HDR / Casebook

The bench · closed jobs

Each job we finish, written up properly.

An entry only goes up once the customer has agreed what came off the device, and names, addresses and serial numbers are stripped out before it does. Each one links to the guide for that fault, so you can read what happened and then how it was done.

An engineer will take the details
0800 6890668

Newest at the top.

Read it on the home page →

HU · HUL-2026-0857LOGGED ✓

A four-bay NAS of odd disks, ruined by its own rebuild

Volume Crashed was on the screen. Overnight the DiskStation had tried to rebuild onto a member that was already dropping sectors of its own. The four disks were all different sizes, which is why SHR had laid the array across more than one mdadm set, and LVM and btrfs then sat on top; pull any single disk and it tells you nothing. Every one of the four was imaged, the layers reassembled in order, and the shares mounted.

All shares came back5 days after it landed

HU · HUL-2026-0851LOGGED ✓

SQL Server said Suspect, and a Goole practice rang at 8:55am

A power cut in the night left the database marked Suspect. The call came in as the doors opened, with an emergency slot already free. The original was not touched: copies were made first, and the transaction log on one of them still replayed. It attached first time, and the morning list ran twenty minutes behind rather than a week.

Reattached — nothing lost24 hours of bench time

HU · HUL-2026-0846LOGGED ✓

A My Book with a dead bridge, and the disk inside encrypted

The enclosure had stopped being seen at all, and the obvious move — take the 3.5-inch disk out and hang it off a SATA port — returned nothing but noise. That is normal for a My Book. The USB bridge does the encryption, so the bare disk means nothing without the key held on its own board. The disk was imaged through a matching bridge with the key lifted off the original, and the two volumes on it, work files and a photo library, both read out whole.

Both volumes read out whole3 days after it landed

HU · HUL-2026-0841LOGGED ✓

A 4TB Barracuda that copied slower every week

It still appeared in Windows, still passed the maker's own test, and still took longer every week to copy anything off. Seagate put shingled recording in a number of desktop Barracudas: write one track and the drive rewrites its neighbours, so a weak patch of surface turns the whole disk to treacle. It was imaged head by head at low speed, the slow zones left until last, with nothing written back to it.

100% copied3 days after it landed

HU · HUL-2026-0834LOGGED ✓

A Satellite Pro stuck on the logo, and an MQ01 near the end

A hinge had worked loose over years in a bag, and then one morning the Satellite sat on the Toshiba screen and went no further. Nine times in ten that is the laptop rather than the disk. Here it was the disk. One band on the MQ01ABD would no longer give up a clean read. The owner powered the machine down and left it, rather than handing it to a repair shop to run checks over, and that is why anything survived. The 2.5-inch drive came out and onto the imager, read one head at a time and very slowly, the bad band saved for last, nothing written back.

98% recoveredNothing written to it

HU · HUL-2026-0827LOGGED ✓

600 wedding RAWs, and the free tool gave thumbnails

What the free tool produced were previews: six hundred of them, and none big enough to print. The card had sat unused since the wedding, so the copy came off it without trouble. Each CR3 was then assembled from the pieces it had been broken into. All 640 came back at their proper size.

640 frames back, full size72 hours of bench time

HU · HUL-2026-0822LOGGED ✓

A RAID 5 down at an accountancy firm, year-end a week away

Disk two had dropped out in June and nobody had looked. Disk four then failed part way through a rebuild in August, which read from outside as two dead disks at once. It was not. Imaging showed nineteen bad sectors on the fourth and nothing else wrong, so the three healthy members and that one almost-healthy disk were enough to rebuild the stripe. The year-end filing was made on the date it was due.

19 bad sectors, and no second failure6 days after it landed

HU · HUL-2026-0816LOGGED ✓

A flat cache battery, and the ProLiant asking questions

The power had been off long enough for the cache battery to go flat. When it came back up, the controller put a question to the practice that none of them could safely answer, so nobody answered it. Every member was copied before anything else was tried. The array's own metadata was read back from those images, the parity rotation worked out, and the set assembled on copies alone. The practice database opened in full, up to the last write the cache had managed.

Database came up complete5 days after it landed

HU · HUL-2026-0811LOGGED ✓

The 'repair' worked fine. The student's files were not on it.

The shop handed the laptop back working, a new disk fitted and empty. The old one, written off as beyond help, sat clicking in a drawer in a Hull student flat. It got donor heads. Two days on, the essays and the photographs went onto the shop's new disk.

100% recoveredAfter that 'repair'

HU · HUL-2026-0803LOGGED ✓

Failed on the Monday, and a York haulier booking again by Thursday

A rebuild was already running when the call came in. That was the awkward part. Nothing on the array itself was touched. Each disk was imaged separately, and the array was reassembled in software from those images alone. The database checked out. The booking system was taking work again by Thursday lunchtime. The job went in front of everything else the moment the phone rang.

Business back up in 4 daysPriority job

HU · HUL-2026-0788LOGGED ✓

A WD Passport down the stairs, with the thesis on it

It started ticking nine days before the hand-in. A donor head stack went in, and the imaging was run slow on purpose. The keys came off the bridge board, because a Passport keeps them there. Chapters, references, the lot came back. The thesis went home with a week to spare.

