Case File Library · Volume Thirty-Seven

Cases 1801–1850

Volume Thirty-Seven continues site eight’s question — what you decide before you know — and finds it most often decided by accident. A man asks a repairer to fix a power supply, which is done correctly, and the drive clicks afterwards; nobody was asked whether powering it was wise. A machine performs an automatic shutdown nobody scheduled and takes a stick with it. A clean installation carried out with the drives safely disconnected removes the description that made them readable. A card is wiped and used again on the assumption a transfer had completed. Alongside them are the observations that separate one fault from another: a dim indicator that is a measurement rather than an impression, a sound correlated with a read rate falling to zero, a write error that arrives before the read failure and describes the same decline, and errors that differ file by file and therefore mean part of the drive is fine. Two cases answer with a plain no — a laptop refusing a password after an update disturbed the component holding its key, and a drive returned after four head replacements nobody authorised. At case 1850, the repair that succeeded at exactly what it was asked to do, and the discipline that follows from it: not avoiding the first power-up but preparing it, because a failing drive gives one good session and the question is whether you are ready to spend it. Every case is a genuine enquiry, its identifying details changed or removed, its lesson kept whole. Every recovery names its instruments: the ACE Lab PC-3000 Express with Data Extractor and PC-3000 Flash with Spider Board, MRT Ultra, Atola TaskForce 2 and Atola Insight Forensic, DeepSpar USB Stabilizer 10Gb and RapidSpar, the Rusolut Visual NAND Reconstructor, Flash Extractor, Passware Kit Forensic, and OSForensics.