement disk was carrying the essays and the photographs.

100%was recoveredEven after the shop's 'repair'

RG · RDG-2026-1953ON FILE ✓

A Thatcham haulier: no bookings on Monday, taking them again by Thursday

A rebuild was still running when the Monday call came through, so the job went straight past the queue. Nothing further was asked of the array — the power came out and it was left exactly as it was. Each member was imaged on its own, and the volume was reassembled from those images, never from the live disks. The database opened clean, and the firm was taking bookings again before Thursday was out.

Their business running again on day 4Pushed aheadof the queue

RG · RDG-2026-1938ON FILE ✓

A thesis nine days from hand-in, and a Passport that began to tick

Nine days from the deadline, the Passport started to tick. A head stack off a matched donor went in, then the image was pulled deliberately slowly. WD puts the encryption keys on the bridge board of these units, so the keys came off the board and never off the platters. Chapters, figures and references all came back with a week still in hand.

100% of the thesis back72bench hours

RG · RDG-2026-1935ON FILE ✓

Two red lights on a Shinfield NAS, then someone started a rebuild

Two red lights, and the box was still recoverable at that point. The rebuild someone started next is what did the damage, writing over the unit's own metadata. Both disks were then copied in full, weak sectors included, and the mirror was put back together block by block — each one taken from whichever disk still gave a clean read there. Every share opened as before.

100%was recovered5 days from arrival to return

RG · RDG-2026-1929ON FILE ✓

An evening wedding, and a card empty by morning

Every frame came back off a 512GB SanDisk that had shown empty at breakfast. Nothing was attempted on the card itself — a clone was taken and all the work ran on that. The file system went back together first, then a deep carve went after the images that no longer had an entry pointing at them. The photographer kept the client.

Every single frame back off the card48bench hours

RG · RDG-2026-1920ON FILE ✓

A Fusion Drive iMac, two weeks from slow to stopped

The iMac had already been written off at the Apple Store. What sat inside was a Fusion Drive — a flash module paired with a spinning disk, presented by macOS as one volume — and the mechanical half was going. Two separate images were taken, one from each device, the pairing was worked out from those, and a design studio has ten years of work back.

98%was recovered5 days from arrival to return

RG · RDG-2026-1916ON FILE ✓

A teacher's five years of work, and one dropped laptop

The laptop itself was finished; the disk inside was only clicking. Heads off a matching donor went in, the imaging pass was run slowly on purpose, and three days later the marks, the reports and five years of lesson plans were back in her hands.

100% of the drive's contents3 days from arrival to return

RG · RDG-2026-1911ON FILE ✓

Fifteen years of accounts, and two heads gone

Two heads had gone, and the drive had been standing still for weeks before it reached us. Donor heads matched to the model went on, and 96% came off the very first imaging pass. Ledgers, invoices and years of family photographs were checked on screen and posted home.

96%was recovered4 days from arrival to return

RG · RDG-2026-1904ON FILE ✓

Ten years of edits, and an NVMe that stopped mid-update

The laptop's system SSD stopped answering during a firmware update, and nothing would come off it afterwards. An engineer went in through technical mode and rebuilt the translator tables until the controller could map its own flash again. Ten years of a photographer's edits opened on the first attempt.

99%was recovered5 days from arrival to return

RG · RDG-2026-1898ON FILE ✓

A second member out mid-rebuild, and Monday's shift on time

A second member dropped out part-way through the rebuild on the Friday, and the live volume stopped mounting. The array was powered down and left alone. All four members were cloned to our own storage, and the stripe was reassembled from three good clones plus the fragments the fourth still returned. The Monday shift ran as normal.

100% of the live volume1weekend on the bench

RG · RDG-2026-1893ON FILE ✓

The plug came off the board, and seven years of invoices with it

That stick carried seven years of invoices, with the CIS records beside them and a return due in. Trodden across the floor of a site office, it had lost the connector off the board entirely. A monolith offers no socket to work with, so the controller pinout was mapped and the data lifted from the test pads themselves. The return went in before its deadline.

100%was recovered3 days from arrival to return

RG · RDG-2026-1802ON FILE ✓

Still wet, sealed in a bag, and posted that afternoon

Twenty years of family photographs came home because of two things nobody did: nobody switched it on to check, and nobody tried to dry it out. Sealed in a bag and still wet, it was posted that afternoon. On the bench the pads were cleaned and the ROM was read across to a donor board, and the full image came off on day four.

100%was recovered4 days from arrival to return

RG · RDG-2026-1797ON FILE ✓

Three years of weddings, and a fall onto concrete

It went over as the bags were being packed down, and it had begun clicking before the bench ever saw it. Three years of paid work sat on that drive, the morning's ceremony included. A matched donor stack went in, two days went on the copy, and every gallery came back.

99%was recovered4 days from arrival to return

RG · RDG-2026-1792ON FILE ✓

An overnight update, and a Shinfield practice locked out of its own workstation

The key was already there — the practice simply did not know it. An overnight update changed what the TPM measures, so the workstation booted asking for 48 digits nobody had thought to write down. The Recovery Key ID on screen matched an escrow entry the firm already held in Entra ID, and that was the whole job. repair-bde wrote fresh BitLocker metadata onto a new disk, and every project file opened as it always had.

100%was recovered3 days from arrival to return

RG · RDG-2026-1788ON FILE ✓

A Theale builders' merchant, and ransomware overnight

Nothing had been encrypted in place. The software opened each file, wrote a scrambled copy beside it and deleted the original — which left the real accounts sitting in free space, ready to be carved back out. What that missed was still in a NAS snapshot nobody had looked at. The merchant was invoicing again inside a week, with no ransom paid and no reply sent.