100% of the chapters72 hours of bench time

HU · HUL-2026-0785LOGGED ✓

A NAS at Skegness, and a rebuild that made it worse

Two red lights, and the box was still savable. It was the rebuild someone kicked off next that finished it: the unit's own metadata got written over. Each disk was then imaged past its bad sectors. The mirror went back together a block at a time, every one taken from whichever disk had read cleanly there. The shared volume came out complete.

100% recovered5 days after it landed

HU · HUL-2026-0779LOGGED ✓

One card held the wedding, and it showed empty

The wedding had been shot the evening before; by morning the 512GB SanDisk showed as empty. The card was cloned before anything else was attempted. The file system came back out of that clone, and a deep carve then collected the fragments that no longer had a home. Every frame was there, and the photographer kept the client.

Every frame recovered48 hours of bench time

HU · HUL-2026-0770LOGGED ✓

An iMac whose Fusion Drive failed over a fortnight

The Apple Store had already told the owner the iMac was finished. Fitted inside was a Fusion Drive: flash storage plus a mechanical disk, which macOS reports as one volume. The mechanical part was dying. Each was imaged on its own, and rebuilding the mapping that pairs them gave a design studio ten years of files back.

98% recovered5 days after it landed

HU · HUL-2026-0766LOGGED ✓

A dropped laptop with five years of a teacher's work

The laptop itself was finished, and the disk in it was clicking. A donor head stack was fitted, imaging ran at a crawl, and three days on she had her lesson plans, her reports and five years of marks back.

100% of the disk contents3 days after it landed

HU · HUL-2026-0761LOGGED ✓

Fifteen years of a firm's books, behind two dead heads

The disk had not turned for weeks, and two of its heads were dead. A matched donor stack went in. On the first imaging pass 96% came off, and the books, the invoices and a lot of family photographs were checked and sent back.

96% recovered4 days after it landed

HU · HUL-2026-0754LOGGED ✓

The firmware update stopped, and so did the NVMe

The laptop's system SSD stopped in the middle of a firmware update. After that it would not read at all. From technical mode an engineer restored its translator tables. The photographer's catalogues, ten years of edits, opened again.

99% recovered5 days after it landed

HU · HUL-2026-0748LOGGED ✓

Two members down by Friday, and Monday's shift still ran

A second member dropped out under the rebuild that Friday, and the live data went beyond reach. From then on the array stayed off. All four disks were imaged onto our own hardware. The stripe was read back from three clean copies, plus the little the fourth would still give up, and the works kept to schedule on the Monday.

100% of the live data1 weekend

HU · HUL-2026-0743LOGGED ✓

The connector went, and seven years of invoices with it

It went under a boot on a site office floor, and the connector left the board. Seven years of invoices were on it, the CIS records with them, and a tax return was due. A monolith gives you no socket to work through, so the controller pinout was traced and the read taken off the test pads. The return went in on time.

100% recovered3 days after it landed

HU · HUL-2026-0652LOGGED ✓

A leak through a home-office ceiling, and nobody tried to power the drive up

Nobody switched it on to see, and nobody tried to dry it out. That is what left something to work with. It went into the post the same afternoon, wet, sealed in a bag. At the bench the pads were cleaned up, the ROM lifted onto a donor board, and a complete image taken a few days later. Twenty years of family photographs went back.

100% recovered4 days after it landed

HU · HUL-2026-0647LOGGED ✓

Dropped on concrete as the wedding shoot packed up

It struck concrete when a wedding was finishing up, and immediately began clicking on the bench. Three years' worth of paid work rested on it. Donor heads were placed into it; imaging required two days; and each gallery (including the one taken that morning) was restored.

99% recovered4 days after it landed

HU · HUL-2026-0642LOGGED ✓

A firmware update in the night, and a Skegness practice shut out of its workstation

No one at the practice had ever recorded the recovery key. On an early morning the workstation requested the recovery key: an overnight firmware update had modified what the TPM measured. The Recovery Key ID was located in the company's Entra ID escrow. That was enough. repair-bde created clean BitLocker metadata to write on a new disk, and all files pertaining to projects were recovered.

100% recovered3 days after it landed

HU · HUL-2026-0638LOGGED ✓

A builders' merchant in North Lincolnshire, hit by ransomware overnight

Nothing was locked in place. Each file was accessed, a locked version written, and the original file deleted, leaving the information necessary to restore in unallocated space, and capable of being extracted again. Everything else remained in a NAS snapshot no one considered looking at. The business was operating again inside a week with no payments made and the note left unanswered.

Trading again in under a weekNothing paid to anyone

HU · HUL-2026-0633LOGGED ✓

The cable came out mid-write, and Windows called it RAW

A person pulled the lead half-way through a write. By morning Windows did nothing except ask to format the disk. An entire image of the 4TB was taken first, and all subsequent repairs occurred on the image: the damaged boot sector was repaired next, followed by the wrecked MFT mirror. The original has never been written to. Fifteen years of client data returned, complete with its folder tree.

