MHDR / Casebook

The lab · finished work

Closed cases, written up one at a time.

The work done on each job completed at this bench is written up here once the customer confirms the result and the names have been removed. Each record points to the guide for that fault, so when you open one, you can see the steps used to handle that particular type of recovery.

Describe the fault to an engineer
0800 6890668

Newest at the top.

Back to the homepage →

MH · MHD-2026-6857ON RECORD ✓

A four-bay NAS with mismatched disks, undone by its own rebuild

With one member already down, the rebuild of the TeraStation was run overnight but halted, leaving the array marked as failed. Underneath, the two 8TB hard drives and two 4TB hard drives contained Buffalo's own RAID descriptors, along with an XFS volume that the firmware would no longer mount. All four were imaged and we determined the correct order of the members and the offset from those images. Once that was complete, all shares opened as if nothing had occurred.

All shares recovered5 days from arrival

MH · MHD-2026-6851ON RECORD ✓

8:55am at a Beaconsfield practice: the SQL database flagged Suspect

An emergency repair was already queued when the practice called, after the overnight power outage had caused the database to be marked as Suspect. Forensic images were created first, and those images showed that the transaction log would still replay. After attaching on the copy of the database, everything worked on the first try, which left the morning's bookings twenty minutes behind instead of a whole week.

Reattached with no loss24 hours spent at the bench

MH · MHD-2026-6846ON RECORD ✓

A two-disk NAS striped for capacity, and one member that stopped answering

This unit had originally been configured in RAID 0 at installation, therefore the single striped volume across its two disks provided no redundancy at all. When the older disk stopped being seen, the whole volume disappeared with it. Both members were first copied into images (the failing one very slowly), then the stripe size, member order and starting offset were determined from these images, and the volume was successfully opened from them.

Both drives imaged first3 days from arrival

MH · MHD-2026-6841ON RECORD ✓

An iMac's Fusion volume that stopped mounting

Fusion provides a single volume that represents a 3.5-inch disk and a blade SSD. If either component develops a fault, then the entire volume disappears. Although there was no audible indication of failure, an upgrade had left the CoreStorage metadata inconsistent. In this case, we simply removed the display and captured a complete image of both halves. Using those copies, we were able to rebuild the volume.

100% imaged3 days from arrival

MH · MHD-2026-6834ON RECORD ✓

A LaCie Rugged that survived the drop better than its disk

The orange bumper had done its job. However, the disk itself didn't. When the drive fell off the desk during a transfer, the light still came on afterwards, but nothing ever mounted. The unit was left alone after that one attempt, which is what saved it: because it remained stationary, the platters stayed the way the fall had placed them. It contained a Seagate mechanism, as do most LaCie units. Therefore, a head stack from a matching donor unit went into the unit, allowing it to be able to read again. Short imaging sessions over a week, with the weakest zones left until last, allowed almost all of the owner's work to come home.

98% recoveredNothing saved over it

MH · MHD-2026-6827ON RECORD ✓

A wedding gallery, 600 RAWs, and a failed first attempt

There were six hundred files, and not one file was printable, as the free software had only been able to recover the embedded previews. However, the card had sat unused since then. Therefore, it was able to image cleanly, and the CR3 originals were reassembled one fragment at a time. The gallery was sent home at full size, forty frames longer than that tool had managed.

640 frames, full resolution72 hours spent at the bench

MH · MHD-2026-6822ON RECORD ✓

An accountancy practice lost its RAID 5 a week from year-end

No one noticed when disk two dropped out in June; therefore, when disk four dropped out of the array during a rebuild in August, it appeared to be two failures occurring simultaneously. It wasn't. Imaging found that disk four had nineteen bad sectors and nothing worse. Therefore, three intact disks, plus an image of disk four that was nearly complete, were used to recreate the stripe. The filing deadlines were met.

19 bad sectors, not two dead drives6 days from arrival

MH · MHD-2026-6816ON RECORD ✓

A ProLiant, a dead UPS, and prompts nobody dared answer

A UPS power supply ran down before the mains returned and caused the Smart Array controller to ask questions that no one at the practice was willing to answer, and rightly so. Every member disk was duplicated prior to rebuilding the array. Metadata from the RIS was extracted and the delayed parity was taken into account, so the rebuild process ran on the duplicate images alone. The entire practice management database opened normally and was current up to the cache's last committed write.

Database came up clean5 days from arrival

MH · MHD-2026-6811ON RECORD ✓

Back from a 'repair' shop, the laptop had nothing of its owner's left

A student in Maidenhead was given the laptop back working perfectly, but on a brand-new and entirely empty disk installed by the repair shop. The original disk, which had been written off as dead, had been sitting in a drawer, still clicking away. We replaced the head assemblies with ones from a donor unit, and two days later every essay and photograph was waiting on the replacement disk installed by the shop.

100% recoveredAfter that 'repair'

MH · MHD-2026-6803ON RECORD ✓

Down at 9am on Monday, a Slough haulage firm was booking loads again by Thursday

What made this one awkward was the rebuild attempt someone had already made on the RAID under the booking system. Before anything else could be done to the RAID, every member drive was imaged, and the array was then reassembled virtually. A verified database went back into service by Thursday lunchtime, and the job was in the priority queue for the entire time.