Taking orders again before the week was outNot one thing handed over to anyone

RG · RDG-2026-1783ON FILE ✓

The cable came out mid-write, and the volume showed as RAW

Someone caught the cable while the disk was mid-write. By morning Windows had exactly one suggestion: format it. The 4TB was imaged end to end before anything else was touched, and every repair after that went onto the copy — boot sector first, then the damaged mirror of the MFT. Not one byte was written back to the original. Fifteen years of client files came home with the folder tree intact.

100%was recovered3 days from arrival to return

RG · RDG-2026-1779ON FILE ✓

Two identical 2TB disks, and the format went to the family archive

Two 2TB disks of the same model sat in the one tower, and the format went to the one holding the family archive rather than the spare. A quick format only writes a new index; everything underneath it stays where it was, which is the whole reason there was anything left. Nothing had been written to the disk since, so the archive came back exactly as it went on.

The full folder tree returned3 days from arrival to return

RG · RDG-2026-1774ON FILE ✓

Shift-delete on the wrong folder, and a year of bookkeeping with it

A year of bookkeeping left the office PC in one keystroke — Shift held down over the wrong folder, so the recycle bin never saw any of it. The tower was imaged the same afternoon and nothing afterwards touched the original: working from the copy, the master file table was put back together and the folder returned with its names and dates intact.

The full folder tree returned24bench hours

RG · RDG-2026-1768ON FILE ✓

The TVS diode did its job, and the WD stopped turning

By morning there was no spin and the BIOS listed nothing, an overnight surge having done for the board. Its TVS diode was short, which is the diode doing precisely its job — it goes first, and leaves the motor and the heads intact. A donor board of the same revision took the original ROM, and the disk imaged right through before the day was out.

100%copied off2 days from arrival to return

RG · RDG-2026-1761ON FILE ✓

A steady tick from a Seagate, and five years of takings behind it

Five years of till records under a noise like a metronome, one tick per second and never varying. Two donor head stacks were needed before the disk would image at all, and the imaging itself was stretched deliberately over several days. The School Road shop in Tilehurst filed its VAT return on time, ledger complete.

97%was recovered4 days from arrival to return

RG · RDG-2026-1713ON FILE ✓

A Woodley distribution yard, and the clip its driver deleted

A copy came first; nothing touched the card itself, and every step after that ran on the image. The clip the insurer wanted had gone overnight — the picture data under it had not. It was rebuilt from the copy, hashed, exported, and with the insurer inside the week. Deleting is not overwriting, and the card settled which of the two had happened.

The clipscame off wholeHashedclip

RG · RDG-2026-1708ON FILE ✓

Two vans, one deleted clip, and an insurer wanting proof

Weeks went by, and the recorder came round to that date more than once, before anyone at the yard was asked for the footage. The only copy that had ever existed was a clip a manager exported and then deleted. Carving it back out of unallocated space, hashing it and writing it up briefly was enough: the claim settled without a hearing.

Their claim concludedCourt-gradeclip

RG · RDG-2026-1702ON FILE ✓

Cleared through the recorder menu, and four days of five came back

A member of staff had deleted footage that looked long past its use, and the record of the theft went with it. What saved the job was the recorder being unplugged inside a few hours: four of the five missing days still held their index entries and their times, so those clips returned with names and dates on them. The fifth had to be carved out of raw blocks — it plays, but nothing tells you when.

4 days of the five, timestamps intact72bench hours

RG · RDG-2026-1696ON FILE ✓

A shop in Reading, and nine days before anyone asked for the footage

It was nine days before the insurer asked for anything, and the recorder wrote over itself the whole time. Nothing was read from the original until an image of it existed. Decoding the index put the burglary on sectors the loop had not yet come round to a second time. What went out was one copy to watch and another for the claim file.

The whole break-in window was still on the disk3 days from arrival to return

RG · RDG-2026-1689ON FILE ✓

The uploads began twenty days before the resignation letter

Because the laptop was company property, authorising the examination raised no argument at all. What it held ran in a plain order: a folder assembled, a personal cloud account signed into, an upload — and a resignation letter twenty days after the last of it. All the Didcot employer had to begin with was a competitor's pitch deck. The matter ended in undertakings.

Wound up once undertakings were givenOrder of events in writing inside 7 days

RG · RDG-2026-1684ON FILE ✓

A Part 35 report on a folder two firms shared

Two firms shared one folder, and the accounts inside it existed in two versions that would not reconcile. Forensic images of both machines showed where each edit had been made, and the sequence of those edits answered the question. The dispute closed inside the month.

Wound upafter the exchangeCPR Part 35 followed

RG · RDG-2026-1677ON FILE ✓

A wiping tool that recorded its own quarter of an hour

Fifteen minutes or so of wiping, started one evening by somebody on the way out, on a laptop due back the following day. The tool kept a log of its own work; that log came through into the image, giving the time it began and the folders it never reached, and the sequence stopped being arguable.

Order of eventsnailed downOur findings in hand on day 8

RG · RDG-2026-1671ON FILE ✓

Missing project files, and a Woodley firm certain they were taken

Nobody had taken anything. A badly configured sync client had emptied the shared folder by itself — duller than the theft the client arrived expecting — and most of what went was still recoverable. The finding ended the dispute with no one accused.

The matter closed, nobody accusedOur findingswithin six days

Every one, in order.

Forty-five jobs, each written up only after the customer had cleared the entry and the identifying detail had come out. Every one records what arrived, what depended on it, what was done at the bench, and how much came back.

Yours might be job forty-six.

Every one of them opened where yours would: with a diagnosis that costs nothing.

0800 6890668

Get it looked at Posting it to Oxford