Case File Library · Volume Thirty-Eight

Cases 1851–1900

Volume Thirty-Eight closes site eight’s middle stretch, and it is largely about what people decide to do next. A man moves his photographs to a new drive and deletes the originals days before it fails. Another formats the wrong drive and runs a deep scan that finds nothing — which on solid-state media may be an accurate answer rather than an inadequate search. A rebuild is started on an array whose second member was already unreliable. Set against those are the people who stopped: the owner who removed a laptop’s battery within moments of a spill, the one who deleted the wrong images and simply did not touch the card again, the one who recalled a drive before any work began. Several cases answer with a plain no, and several correct a verdict someone else gave — including a shop’s report that data was visible but unreadable, which describes where a recovery starts rather than where it ends. At case 1900, a drive that failed a quarter of a century ago and was never opened, kept on a shelf against a day its owner could not know would come. Every case is a genuine enquiry, its identifying details changed or removed, its lesson kept whole. Every recovery names its instruments: the ACE Lab PC-3000 Express with Data Extractor and PC-3000 Flash with Spider Board, MRT Ultra, Atola TaskForce 2 and Atola Insight Forensic, DeepSpar USB Stabilizer 10Gb and RapidSpar, the Rusolut Visual NAND Reconstructor, Flash Extractor, Passware Kit Forensic, and OSForensics.