NDR / Casebook

Off the bench · jobs now closed

Every closed job, set down here in full.

Sign-off comes first: an entry appears only once its customer has read the recovered material and approved it, and at that moment the identifying detail goes — names, sites, serial numbers. From each entry a link runs to the technical guide behind that fault, for readers who want the method as well as the story.

Ask an engineer, and the first look is free
0115 8220606

The latest ones first.

It is on the home page →

NG · NTG-2026-2007ON THE LOG ✓

A rebuild that halted, and a SQL database that would not attach

A food manufacturer in Leicester kept its batch and QA records on a six-bay server that had quietly been running a member short since the summer without anyone noticing. When a second carrier turned amber a spare went in and the rebuild was allowed to run; it halted part-way, the virtual disk dropped offline, and on the next restart the job database came up SUSPECT. Power came off the chassis that same afternoon, and every drive reached us with a bay number on its carrier. Copies were taken of the two weak members first, one of them across four passes, while the rest read from end to end. The controller's own account of the set came off the images, the volume was assembled above them, and the .mdf and .ldf were taken away as copies. Both databases attached, and both were checked here before a thing went home.

The two weak members copied before the rest2 databases attached on the copies

NG · NTG-2026-2001ON THE LOG ✓

An EliteBook that got slower for a year and then stopped at the logo

Nine years of tenancy files, valuations and site photography sat on an HP EliteBook belonging to a land agent in Grantham — a machine the practice's IT had never once looked at. Opening anything had been getting slower since the spring. Then one morning it reached the logo and went no further. Out came the spinning disk. On a write-blocked port it read, though slowly, and a band around the middle would not answer at any speed at all. That band was left alone until the rest of the surface was down safely, and then taken across two nights in short passes. Before a single file travelled, each folder was opened on the bench, beginning with the tenancy agreements and the valuations, since those were the ones named over the telephone.

Each folder opened before it went backThe whole disk copied before a repair

NG · NTG-2026-1996ON THE LOG ✓

A two-bay box that had run on one disk since the spring

An engineering firm in Ilkeston rang when the office box stopped presenting its data volume. Months earlier a member had dropped out behind a door nobody opens, with an amber light the only sign of it, and the survivor had been running the volume single-handed since — and was starting to fail itself. Each disk was imaged alone, the worn one over two nights in short passes. Blocks that disk refused were pulled off its older partner; blocks the older partner had missed came from the newer side. Twenty years of drawings, plus the job ledger, were opened on the bench before the parcel went back. Three days, door to door.

The two members cloned one at a time3 days between arrival and return

NG · NTG-2026-1991ON THE LOG ✓

A four-bay QNAP that came back from a firmware update with no volumes

A pattern-cutter in Ilkeston kept twenty years of nesting files, grading sets and product photography on a four-bay QNAP under the cutting table. An update finished, the unit restarted, and the storage pool was simply not there — no shares, no volumes, four green bays and an empty screen. It was switched off that afternoon and the four disks arrived numbered one to four. All four cloned straight through with nothing awkward on any of them, which told us what the trouble was: the box, not the set. The array description was read off the images, the volume assembled above them and brought up read-only. Every share opened. Three days, parcel to parcel, and the patterns travelled back on a new drive, arranged the way the cutting room had always arranged them.

100% copied sector by sector3 days between arrival and return

NG · NTG-2026-1984ON THE LOG ✓

A DriveStation Duo that stopped presenting its volume

A ground-stability consultant in Mansfield ran borehole logs, scanned abandonment plans and site photography off a two-bay DriveStation Duo, configured as a single striped volume across both disks. The unit powered up, ran its fan and showed a code; nothing appeared over the network and nothing over USB. Both disks were taken out and copied before either was asked to do anything else. The first read from end to end. The second had a worn band about a third of the way in, taken in short passes over two nights once the easy ground was safely down. The striped volume was reassembled above the images and brought up read-only. Ninety-eight per cent of it came back, and the report names the files that did not.

98% of the files backThe two disks copied before anything else

NG · NTG-2026-1977ON THE LOG ✓

A free tool returned thumbnails; the wedding album needed full frames

The card had been left alone since the wedding — nothing written to it, no new frames — which is why the copy lifted off it cleanly. A free utility had already been at it and produced six hundred thumbnails, none of them printable. Rebuilding each CR3 from its scattered fragments put all 640 back at full size.

