The bench · closed jobs
A job goes up here once the customer has confirmed what came back and every identifying detail has been taken out. Each entry links to the guide covering that fault, so you can read the write-up and then read how that work is actually done.
Tell an engineer what it is doing
0800 6890668
The screen said Volume Crashed, and the DiskStation had spent the night rebuilding onto a disk that was already shedding sectors. SHR had spread four mismatched disks across more than one mdadm set, with LVM and btrfs stacked above, so no single disk meant anything on its own. All four were imaged, the layers put back in order, and every share opened.
The practice rang with its database marked Suspect after an overnight power cut, and an emergency slot was already open. Forensic copies came first, and on those copies the transaction log still replayed. Attaching against one worked at the first attempt, so the morning's bookings ran twenty minutes late rather than a week.
RAID 10 survives one disk in each mirrored pair and not a disk more, which is the half of it nobody reads. Here a member had been failing quietly for weeks, and its partner gave out in the middle of a working day, so the stripe lost a whole pair and the volume went with it. All four disks were imaged, the weak one over two nights, and pair membership, stripe size and order were worked out from those copies.
After a power event the PERC came up offering to import a foreign configuration, and nobody in the office knew whether Import or Clear was the safe answer. They left it alone, and that decided the case. Every member went to an image, the DDF metadata was read off the copies, and the virtual disk was rebuilt from them.
The laptop arrived whole, as Acers usually do, when only the M.2 drive needed to travel. It had gone off a table and afterwards would get no further than the Acer logo. The owner tried once, then stopped, and that restraint is most of why this worked. The board was dead but the NVMe module still read, and Windows 11 had turned BitLocker on at setup without anyone noticing. The key was still sitting in the owner's Microsoft account. Imaging ran slowly around a band of weak blocks, the key opened the volume, and almost all of it came back.
What the free tool handed back were thumbnails: six hundred of them, and not one big enough to print. The card had gone untouched since, which is why it copied without complaint, and each CR3 original was reassembled out of its fragments. Six hundred and forty frames went home at full resolution.
June was when disk two quietly dropped out, and nobody saw it go. August was when disk four gave up mid-rebuild, which made it look like two had died at once. It had not. Imaging turned up nineteen bad sectors on that fourth disk and nothing else, so three clean members and one nearly clean fourth rebuilt the stripe. The filings went in on time.
When the mains came back the Smart Array offered choices nobody in the practice could safely take, the battery having emptied while the power was off. Each member went to an image first. Only then did the RIS metadata come off, with the delayed parity allowed for, and the rebuild ran on copies alone. The practice-management database opened complete, current to the final write the cache had committed.
A Birmingham student got the laptop back running sweetly, on a brand-new disk holding nothing at all. The original, written off as dead, sat in a drawer at home, still clicking. Donor heads went in, and inside two days every essay and photograph was on the replacement disk the shop had fitted.
The complication here was a rebuild someone had already set running on the RAID beneath the booking system. Nothing was touched until each member drive had an image of its own. The array went back together virtually, off those images, and a checked database was carrying bookings again by Thursday lunchtime. Priority queue from the first call.
The drive began ticking nine days before the hand-in date. A donor head stack went in, the imaging was held deliberately slow, and the encryption keys came off the bridge board; the thesis came home whole, references and all, a week ahead of the deadline.
Two red lights the box could still have come back from; the rebuild that followed could not, because it wrote over the metadata the unit kept for itself. Both disks were imaged past their bad sectors, and at every point the mirror was rebuilt from whichever copy read cleanest, until the shared volume stood whole again.
The wedding had been shot the night before, and by breakfast the 512GB SanDisk was showing nothing on it at all. The card was cloned first. Its file system was rebuilt on that clone, and a deep carve then swept up the files left with nowhere to sit. Not a frame was missing, and the photographer kept the client.
An Apple Store had already declared the machine finished. Inside sat a Fusion Drive — an SSD and a hard disk presented to you as one volume — and the hard disk was on its way out. Each half was imaged, the map that joins them was put back together, and a decade of one design studio's work came off it.
By the time it reached us the disk was clicking and the laptop itself was scrap. We fitted donor heads, imaged at a crawl, and inside three days she had every lesson plan, report and set of marks from five years of teaching.
Nothing inside had turned for weeks, and two of the heads were gone. A donor stack went in, the first imaging pass lifted 96% of it, and the ledgers, invoices and photographs went home checked.
A firmware update stopped part-way through and left the laptop's system SSD unreadable. Its translator tables were rebuilt in technical mode, and a decade of edited catalogues belonging to one photographer came back whole.