100% recovered3 days after it landed

HU · HUL-2026-0629LOGGED ✓

Two identical disks, and the wrong one was formatted

Two identical 2TB disks sat next to each other in one tower, and the one that got wiped held the family archive rather than the empty one. All a quick format does is redo the index. The files stay put where they were, and that is why it came back at all. Nothing else had gone onto the disk since, so the archive read out exactly as before.

Whole tree came back3 days after it landed

HU · HUL-2026-0624LOGGED ✓

A year of accounts gone, because Shift was held on the wrong folder

The shift key was depressed on an incorrect folder, therefore 12 months of accounting records were lost from the office PC prior to ever entering the recycle bin. The tower was imaged later in the day. All work thereafter occurred on the copied image: the master file table was recreated and the folder reappeared, complete with original names and dates.

Whole tree came back24 hours of bench time

HU · HUL-2026-0618LOGGED ✓

The TVS diode went short and the WD stopped dead

A surge overnight did for the electronics. Its TVS diode had gone short, which is exactly what the part exists to do: it dies so that the motor and the heads do not. Next morning: no spin, and nothing at all in the BIOS list. The ROM was transplanted to a matching donor board, and after that the disk read end to end inside the day.

100% copied2 days after it landed

HU · HUL-2026-0611LOGGED ✓

A Seagate ticking, and five years of takings on it

One tick a second, as regular as a metronome, with five years of till records behind it. Two donor head stacks went in one after the other, imaging was held deliberately slow over several days, and a shop on Newland Avenue got its VAT return away on time, ledger complete.

97% recovered4 days after it landed

HU · HUL-2026-0563LOGGED ✓

A Hedon Road transport firm, and a clip a driver deleted

Deleting a segment does not equal writing over it. The image captured from this cab-mounted camera determined which occurred. The clip requested by the insurer had vanished during the night, thus no action was performed until a duplicate of the card existed. It was built from this duplicate copy, hashed, and returned inside a week. Both the claim and the HR file were resolved on it.

CCTV video came back wholeConfirmed export

HU · HUL-2026-0558LOGGED ✓

Two vans, one claim, and a file already deleted

The yard was not queried until the recorder had written over that date several times. Weeks before, a manager had taken the clip off and then deleted the file, and nothing held another copy. It came back out of unallocated space, was hashed, and went into a short written report. The claim closed with no hearing.

Insurance claim settledCourt-ready export

HU · HUL-2026-0552LOGGED ✓

A wiped week, and most of it back for a Newland Avenue shop

An individual behind the counter had erased segments that appeared too old for reuse. This included a theft occurring directly within it. It was saved due to the recorder being stopped within a few hours. Of the five missing days, four days retained their index entries and timestamps. The fifth day only came back as carved video: it will play, but nothing identifies it.

4 of the 5 missing days, timestamps and all72 hours of bench time

HU · HUL-2026-0546LOGGED ✓

A Hull shop break-in, nine days into the loop

The insurance company requested footage nine days after the break-in. The unit continuously overwrote itself throughout those nine days. No content was read from the original media unit until an image existed. Examining the index revealed the burglary still present on sectors that were not yet rewritten by the looping cycle. Two copies were sent out: one to examine and another to include in the claim file.

The break-in window read back3 days after it landed

HU · HUL-2026-0539LOGGED ✓

Files went out twenty days before the resignation

The employer in Bridlington brought in a competitor's slide presentation (pitch deck) with very little other material. The timing proved to be the deciding factor; the last file was uploaded twenty days prior to the employee's resignation letter. On the company's own laptop, the various files were consolidated into a single folder. Afterwards, a personal cloud account was created and the materials were uploaded, in this exact sequence. The case closed when undertakings were given.

Closed with undertakingsChronological record written up in 7 days

HU · HUL-2026-0534LOGGED ✓

One shared folder, two North Lincolnshire firms, a Part 35 report

Two companies; two versions of the financial records that did not agree; one shared directory. The imaging revealed each version had been altered and the timeline of alterations left no room for argument. The matter was resolved by the end of the first month.

Closed post-exchangeCPR 35 throughout

HU · HUL-2026-0527LOGGED ✓

A quarter-hour of wiping, and the tool's own log

On the final evening before the laptop went back, a wiping tool was started by somebody heading out of the door. It ran about fifteen minutes. The tool kept its own log, that log came through in the image with a start time and a list of everything it had not got to, and the order of events stopped being arguable.

Chronological record fixedFindings by day 8

HU · HUL-2026-0521LOGGED ✓

Missing project files, and an East Yorkshire firm sure of theft

What our client thought we would uncover was theft. What we found was far less sensational. A user improperly configured a sync client, which resulted in the automated removal of all data from the shared directory. Fortunately most of the material could be recovered. The findings ended the dispute without either party having made accusations.

Dispute resolvedFindings inside six days

Every one, listed.

Forty-five entries, anonymised and cleared with the customer first. Each says what landed on the bench, what depended on it, the way it was worked, and how much went back.

Yours could be the next one.

All of them started where yours would: a diagnosis that costs nothing.

0800 6890668

Have it looked at How to post it to us