640 frames returned at full size72 hours of work on it

NG · NTG-2026-1972ON THE LOG ✓

The year-end still went in on time, with two RAID 5 members gone

Nineteen bad sectors, and that was the whole of it. The set looked like it had gone two disks down together; in fact one member had dropped out quietly months earlier with nobody the wiser, so when a second stopped partway through the rebuild there was nothing left holding it up. Imaging the pair showed how little on that second disk was actually unreadable, and three sound members plus one very nearly sound worked the stripe out between them. Year-end filing still went in on the day.

19 unreadable sectors, and not a second dead disk6 days between arrival and return

NG · NTG-2026-1966ON THE LOG ✓

The cache battery was flat; the practice database still opened whole

A long power cut had emptied the cache battery. When the power came back the controller put a question to the office that nobody there could safely answer, so it sat unanswered. Not one member disk was worked on directly: all of them were cloned, and the array's own metadata came off those clones, which settled the parity order. The rebuild then ran over the copies, and what opened at the end was the whole practice database, the write the cache had still been holding included.

The database opened in full5 days between arrival and return

NG · NTG-2026-1961ON THE LOG ✓

A repair shop fitted a new disk. Every essay sat on the old one.

Handed back empty by a repair shop that had fitted a new disk, the laptop was one thing; the old drive was another, written off and left ticking in a drawer of a student flat at Lenton, a few streets from University Park. A donor head stack brought it onto the bench, and the essays and photographs were on the shop's replacement disk two days after that.

100% of the files backFollowing the shop's 'fix'

NG · NTG-2026-1953ON THE LOG ✓

A Newark-on-Trent haulier: bookings stopped Monday, running again by Thursday

The call came in on the Monday with a rebuild still running, so we brought the job forward. First instruction: cut the power, and ask nothing more of the array. Each member then went onto an image of its own, and the reassembly was done from that set, never from the disks themselves. The database opened without error, and the firm was taking bookings again by the Thursday.

The firm back working on day 4Moved up the queue

NG · NTG-2026-1938ON THE LOG ✓

A ticking Passport, with nine days left before a thesis was due

The Passport began ticking with nine days left on the deadline. A head stack came off a matched donor, after which the imaging pass was run at a deliberately low speed. On these units the encryption keys live on the bridge board rather than on the platters, so that is where they were read from. References, figures and chapters were all back with a week still spare.

100% of the thesis came back72 hours of work on it

NG · NTG-2026-1935ON THE LOG ✓

A Mansfield NAS on two red lights, and a rebuild started anyway

At two red lights the unit was still perfectly recoverable. The damage came from the rebuild started afterwards, which wrote over the metadata the box keeps for itself. Recovery meant a full copy of each disk, weak sectors and all, then reassembling the mirror block by block, taking every block from whichever disk still read it cleanly. All the shares opened exactly as before.

100% of the files back5 days between arrival and return

NG · NTG-2026-1929ON THE LOG ✓

The card filled at an evening wedding and was empty by breakfast

A 512GB SanDisk read as empty first thing in the morning; by the end of the job every frame was back. The card itself was never written to — a clone came off it and every attempt after that ran against the copy. Rebuilding the file system accounted for most of it, and a deep carve picked up the images whose directory entries had gone. The client stayed with the photographer.

Each frame lifted off the card48 hours of work on it

NG · NTG-2026-1920ON THE LOG ✓

Two weeks of a slowing iMac, then the Fusion Drive stopped

Written off already at the Apple Store, the iMac turned out to hold a Fusion Drive: a flash module married to a spinning disk and shown by macOS as one volume, with the mechanical half on its way out. Each device was imaged separately, and the pairing was reconstructed from those two images. Ten years of a design studio's work is back.

98% of the files back5 days between arrival and return

NG · NTG-2026-1916ON THE LOG ✓

Five years of a teacher's files, and a laptop that hit the floor

The laptop had gone; inside it, a disk that was only clicking. A matching donor gave up its heads, the imaging pass was deliberately run slow, and by day three she had her marks, her reports and five years of lesson plans.

100% of what was on the disk3 days between arrival and return

NG · NTG-2026-1911ON THE LOG ✓

Two heads gone, and fifteen years of accounts on the platters

Weeks had gone by with the drive sitting idle before it arrived, two of its heads already gone. Matched donor heads went in, and the first imaging pass alone returned 96%. Ledgers, invoices and a couple of decades of family pictures went home on new media once the owner had seen them listed.

