HDR / Casebook

The bench · closed jobs

Each job we finish, written up properly.

An entry only goes up once the customer has agreed what came off the device, and names, addresses and serial numbers are stripped out before it does. Each one links to the guide for that fault, so you can read what happened and then how it was done.

An engineer will take the details
0800 6890668

Newest at the top.

Read it on the home page →

HU · HUL-2026-0857LOGGED ✓

A four-bay NAS of odd disks, ruined by its own rebuild

Volume Crashed was on the screen. Overnight the DiskStation had tried to rebuild onto a member that was already dropping sectors of its own. The four disks were all different sizes, which is why SHR had laid the array across more than one mdadm set, and LVM and btrfs then sat on top; pull any single disk and it tells you nothing. Every one of the four was imaged, the layers reassembled in order, and the shares mounted.

All shares came back5 days after it landed

HU · HUL-2026-0851LOGGED ✓

SQL Server said Suspect, and a Goole practice rang at 8:55am

A power cut in the night left the database marked Suspect. The call came in as the doors opened, with an emergency slot already free. The original was not touched: copies were made first, and the transaction log on one of them still replayed. It attached first time, and the morning list ran twenty minutes behind rather than a week.

Reattached — nothing lost24 hours of bench time

HU · HUL-2026-0846LOGGED ✓

A My Book with a dead bridge, and the disk inside encrypted

The enclosure had stopped being seen at all, and the obvious move — take the 3.5-inch disk out and hang it off a SATA port — returned nothing but noise. That is normal for a My Book. The USB bridge does the encryption, so the bare disk means nothing without the key held on its own board. The disk was imaged through a matching bridge with the key lifted off the original, and the two volumes on it, work files and a photo library, both read out whole.

Both volumes read out whole3 days after it landed

HU · HUL-2026-0841LOGGED ✓

A 4TB Barracuda that copied slower every week

It still appeared in Windows, still passed the maker's own test, and still took longer every week to copy anything off. Seagate put shingled recording in a number of desktop Barracudas: write one track and the drive rewrites its neighbours, so a weak patch of surface turns the whole disk to treacle. It was imaged head by head at low speed, the slow zones left until last, with nothing written back to it.

100% copied3 days after it landed

HU · HUL-2026-0834LOGGED ✓

A Satellite Pro stuck on the logo, and an MQ01 near the end

A hinge had worked loose over years in a bag, and then one morning the Satellite sat on the Toshiba screen and went no further. Nine times in ten that is the laptop rather than the disk. Here it was the disk. One band on the MQ01ABD would no longer give up a clean read. The owner powered the machine down and left it, rather than handing it to a repair shop to run checks over, and that is why anything survived. The 2.5-inch drive came out and onto the imager, read one head at a time and very slowly, the bad band saved for last, nothing written back.

98% recoveredNothing written to it

HU · HUL-2026-0827LOGGED ✓

600 wedding RAWs, and the free tool gave thumbnails

What the free tool produced were previews: six hundred of them, and none big enough to print. The card had sat unused since the wedding, so the copy came off it without trouble. Each CR3 was then assembled from the pieces it had been broken into. All 640 came back at their proper size.

640 frames back, full size72 hours of bench time

HU · HUL-2026-0822LOGGED ✓

A RAID 5 down at an accountancy firm, year-end a week away

Disk two had dropped out in June and nobody had looked. Disk four then failed part way through a rebuild in August, which read from outside as two dead disks at once. It was not. Imaging showed nineteen bad sectors on the fourth and nothing else wrong, so the three healthy members and that one almost-healthy disk were enough to rebuild the stripe. The year-end filing was made on the date it was due.

19 bad sectors, and no second failure6 days after it landed

HU · HUL-2026-0816LOGGED ✓

A flat cache battery, and the ProLiant asking questions

The power had been off long enough for the cache battery to go flat. When it came back up, the controller put a question to the practice that none of them could safely answer, so nobody answered it. Every member was copied before anything else was tried. The array's own metadata was read back from those images, the parity rotation worked out, and the set assembled on copies alone. The practice database opened in full, up to the last write the cache had managed.

Database came up complete5 days after it landed

HU · HUL-2026-0811LOGGED ✓

The 'repair' worked fine. The student's files were not on it.

The shop handed the laptop back working, a new disk fitted and empty. The old one, written off as beyond help, sat clicking in a drawer in a Hull student flat. It got donor heads. Two days on, the essays and the photographs went onto the shop's new disk.

100% recoveredAfter that 'repair'

HU · HUL-2026-0803LOGGED ✓

Failed on the Monday, and a York haulier booking again by Thursday

A rebuild was already running when the call came in. That was the awkward part. Nothing on the array itself was touched. Each disk was imaged separately, and the array was reassembled in software from those images alone. The database checked out. The booking system was taking work again by Thursday lunchtime. The job went in front of everything else the moment the phone rang.

