The bench · finished work
Nothing goes up until the customer has confirmed what came off the device, and every name, address and serial number is taken out first. Each entry sits next to the guide for that kind of fault, so you can read the outcome, then read the method behind it.
Describe the symptoms to an engineer
0800 6890668
Volume Crashed on the screen, and the DiskStation had run a rebuild all night onto a disk that was already losing sectors. Four mismatched disks meant SHR had spread the array over more than one mdadm set; LVM and btrfs sat on top of that, so no single disk carried anything that made sense alone. We imaged all four, restored the layers to their proper order, and every share opened.
An overnight power cut left the practice's database marked Suspect, and the call came in first thing with an emergency slot already open. Nothing was tried on the original: forensic copies were taken, and on one of those the transaction log still replayed. It attached at the first attempt, so the morning's appointments started twenty minutes late instead of a week later.
A clean copy of Windows had gone on the machine, and nobody remembered that Bitcoin Core and Electrum had both lived on the old partition. A reinstall does not scrub a disk; it writes a fresh index over what is already there. Nothing more was done to it after the call. The disk was imaged, the old volume's records rebuilt from that copy, and a carve through free space returned a wallet.dat and an Electrum .json. Ownership was proved before either went back.
It came out of a washing-machine pocket and never woke up. A hardware wallet keeps its keys in a secure element, so there is nothing on the device for us to read — the recovery sheet is the way back, and that sheet was long gone. The owner did still have an old laptop with a photograph of it. The disk was imaged in full and the picture carved out of deleted space.
Years of being carried about had loosened a hinge, and then one morning the Satellite stopped at the Toshiba screen and stayed there. That is usually the machine rather than the disk, but here it was the disk. The MQ01ABD inside had a band of sectors it could no longer read cleanly, and the owner switched the laptop off and left it alone instead of letting a shop run a check over it. The 2.5-inch drive came out, went onto the imager, and was read head by head at a crawl, weak zone last, with nothing at all put back onto the original.
The free software handed back six hundred thumbnails: previews, and not one printable. No one had written to it since the shoot, so the imaging pass ran clean, and each CR3 was pieced back together from its scattered fragments. Six hundred and forty frames went back at full size.
Back in June, disk two left the set without anyone noticing. Then, in August, disk four gave out during a rebuild, and from the outside it looked as though a pair had failed together. They had not. On the imager the fourth showed nineteen bad sectors and no other damage, so three sound members plus that near-sound fourth were enough to put the stripe back. Year-end filings went in on time.
With the power off long enough to flatten the cache battery, the controller came up asking the practice to choose between options none of them could safely answer. Nothing was answered. Each member went to a copy first, the RIS metadata was lifted off those copies, the parity delay was worked into the sums, and the set went back together on images alone. The database behind the practice software opened complete, as far as the last write the cache got down.
The laptop came home from the shop working perfectly, on a new disk with nothing on it. The original, declared beyond help, sat clicking in a drawer at a student flat in Cardiff. Donor heads went in. Two days later the essays and the photographs were all on the shop's new disk.
The awkward part was a rebuild already running on the RAID that sat under the booking system. Nothing on the array was touched until every disk had been imaged on its own. The set was then put back together in software from those copies, the database checked, and bookings were going through again by Thursday lunchtime. It sat at the front of the queue from the first call.
Nine days out from the hand-in, the ticking started. We fitted a head stack from a donor, imaged at a deliberately slow pace, and lifted the encryption keys from the bridge board. Every chapter and every reference came back, and the thesis was home a week before the deadline.
Two red lights, and the box could still have been saved. The rebuild someone started afterwards was what it could not survive: that wrote straight over the unit's own metadata. Both disks were imaged past the bad sectors, then the mirror was rebuilt piece by piece, each block taken from whichever copy read cleanest. The shared volume came back whole.
A wedding shot the previous evening, and by morning the 512GB SanDisk read as empty. Cloning the card came before anything else was tried. From that clone the file system was rebuilt, and a deep carve afterwards gathered up whatever had lost its place. Not one frame was missing, and the photographer did not lose the client.
The verdict from the Apple Store was that the iMac was beyond help. What sat inside was a Fusion Drive: an SSD and a spinning disk that the Mac shows you as a single volume. The spinning half was failing. Both were imaged separately, the mapping that ties them together was rebuilt, and a design studio got a decade of its files back.
The laptop was scrap by the time it got to us, and the disk inside was clicking. Donor heads went in, the imaging crawled, and three days later she had back five years of lesson plans, reports and marks.
Nothing had spun inside it for weeks, and two heads were dead. With a donor stack fitted, the first pass off the imager lifted 96%, and the ledgers, invoices and family pictures went home checked.
The laptop's system SSD stopped part-way through a firmware update and would not read afterwards. Working in technical mode, an engineer rebuilt the translator tables, and ten years of one photographer's edited catalogues came back intact.
