Case File Library · Volume Forty-One

Cases 2001–2050

Volume Forty-One opens site nine, and a run of cases about what a single observation establishes. The remaining enquiries in this archive are short — a device, a symptom, and one other detail — so each case here takes that one detail and works out what it proves, what it does not, and where it misleads. A man reasons that because nothing happened to his drive, recovery should be easy: the first half is sound and the second does not follow. Someone opens an enclosure and finds the connector soldered straight to the drive, which eliminates the cheapest repair in one look. A drive reports a capacity hundreds of times too small, which makes every recovery tool useless without anyone realising why. A wedding photographer shooting to two cards at once discovers that redundancy protects against a card and not against the camera. An answering machine reports that it is empty, and is reporting its own counter. A recorder's clock resets to 1970 and files a day of footage under a date the calendar cannot reach. And at case 2050, a man blames a system update for a slowdown it did not cause, acts on it anyway, and gets part of his data out before the drive stops answering. Every case is a genuine enquiry, its identifying details changed or removed, its lesson kept whole. Every recovery names its instruments: the ACE Lab PC-3000 Express with Data Extractor and PC-3000 Flash with Spider Board, MRT Ultra, Atola TaskForce 2 and Atola Insight Forensic, DeepSpar USB Stabilizer 10Gb and RapidSpar, the Rusolut Visual NAND Reconstructor, Flash Extractor, Passware Kit Forensic, and OSForensics.