Business back up in 4 daysPriority job

HU · HUL-2026-0788LOGGED ✓

A WD Passport down the stairs, with the thesis on it

It started ticking nine days before the hand-in. A donor head stack went in, and the imaging was run slow on purpose. The keys came off the bridge board, because a Passport keeps them there. Chapters, references, the lot came back. The thesis went home with a week to spare.

100% of the chapters72 hours of bench time

HU · HUL-2026-0785LOGGED ✓

A NAS at Skegness, and a rebuild that made it worse

Two red lights, and the box was still savable. It was the rebuild someone kicked off next that finished it: the unit's own metadata got written over. Each disk was then imaged past its bad sectors. The mirror went back together a block at a time, every one taken from whichever disk had read cleanly there. The shared volume came out complete.

100% recovered5 days after it landed

HU · HUL-2026-0779LOGGED ✓

One card held the wedding, and it showed empty

The wedding had been shot the evening before; by morning the 512GB SanDisk showed as empty. The card was cloned before anything else was attempted. The file system came back out of that clone, and a deep carve then collected the fragments that no longer had a home. Every frame was there, and the photographer kept the client.

Every frame recovered48 hours of bench time

HU · HUL-2026-0770LOGGED ✓

An iMac whose Fusion Drive failed over a fortnight

The Apple Store had already told the owner the iMac was finished. Fitted inside was a Fusion Drive: flash storage plus a mechanical disk, which macOS reports as one volume. The mechanical part was dying. Each was imaged on its own, and rebuilding the mapping that pairs them gave a design studio ten years of files back.

98% recovered5 days after it landed

HU · HUL-2026-0766LOGGED ✓

A dropped laptop with five years of a teacher's work

The laptop itself was finished, and the disk in it was clicking. A donor head stack was fitted, imaging ran at a crawl, and three days on she had her lesson plans, her reports and five years of marks back.

100% of the disk contents3 days after it landed

HU · HUL-2026-0761LOGGED ✓

Fifteen years of a firm's books, behind two dead heads

The disk had not turned for weeks, and two of its heads were dead. A matched donor stack went in. On the first imaging pass 96% came off, and the books, the invoices and a lot of family photographs were checked and sent back.

96% recovered4 days after it landed

HU · HUL-2026-0754LOGGED ✓

The firmware update stopped, and so did the NVMe

The laptop's system SSD stopped in the middle of a firmware update. After that it would not read at all. From technical mode an engineer restored its translator tables. The photographer's catalogues, ten years of edits, opened again.

99% recovered5 days after it landed

HU · HUL-2026-0748LOGGED ✓

Two members down by Friday, and Monday's shift still ran

A second member dropped out under the rebuild that Friday, and the live data went beyond reach. From then on the array stayed off. All four disks were imaged onto our own hardware. The stripe was read back from three clean copies, plus the little the fourth would still give up, and the works kept to schedule on the Monday.

100% of the live data1 weekend

HU · HUL-2026-0743LOGGED ✓

The connector went, and seven years of invoices with it

It went under a boot on a site office floor, and the connector left the board. Seven years of invoices were on it, the CIS records with them, and a tax return was due. A monolith gives you no socket to work through, so the controller pinout was traced and the read taken off the test pads. The return went in on time.

100% recovered3 days after it landed

HU · HUL-2026-0652LOGGED ✓

A leak through a home-office ceiling, and nobody tried to power the drive up

Nobody switched it on to see, and nobody tried to dry it out. That is what left something to work with. It went into the post the same afternoon, wet, sealed in a bag. At the bench the pads were cleaned up, the ROM lifted onto a donor board, and a complete image taken a few days later. Twenty years of family photographs went back.

100% recovered4 days after it landed

HU · HUL-2026-0647LOGGED ✓

Dropped on concrete as the wedding shoot packed up

It hit concrete while a wedding was being packed away, and on the bench it clicked straight away. Three years of paid work sat on it. Donor heads went in, imaging took two days, and every gallery was returned — including the one shot that morning.

99% recovered4 days after it landed

HU · HUL-2026-0642LOGGED ✓

A firmware update in the night, and a Skegness practice shut out of its workstation

Nobody at the practice had ever written the recovery key down, and one morning the workstation asked for it: an overnight firmware update had changed what the TPM measures. The Recovery Key ID was sitting in the firm's Entra ID escrow all along. That was enough. repair-bde wrote clean BitLocker metadata onto a fresh disk, and every project file came back.

100% recovered3 days after it landed

HU · HUL-2026-0638LOGGED ✓

A builders' merchant in North Lincolnshire, hit by ransomware overnight

Nothing was locked in place. Each file was read, a locked copy written, the original deleted — so the material that mattered still lay in free space, and could be carved out again. The rest sat in a NAS snapshot no one had thought to look at. The business was trading inside the week, with no money paid and the note left unanswered.

Trading again in under a weekNothing paid to anyone

HU · HUL-2026-0633LOGGED ✓

The cable came out mid-write, and Windows called it RAW

Someone pulled the lead mid-write. By morning Windows would do nothing but offer to format the disk. A full image of the 4TB came off first, and every repair after that happened on the image: the boot sector put right, then the wrecked MFT mirror. The original was never written to. Fifteen years of client jobs came back, folder tree and all.