The rebuild pulled a second member down on the Friday, and the live data was suddenly out of reach. The array was left switched off from that point. We imaged all four disks onto our own hardware, read the stripe back out of three clean copies and what little the fourth still gave, and the plant ran to time on the Monday.
A boot in a site office parted the connector from the board. Seven years of invoices went with it, and the CIS records too, with a tax return waiting. Nothing on a monolith gives you a port to attach to, so the controller's pinout was mapped and the work done at the test pads. It was all filed on time.
Nobody reached for a hairdryer, and nobody plugged it in to see. That is what saved the job. The drive went into a sealed bag wet, and into the post the same afternoon. At the bench the contacts were cleaned, the ROM was moved onto a donor board, and a full image was done within days. Two decades of family pictures came home.
The drive went down onto concrete as a wedding shoot was packing up, and the first bench test had it clicking. Three years of paid commissions were on there. A donor head stack, two days of imaging, and every gallery came home — that morning's included.
The recovery key had never been kept by anyone at the practice, and the workstation booted asking for it: a firmware update overnight had changed what the TPM was measuring beneath. Its Recovery Key ID was already sitting in the firm's Entra ID escrow. With that, repair-bde laid sound BitLocker metadata onto a fresh disk, and not one project file was lost.
The ransomware never encrypted anything in place. It read each file, wrote a locked copy and deleted the original — so what mattered was still sitting in free space, and could be carved back out. A NAS snapshot nobody had thought of covered the rest. They were trading again inside the week, without paying a penny or answering the note.
A write was still going when the cable came out of the socket. Next morning Windows offered one thing: a prompt to format the disk. So the whole 4TB was imaged first, and only then were the boot sector and the broken MFT mirror mended — on the copy, never on the original. Fifteen years of client jobs went home with the folder tree intact.
Two matching 2TB disks sat side by side in one tower, and it was the family archive that got wiped, not the blank one. A quick format only rewrites the index; the files themselves stay where they lie, which is why this one came back. Nothing had been written since, so the archive listed out as before.
The wrong folder was picked with Shift held, and twelve months of accounts left an office PC without ever landing in the bin. The tower was imaged that afternoon. On the copy, the file table was rebuilt, and the folder reappeared, filenames and timestamps unchanged.
An overnight surge took the electronics with it. The TVS diode had gone short, which is precisely what it is there for: it fails so the motor and heads do not. Come morning there was no spin and no drive in the BIOS list. The ROM moved onto a matching donor board, and the disk was read right through before the day was out.
A tick every second or so, steady as a clock, with five years of till records on the other side of it. Two donor head stacks were fitted in turn, the imaging was kept deliberately slow across several days, and a shop in Whitchurch got its VAT return in on time with the ledger complete.
Deleted and overwritten are not the same thing, and the image taken off this cab camera showed which of the two it was. The clip the insurer wanted had vanished overnight, so nothing was attempted until the card had been copied. Once it was rebuilt and hash-checked, the footage went back within days, closing the claim and the HR file at once.
Nobody asked about the yard until the recorder had looped well past the day in question. A manager had pulled the clip off weeks before, then deleted the file, and there was no copy of it anywhere else. It was carved out of unallocated space, hashed, and covered in a short report. No hearing was needed to settle the claim.
Someone on the counter had cleared out what looked like stale footage. A theft was in among it. The recorder was switched off within hours, and that is the reason there was anything left: four of the five missing days still had index entries and their timestamps, and the fifth was carved out as video that plays, with no label on it.
The insurer took nine days to ask, and all that time the recorder had been overwriting itself. A copy of the disk was taken before anything else, its index decoded, and the break-in came off sectors the loop had not yet reached. It went back twice over: a viewing copy, and one for the claim file.
The employer in Bridgend arrived with a competitor's pitch deck and nothing else. What settled it was the timing: the last upload sat twenty days ahead of the resignation letter. Files pulled into a single folder, a personal cloud account signed into, then the transfer, in that order. Undertakings closed the matter.
Two firms, one shared folder, and two sets of accounts that would not match. The image showed neither copy had been left untouched, and the timeline made that impossible to dispute. It was over inside a month.
On the last evening before the laptop went back, someone on their way out set a wiping tool running and walked off. It managed roughly a quarter of an hour. The tool's own log came through in the image, with the time it began and a list of what it never reached, and that was enough to fix the order of events.
The client came in sure the files had been lifted deliberately. The evidence told a flatter story: a sync client set up wrong had cleared them out of the shared folder, and most of it came back. That finding closed the argument quicker than any accusation would have.
Forty-five write-ups, anonymised and agreed with the customer. Each says what turned up on the bench, what was at stake, how it was worked, and how much of it went home.
Each began with the step yours would: a diagnosis costing nothing.