96% of the files back4 days between arrival and return

NG · NTG-2026-1904ON THE LOG ✓

An NVMe that quit mid-update, with ten years of edits on it

Halfway through a firmware update the laptop's system SSD stopped answering, and nothing would come off it afterwards. Technical mode gave an engineer a way in, and the translator tables were rebuilt until the controller could once again map the flash beneath it. A photographer's ten years of edits opened at the first try.

99% of the files back5 days between arrival and return

NG · NTG-2026-1898ON THE LOG ✓

Monday's shift ran on time, after a second member dropped out mid-rebuild

Friday's rebuild was half done when a second member dropped out, and the live volume would no longer mount. Power off, hands off. All four disks were then cloned onto our own storage, three of the clones came back sound, and the stripe was reassembled from those plus whatever the fourth would still give up. Monday's shift ran to its usual pattern.

100% of the working volume1 weekend on it

NG · NTG-2026-1893ON THE LOG ✓

Seven years of invoices, and a plug lifted clean off the board

Invoices going back seven years were on that stick, along with the CIS records, and a return was coming due. It had been trodden on across a site-office floor, and the connector had come clean off the board. Monoliths give you nothing to plug into, so the pinout on the controller was mapped and the data read straight from the test pads. The return went in before its deadline.

100% of the files back3 days between arrival and return

NG · NTG-2026-1802ON THE LOG ✓

Sealed in a bag while still wet, and in the post that afternoon

Nobody powered it up to see whether it still worked, and nobody stood it near a radiator — which is why twenty years of family photographs are back with their owner. Bagged, still wet, it caught the post that same afternoon. Cleaning the pads and moving the ROM across to a donor board was the whole of it, and the full image finished on day four.

100% of the files back4 days between arrival and return

NG · NTG-2026-1797ON THE LOG ✓

A fall onto concrete, with three years of weddings on the drive

It tipped over during the pack-down, and it was already clicking before it ever got to the bench. On it sat three years of paid work, including that morning's ceremony. Heads came off a matched donor, the copy ran across two days, and back came every gallery.

99% of the files back4 days between arrival and return

NG · NTG-2026-1792ON THE LOG ✓

An overnight update, and a Mansfield practice locked out of its own workstation

Nobody at the practice realised they already held the key. An overnight update altered what the TPM measures, and the workstation came up asking for 48 digits that had never been written down anywhere. On screen was a Recovery Key ID; it matched an escrow record sitting in the firm's own Entra ID, and that answered the whole job. Fresh BitLocker metadata went onto a new disk with repair-bde, and every project file opened exactly as it always had.

100% of the files back3 days between arrival and return

NG · NTG-2026-1788ON THE LOG ✓

Ransomware overnight at a builders' merchant in Loughborough

Nothing had been encrypted where it lay. What the software did was open each file in turn, write a scrambled version beside it, and delete the one it had just read — so the real accounts had never gone anywhere. They were sitting unallocated and could be pulled straight back. Whatever that missed turned up in a NAS snapshot nobody had bothered to check. No ransom, no reply, and the merchant was invoicing again inside the week.

Working again inside the same weekNot a thing paid, and nothing handed over

NG · NTG-2026-1783ON THE LOG ✓

Unplugged mid-write, and Windows called the volume RAW

A cable caught mid-write, and by morning the only thing Windows would offer was a format. Before anything else, an end-to-end image was taken of the 4TB, and every repair after that was done to that copy: boot sector, then the damaged mirror of the MFT. The original was never written to at all. Fifteen years of client files came back with the folder tree the way it was.

100% of the files back3 days between arrival and return

NG · NTG-2026-1779ON THE LOG ✓

The family archive took the format meant for its twin 2TB disk

One tower, two 2TB disks of the same model — and the format landed on the family archive rather than on the spare. Because a quick format does no more than lay down a fresh index, everything beneath it was still sitting where it had always been. Nothing further had been written to that disk, so the archive came off exactly as it went on.

The whole folder tree back3 days between arrival and return

NG · NTG-2026-1774ON THE LOG ✓

A year of bookkeeping, gone with one shift-delete on the wrong folder

One keystroke took a year of bookkeeping off the office PC — Shift held down across the wrong folder, which meant the recycle bin never saw it. That afternoon the tower was imaged, and from then on the original was left alone. The master file table was rebuilt on the copy, and back came the folder, names and dates as before.