100% recovered3 days after it landed

HU · HUL-2026-0629LOGGED ✓

Two identical disks, and the wrong one was formatted

Two identical 2TB disks sat next to each other in one tower, and the one that got wiped held the family archive rather than the empty one. All a quick format does is redo the index. The files stay put where they were, and that is why it came back at all. Nothing else had gone onto the disk since, so the archive read out exactly as before.

Whole tree came back3 days after it landed

HU · HUL-2026-0624LOGGED ✓

A year of accounts gone, because Shift was held on the wrong folder

Shift was held down on the wrong folder, so twelve months of bookkeeping left the office PC without ever reaching the recycle bin. The tower was imaged that afternoon. Work happened on the copy alone: the master file table went back together and the folder reappeared, names and dates as before.

Whole tree came back24 hours of bench time

HU · HUL-2026-0618LOGGED ✓

The TVS diode went short and the WD stopped dead

A surge overnight did for the electronics. Its TVS diode had gone short, which is exactly what the part exists to do: it dies so that the motor and the heads do not. Next morning: no spin, and nothing at all in the BIOS list. The ROM was transplanted to a matching donor board, and after that the disk read end to end inside the day.

100% copied2 days after it landed

HU · HUL-2026-0611LOGGED ✓

A Seagate ticking, and five years of takings on it

One tick a second, as regular as a metronome, with five years of till records behind it. Two donor head stacks went in one after the other, imaging was held deliberately slow over several days, and a shop on Newland Avenue got its VAT return away on time, ledger complete.

97% recovered4 days after it landed

HU · HUL-2026-0563LOGGED ✓

A Hedon Road transport firm, and a clip a driver deleted

Deleting a clip is not the same as writing over it. The image off this cab camera settled which had happened. The clip the insurer asked for had gone in the night, so nothing was touched until a copy of the card existed. It was rebuilt from that copy, hashed, and the footage went back inside a week. The claim and the HR file both closed on it.

Footage came back wholeVerified export

HU · HUL-2026-0558LOGGED ✓

Two vans, one claim, and a file already deleted

The yard was not queried until the recorder had written over that date several times. Weeks before, a manager had taken the clip off and then deleted the file, and nothing held another copy. It came back out of unallocated space, was hashed, and went into a short written report. The claim closed with no hearing.

Claim settledCourt-ready export

HU · HUL-2026-0552LOGGED ✓

A wiped week, and most of it back for a Newland Avenue shop

Someone behind the counter had cleared down footage that looked long past use. The theft was in the middle of it. What saved it was the recorder being stopped within a few hours. For four of the five missing days the index entries and their timestamps were still there. The fifth came back as carved video: it plays, but nothing names it.

4 of the 5 missing days, timestamps and all72 hours of bench time

HU · HUL-2026-0546LOGGED ✓

A Hull shop break-in, nine days into the loop

Nine days went by before the insurer asked, and the recorder overwrote itself all the while. Nothing was read off the original until an image existed. Decoding the index showed the break-in still sitting on sectors the loop had not yet returned to. Two copies left here: one to look at, one to go in the claim file.

The break-in window read back3 days after it landed

HU · HUL-2026-0539LOGGED ✓

Files went out twenty days before the resignation

A Bridlington employer brought in a rival's pitch deck and not much else. The timing decided it: the last upload ran twenty days before the resignation letter. On the company's own laptop, the files were pulled together into a single folder, then a personal cloud account was opened and the upload followed — in that order. The matter closed on undertakings.

Closed with undertakingsTimeline written up in 7 days

HU · HUL-2026-0534LOGGED ✓

One shared folder, two North Lincolnshire firms, a Part 35 report

One shared folder, two companies, and two versions of the accounts that did not agree. Imaging showed that both copies had been edited, and the timeline of those edits left nothing to argue about. The matter closed within the month.

Closed post-exchangeCPR 35 throughout

HU · HUL-2026-0527LOGGED ✓

A quarter-hour of wiping, and the tool's own log

On the final evening before the laptop went back, a wiping tool was started by somebody heading out of the door. It ran about fifteen minutes. The tool kept its own log, that log came through in the image with a start time and a list of everything it had not got to, and the order of events stopped being arguable.

Timeline fixedFindings by day 8

HU · HUL-2026-0521LOGGED ✓

Missing project files, and an East Yorkshire firm sure of theft

Theft was what the client expected us to find. The answer was duller. Someone had set a sync client up wrongly, and it had emptied the shared folder on its own. Most of the material was still there to recover. The finding ended the dispute, and no accusation was needed.

Dispute resolvedFindings inside six days

Every one, listed.

Forty-five entries, anonymised and cleared with the customer first. Each says what landed on the bench, what depended on it, the way it was worked, and how much went back.

Yours could be the next one.

All of them started where yours would: a diagnosis that costs nothing.

0800 6890668

Have it looked at How to post it to us