Case File Library · Volume Forty

Cases 1951–2000

Volume Forty completes site eight, and closes a run of cases about the decisions people make before they know anything. A wedding photographer shooting to two cards at once discovers that redundancy protects against a card and not against the camera writing to both. A man replaces two failed drives in a four-bay unit and keeps the originals, which turn out to be the only place his files still exist. A consistency check refuses to run because the drive has stopped accepting writes — and that refusal is what saved the archive on it. Someone is told his drive has thirty thousand damaged sectors, a number that needs a denominator before it means anything. A backup that covered every photograph and none of the working documents. A camera card reformatted in error, whose recovered images render halfway down and then turn to a block of colour that marks exactly where the valid data stopped. At case 2000, a drive dropped at the weekend that ticks, falls silent after a minute, and appears to have recovered — and an owner who stopped testing it with nothing telling him to. Every case is a genuine enquiry, its identifying details changed or removed, its lesson kept whole. Every recovery names its instruments: the ACE Lab PC-3000 Express with Data Extractor and PC-3000 Flash with Spider Board, MRT Ultra, Atola TaskForce 2 and Atola Insight Forensic, DeepSpar USB Stabilizer 10Gb and RapidSpar, the Rusolut Visual NAND Reconstructor, Flash Extractor, Passware Kit Forensic, and OSForensics.