Business back in 4 daysPriority job

MH · MHD-2026-6788ON RECORD ✓

A staircase, and a WD My Passport at the bottom

Nine days before the deadline for submission, the drive began to tick. Fitting a donor head stack, imaging the drive at a very low speed, and pulling the encryption keys from the bridge board allowed for the complete return of the thesis and references with a week left to go.

100% of the chapters72 hours spent at the bench

MH · MHD-2026-6785ON RECORD ✓

The rebuild that finished off a Wokingham mirror

While the two red lights presented issues, they were survivable. However, the rebuild attempted after these failures was not, because it wrote over the box's own metadata. Therefore we imaged both drives right through their bad sectors. Then, using whichever copy read more cleanly at each point, we rebuilt the mirror until the shared volume was whole again.

100% recovered5 days from arrival

MH · MHD-2026-6779ON RECORD ✓

An entire wedding on a card that showed nothing

By breakfast the next morning, the 512GB SanDisk that had held pictures from an entire wedding the previous evening was reading as empty. First we created a copy of everything on the card, then we rebuilt the file system on this copy, and finally we used a deep carve to gather up anything that was orphaned. All frames were recovered and the photographer was able to keep the client.

Every shot recovered48 hours spent at the bench

MH · MHD-2026-6770ON RECORD ✓

An iMac's Fusion Drive, failing across two weeks

A Fusion Drive combines an SSD with a hard disk, and in this case the hard disk was failing, taking the logical volume down with it. We imaged both of them, rebuilt the mapping that ties the two together, and were able to return ten years of a design studio's work from a Mac that the Apple Store had written off.

98% recovered5 days from arrival

MH · MHD-2026-6766ON RECORD ✓

Five years of teaching, on a laptop dropped before results day

The disk had started clicking, and the laptop itself was beyond repair. A donor head stack was placed into the drive, and after a slow imaging process, she had her five years of marking, reports and lesson plans recovered within three days.

100% of the owner's files3 days from arrival

MH · MHD-2026-6761ON RECORD ✓

Two dead heads between a family firm and fifteen years of records

Two heads had failed, and nothing inside the drive had turned for weeks. Once a donor head stack was installed, the first imaging pass took off 96% of the data, allowing all of the ledgers, invoices, and photographs to be restored with verification.

96% recovered4 days from arrival

MH · MHD-2026-6754ON RECORD ✓

An NVMe left unreadable by a stalled update

A firmware update failed part-way through the process and left the laptop's internal SSD containing the operating system unreadable. In technical mode, we rebuilt its translator tables, which allowed us to recover ten years of one photographer's edited catalogues in full.

99% recovered5 days from arrival

MH · MHD-2026-6748ON RECORD ✓

Second disk gone mid-rebuild; the factory ran on Monday

Production ceased when a Friday rebuild claimed a second member and locked away the live data. We imaged each disk individually. From the three that could be read cleanly, we reconstructed the stripe, and whatever information was recoverable from the fourth disk was also used. By Monday morning, production resumed.

100% of the vital files1 weekend

MH · MHD-2026-6743ON RECORD ✓

Seven years of accounts on a USB stick snapped underfoot

The tax return deadline loomed large. Unfortunately, the stick housing the CIS records and seven years' worth of invoices had been stood on in a site office until its connector came away. Due to its monolithic design, the test pads were the only way in; therefore, we mapped the controller pinout here first. Everything was filed on time.

100% recovered3 days from arrival

MH · MHD-2026-6652ON RECORD ✓

A burst pipe over a home office, and a wet drive that was never switched on

The drive was saved by nothing being turned on: it was put in a sealed bag while still damp and sent by post that very day. The contact points were then cleaned at our bench, and we installed a donor board with the ROM from the original. Lastly, the hard drive was completely duplicated using an imaging process within the week, and twenty years of family photographs came home.

100% recovered4 days from arrival

MH · MHD-2026-6647ON RECORD ✓

A photographer's whole archive, dropped at the venue

It was clicking by the first test on the bench, after going onto a hard floor while a wedding shoot was packed away. Three years of client work sat on it. A donor head stack went in, and two days of imaging left not one gallery missing, the morning's shoot among them.

99% recovered4 days from arrival

MH · MHD-2026-6642ON RECORD ✓

A Wokingham architect, locked out of their own workstation by a BIOS update

Because an overnight firmware update shifted the TPM measurements, the workstation woke asking for a recovery key nobody had ever written down. The Recovery Key ID led us to the practice's escrow in Entra ID, and repair-bde then rebuilt the damaged BitLocker metadata onto a clean disk. Not one project file was lost.

100% recovered3 days from arrival

MH · MHD-2026-6638ON RECORD ✓

A builders' merchant in Buckinghamshire, locked overnight

Nothing was encrypted where it lay. Each file was copied, the copy locked and the original deleted, so what mattered was still in free space waiting to be carved, and a NAS snapshot they had overlooked filled the gaps. Trading resumed inside the week, nothing paid and no one answered.

