Case File Library · Volume Thirty-Nine

Cases 1901–1950

Volume Thirty-Nine is largely about decisions made by somebody, or something, other than the owner. A computer runs a consistency repair on a damaged drive by itself at the next start-up, before anyone can decline. A camera meeting an unfamiliar card builds its own folder structure over the one already there. A transfer stops when the destination fills up, and files vanish from the source instead — because what ran was a move rather than a copy. An organisation cannot produce the recovery key for its own encrypted machine. A relative tests a drive with a substitute circuit board and reaches a confident conclusion the test could not support. Against those sit the people whose instincts were right: the owner refused writes by a system that had quietly decided her volume was unsafe to write to, the administrator who checked which data chunks were genuinely unreplicated before assuming the cluster held another copy, the man who took his drive out of its enclosure and eliminated the commonest cause in one step. Several cases answer by pointing somewhere cheaper — to a software licence, to an employer's backup, to an escrowed key an IT department had not thought to look for. At case 1950, a drive repaired without being asked. Every case is a genuine enquiry, its identifying details changed or removed, its lesson kept whole. Every recovery names its instruments: the ACE Lab PC-3000 Express with Data Extractor and PC-3000 Flash with Spider Board, MRT Ultra, Atola TaskForce 2 and Atola Insight Forensic, DeepSpar USB Stabilizer 10Gb and RapidSpar, the Rusolut Visual NAND Reconstructor, Flash Extractor, Passware Kit Forensic, and OSForensics.