Case Studies

The Situation

Two simultaneous drive failures during a rebuild operation caused the array to go offline, rendering approximately 16 TB of video production assets inaccessible.

The Challenge

The failed rebuild had partially overwritten parity data on a third drive, significantly complicating the recovery. The client required the original folder structure to be preserved to meet a broadcast delivery deadline.

Our Approach

Each drive was individually imaged to a forensic copy before any reconstruction was attempted. Our engineers analysed the RAID parameters — stripe size, rotation, and parity layout — and rebuilt the array virtually from the imaged copies. Partial overwrite damage was addressed through sector-level reconstruction.

The Situation

A solicitor's laptop was dropped while in use. The drive suffered a severe head crash, with the read/write heads making contact with the platters. The drive was completely undetected by the operating system.

The Challenge

Platter scoring was present across two of the four platters, and the heads had partially seized. Standard donor matching was required due to firmware-specific head stack compatibility.

Our Approach

The drive was opened in our ISO Class 100 clean room. A compatible donor head stack was sourced and fitted. Platters were inspected for scoring depth before imaging commenced. A specialised imager was used to extract data from the damaged sectors in multiple passes.

The Situation

A power surge caused the NAS controller board to fail. Two of the four drives were also affected by the surge. The client had not maintained an off-site backup and required access to three years of financial records and stock data.

The Challenge

The controller failure had corrupted the volume metadata, and the two surge-affected drives had developed bad sector clusters in the file system area. The Btrfs file system required specialist reconstruction tools.

Our Approach

All four drives were imaged independently. The two surge-affected drives were treated with targeted sector recovery passes. Volume metadata was reconstructed manually from the imaged copies, and the Btrfs file system was rebuilt in a virtual environment.

The Situation

A government workstation SSD failed following a firmware update that was interrupted by a power cut. The drive was BitLocker-encrypted and became unresponsive after the failed update.

The Challenge

The firmware corruption had rendered the drive's translation layer inaccessible, preventing any standard recovery approach. The encryption added a further layer of complexity, requiring the client to provide the BitLocker recovery key before any decryption could be attempted.

Our Approach

Our engineers used direct NAND flash access techniques to bypass the failed controller and read the raw flash memory chips. The raw data was reconstructed into a logical image, and the BitLocker volume was decrypted using the client-supplied recovery key.

The Situation

An external drive containing the complete photo and video archive for a major corporate event was accidentally dropped and became unresponsive hours before the client was due to deliver the final edited footage.

The Challenge

The case was received at 9 PM. The client required delivery by 8 AM the following morning. The drive had suffered a head failure and required clean room work within the emergency window.

Our Approach

The drive was immediately triaged on receipt. Clean room work commenced within the hour. A compatible donor was sourced from our in-house parts inventory. Imaging was completed overnight with priority given to the video project folders.

The Situation

Three drives in a RAID 6 array failed within a 48-hour period following a cooling system fault in the server room. The array went offline and the PERC controller reported the volume as foreign and unreadable.

The Challenge

The PERC controller had partially written a new configuration to the drives before going offline, overwriting portions of the original RAID metadata. SAS drive firmware logs indicated thermal stress damage on all eight drives.

Our Approach

All eight drives were imaged with thermal management protocols to prevent further damage. The RAID 6 parameters were reconstructed from the remaining metadata fragments and verified against the known data patterns. The array was rebuilt virtually and the NTFS volume was extracted.