The rebuild took a second member with it on the Friday, and the live production data went out of reach. Nothing was powered up again. All four disks were copied to our own storage, the stripe worked out from three clean images and what the fourth still held, and the plant started on time Monday.
It had been trodden on in a site office until the connector parted from the board, taking seven years of invoices and the CIS records out of reach with the tax return due. A monolith leaves no port to work through, so the test pads were found and the controller pinout mapped here. Everything was filed on time.
Nobody tried to dry it out or test it, and that decision is the whole case. It went into a sealed bag still wet and into the post that afternoon. Contacts were cleaned at the bench, a donor board took the ROM off the original, and a full image followed inside the week. Twenty years of family pictures came back.
A hard floor at the end of a wedding shoot, and by the first bench test the drive was clicking. Three years of commissioned work were on it. We fitted a donor head stack, imaged for two days, and every gallery came back — the morning's shoot with them.
The workstation came up demanding a recovery key that nobody in the practice had kept, an overnight firmware update having moved the TPM measurements beneath it. Its Recovery Key ID matched an entry in the practice's Entra ID escrow, and from there repair-bde put the damaged BitLocker metadata back onto a clean disk. Every project file came through.
Not one file was encrypted where it sat. Each was copied, the copy locked, the original deleted — so what mattered still lay in free space, ready to carve back, and a NAS snapshot nobody had remembered covered the rest. They were trading again within the week, no ransom paid and no reply sent.
The lead came out of the socket while a write was still running, and by the next morning Windows had nothing to offer but a format prompt. An image of the whole disk came first. The boot sector and the damaged MFT mirror were then repaired on that image alone. Fifteen years of client work went back with the folders as they had been.
A quick format rewrites the index and leaves the data where it lies, which is the whole reason this one came back. Two matching 2TB disks sat in the same tower, and the fitter wiped the family archive rather than the spare. Nothing was written afterwards, so the archive listed out exactly as before.
One wrong folder, Shift held down, and a year of ledgers left an office PC without ever reaching the bin. The machine was imaged that same afternoon. Rebuilding the file table on the copy brought the folder back with its names and dates intact.
A power cut in the night finished the board. The TVS diode had shorted, which is exactly the job that component is there to do — it dies so the rest does not. By morning nothing spun and BIOS saw nothing. The ROM went across to a donor board and the disk was imaged end to end that same day.
The disk ticked about once a second on the bench, and five years of till data sat behind the noise. Two donor head stacks went in, imaging was held to a crawl over several days, and a Kings Heath shop filed its VAT return on time with the ledger whole.
Deleted is not the same as recorded over, and the image off this cab camera proved it was the first. The clip an insurer wanted had gone overnight; the card was copied before anything else was tried. Rebuilt and hashed, the footage was back inside the week and settled the claim and the HR file together.
By the time anyone asked whether two vans had really met in that yard, the recorder had long since looped past the date. A manager had exported the clip weeks earlier and then deleted it, and no other copy existed anywhere. That export was carved back out of free space, hashed, and written up in a short report. The claim settled with no hearing.
A member of staff had binned what they took to be old clips, and a theft was sitting in one of them. The recorder went off that same afternoon, and that is what saved it: four of the five missing days were still listed in its index with timestamps intact, and the fifth was carved back as playable video, unlabelled.
Nine days passed before the insurer asked, and the recorder had been writing over itself the whole while. A copy of the disk came first, then its index was decoded, and the break-in came back off sectors the loop had still not overwritten. Two copies went back: one for watching, one for the insurer.
Twenty days separated the last upload from the resignation letter, and that gap is what made the order of things obvious: files gathered into one folder, a personal cloud account logged into, then the transfer. All the Worcester employer had was a competitor's pitch deck. Undertakings closed it.
One folder sat between two companies and two sets of accounts that refused to agree. The image showed that neither copy had been left alone, and the timeline put that beyond argument. The matter settled inside a month.
The evening before handing the laptop back, a departing employee started a wiping tool and left it going. It got about fifteen minutes in. Its own log survived in the image, showing the time it started and the files it never got to, and that was enough to lay out the order of events.
The client arrived certain the files had been taken on purpose. What the evidence showed was duller: a sync client set up badly had swept them off the shared drive, and most of it could be brought back. That finding closed the argument faster than an accusation ever would.
Forty-five jobs, names removed and results confirmed. Each one says what arrived, what was riding on it, how it was handled, and how much went home.
Every one of these started where yours would start: a free diagnosis.