The whole folder tree back24 hours of work on it

NG · NTG-2026-1768ON THE LOG ✓

A blown TVS diode, and a WD that would not spin

No spin by morning, and nothing listed in the BIOS: an overnight spike on the mains had finished the board. The TVS diode was short — which is that component doing precisely what it exists to do, going first and sparing the motor and the heads. A donor board of matching revision received the original ROM, and the disk imaged straight through before the day ended.

100% copied sector by sector2 days between arrival and return

NG · NTG-2026-1761ON THE LOG ✓

Five years of takings on a Seagate that had started ticking

One tick a second, never varying, like a metronome, over five years of till records. The disk would not image at all until two donor head stacks had gone in, and the imaging after that was spread deliberately across several days. Ilkeston's shop got the VAT return in on time, its ledger complete.

97% of the files back4 days between arrival and return

NG · NTG-2026-1713ON THE LOG ✓

The clip a driver deleted, at a Lincoln distribution yard

Nothing at all was done to the card: an image came off it first, and the rest of the work ran on that image. Overnight the clip that had been asked for was gone, though the picture data beneath it was not — so it was rebuilt off the copy, hashed, exported, and in the insurer's hands within the week. Deletion and overwriting are different things, and the card itself showed which had happened.

The video came back completeHash-checked export supplied

NG · NTG-2026-1708ON THE LOG ✓

The insurer wanted footage of both vans, and the clip was gone

Weeks went by before anybody at the yard was asked for footage, and by then the recorder had come round to that date more than once. One clip was all that had ever existed: a manager had exported it, then deleted it. Unallocated space still held it, so it was carved out and hashed and the method written up briefly — enough, as it turned out, for the claim to settle with no hearing.

The insurance claim brought to a closeExhibit-numbered export supplied

NG · NTG-2026-1702ON THE LOG ✓

Wiped from the DVR's own menu; four of the five days came back

Unplugging the recorder within a few hours is what made this one work. Footage that looked long past its use had been deleted by a member of staff, and the only record of the theft went with it. Four of the five missing days still carried index entries and timings, which is why those clips returned with camera names and times on them. Day five came out of raw blocks instead: it plays, though there is nothing in it to say when.

4 of the five days, times intact72 hours of work on it

NG · NTG-2026-1696ON THE LOG ✓

Nine days went by before the Nottingham shop asked for its footage

The insurer took nine days to ask for anything, and throughout them the recorder kept writing over itself. Not a byte came off the original before an image existed. Decoding the index placed the burglary on sectors the loop had yet to reach a second time. Two files left here: one to view, and one for the claim file.

The entire break-in window came back off the disk3 days between arrival and return

NG · NTG-2026-1689ON THE LOG ✓

Twenty days of uploads, then the resignation letter

Company property, so authorising an examination of the laptop raised no argument. The order of events was plain enough — a folder put together, a sign-in to a personal cloud account, an upload, and twenty days after the last of it, a resignation letter. A competitor's pitch deck was all the Leicester employer had at the start. Undertakings ended the matter.

Concluded once undertakings were in placeThe run of events written up inside 7 days

NG · NTG-2026-1684ON THE LOG ✓

Two firms, one shared folder, and a Part 35 report

One shared folder, two firms, and a set of accounts that existed in two versions nobody could reconcile. Imaging both machines forensically showed which edit had been made where, and in what order — and the order was the answer. Within the month the dispute was settled.

Concluded after reports were exchangedCPR Part 35 met in full

NG · NTG-2026-1677ON THE LOG ✓

The wiping tool logged its own fifteen minutes

About fifteen minutes of wiping, started one evening by a person on their way out of the door, on a laptop due back the next day. Its own log was kept by the tool, and that log survived into the image: it gave the start time and named the folders never reached. After which the sequence was no longer arguable.

The run of events pinned downThe findings with you on day 8

NG · NTG-2026-1671ON THE LOG ✓

A Lincoln firm convinced someone had taken its project files

Nobody had taken anything at all. The culprit was a sync client with the wrong settings, which had emptied the shared folder by itself — a duller answer than the theft the client came in expecting — and the bulk of what disappeared was still recoverable. That finding closed the dispute with nobody accused.

The disagreement ended, nobody blamedThe findings written up in six days

Every one of them, listed.

Forty-five jobs. No entry was written up before its customer approved it and the identifying detail had been taken out. Each of them records the device that arrived, what was riding on it, the bench work, and how much came home.

Yours would make forty-six.

All forty-five began where yours would begin: with a diagnosis nobody charges for.

0115 8220606

Send it for a free look Posting it to Manchester