Running inside the weekNothing paid out at all

MH · MHD-2026-6633ON RECORD ✓

A 4TB archive drive, unplugged mid-write, came back RAW

One evening it came out of the socket mid-write, and by morning Windows would only offer to format it. The whole disk was imaged before anything else, and the boot sector and damaged MFT mirror were repaired on that copy alone. Fifteen years of client files went home with the folder structure still standing.

100% recovered3 days from arrival

MH · MHD-2026-6629ON RECORD ✓

One reinstall later, the family archive had been formatted

Nothing had been written to the disk after the mistake, and that is what saved it. Two identical 2TB disks sat in the one tower, and the fitter quick-formatted the family archive rather than the spare. The original file table survived, so every folder returned under its own name.

Full tree intact3 days from arrival

MH · MHD-2026-6624ON RECORD ✓

Twelve months of accounts, Shift+Deleted two days from payroll

Shift and Delete on the wrong folder took a year of bookkeeping off an office PC, bypassing the bin entirely. An image was taken the same afternoon, the file table rebuilt from that copy, and every name and date came back with it.

Full tree intact24 hours spent at the bench

MH · MHD-2026-6618ON RECORD ✓

One TVS diode gone, and a WD desktop drive stayed dark

An overnight outage took the board with it: the TVS diode shorted, which is precisely what that component exists to do. By morning there was no spin and nothing in BIOS. The ROM moved to a donor board and the disk imaged in full the day it was booked in.

100% imaged2 days from arrival

MH · MHD-2026-6611ON RECORD ✓

Five years of till records on a Seagate that clicked

Five years of EPOS data sat on a disk that ticked roughly once a second when it came in. Two donor head assemblies went in, the image was taken slowly over several days, and the shop's VAT return went off on time with the ledger complete.

97% recovered4 days from arrival

MH · MHD-2026-6563ON RECORD ✓

A haulier in Furze Platt, and a dashcam the driver had wiped

Overnight, the clip an insurer needed disappeared from a cab camera. The card was imaged first, and the image showed a deletion rather than an overwrite — which is the whole difference. Repaired and hashed, the footage went back within the week, and it answered the insurer and the HR file at once.

Camera video restored in fullSame-week bundle

MH · MHD-2026-6558ON RECORD ✓

A yard claim settled inside the week, on camera

By the time the insurer asked for proof of two vans meeting in a yard, the recorder had looped well past the date. The only copy had been an export a manager made and then deleted, and nothing of it survived elsewhere. That file was carved back off the disk, hashed, and set out in a short report; the claim closed without a hearing.

Claim backedCourt-ready bundle

MH · MHD-2026-6552ON RECORD ✓

Most of a wiped week back for a Bray farm shop

Four of the five lost days were still described in the recorder's index, timestamps intact, and the fifth came back through carving as playable video with no labels. What saved it was switching the recorder off that same afternoon, after a member of staff deleted a batch of 'old clips' — one of which held a theft.

4 of the 5 days, timestamps too72 hours spent at the bench

MH · MHD-2026-6546ON RECORD ✓

A shop in Maidenhead turned over, the DVR still looping

By the ninth day the recorder had been overwriting itself for days, and only then did the insurer ask. An image was taken, the recorder's index decoded, and the break-in lifted from sectors the loop had not reached. Two exports went back, one to watch, one for the claim.

The break-in window rebuilt3 days from arrival

MH · MHD-2026-6539ON RECORD ✓

A client list that left before the employee did

The uploads finished twenty days before the resignation letter arrived, which is what made the sequence so plain: documents pulled together in one place, a private cloud account signed in to, then the transfer itself. A Henley-on-Thames employer had only a rival's pitch deck to go on. It closed on undertakings.

Disposed of under undertakingsDated chronology built in 7 days

MH · MHD-2026-6534ON RECORD ✓

Two Buckinghamshire companies, one folder, one Part 35 report

Two companies, two sets of accounts that would not reconcile, and one folder missing between them. Neither version had come through the image untouched, and the timeline said as much in plain terms. Settlement followed within a month.

Disposed of post-exchangeCPR 35 compliant

MH · MHD-2026-6527ON RECORD ✓

A wiped laptop, and the quarter of an hour that decided it

A departing employee set a wiping tool running the evening before the laptop went back. It managed about fifteen minutes, and its own log came through in the image: when it began and which files it never reached. That was enough to set out the sequence.

Dated chronology rebuiltAnalysis by day 8

MH · MHD-2026-6521ON RECORD ✓

A Berkshire firm's project files, and where they went

The client was certain the files had been taken deliberately. The evidence pointed somewhere duller: a sync client set up wrongly had cleared them from the shared drive, and the greater part was recoverable. That answer closed the dispute faster than an accusation could have.

Dispute resolvedAnalysis back in 6 days

The complete list.

45 cases, anonymised and verified, each set out in full: what arrived, what depended on it, what we did with it, and what went home.

Yours could be the next entry here.

Each of these began the same way yours would: a diagnosis that costs nothing.

0800 6890668

Ask for a free diagnosis Posting it to us