Case Studies

Case Study 1 — Dell XPS Desktop (HDD shows RAW)

Intake symptoms

• Windows reported the system volume as RAW and prompted to format.

• Drive spun inconsistently; occasional soft beeps followed by spin-down.

Technical diagnosis

• Drive family identified via terminal/ID; SMART readable only intermittently.

• 12 V inrush within spec; 5 V rail stable; PCB TVS and motor driver OK (no cooked ICs).

• Vibration/accel trace showed no stable RPM lock—classic spindle/motor fault (stiction or seized hydrodynamic bearing).

• Service Area (SA) modules unreadable due to non-rotation; hence the OS sees an unmountable/RAW device. The RAW symptom was secondary to a hardware fault (not a pure filesystem issue).

Lab actions

1. HDA mechanical work

   • Heads parked off-platter; verified no gross head damage.

   • Spindle/motor swap: moved the entire platter stack to a matched donor base using a concentric platter-locking jig (maintains servo alignment and axial spacing).

   • Donor chosen by microcode match, DCM/WWN family, head map; pre-fit runout and tilt checked.

2. Electronics/firmware alignment

   • Original PCB retained; ROM/NVRAM (adaptive parameters) confirmed.

   • SA modules read on the donor base; translator verified; defect lists loaded.

3. Forensic imaging

   • Imaging with PC-3000 in head-mapped mode; weak head throttled with reduced seek amplitude.

   • Multi-pass: fast linear for good regions → reverse pass for slow/bad zones → targeted retries over metadata extents (MFT, $LogFile).

   • Persistent error map maintained; no writes to original media.

4. Logical reconstruction

   • NTFS: Boot sector compared to mirror; $MFT rebuilt using $MFTMirr and $LogFile replay.

   • Recovered folder structure containing DWG/DXF/RVT (AutoCAD/Revit) plus PDF deliverables.

Outcome

• 99.6% LBA imaged; all architect project folders verified (opened in AutoCAD/Revit).

• SHA-256 manifest provided; triage report documented motor failure and RAW as a downstream effect.

Case Study 2 — Seagate Expansion Portable 5 TB (slow/open-copy failures)

Intake symptoms

• Extremely slow enumeration; copying stalls at a few MB then times out.

• The client’s workload: Adobe InDesign packages (.INDD/.IDML, linked assets on exFAT/NTFS).

Technical diagnosis

• Drive identified as Seagate 5 TB 2.5″ SMR (Rosewood family, ST5000LM00x)—15 mm height, shingled media.

• SMART showed elevated UNC and pending sectors; terminal logs indicated repeated read channel timeouts and background processes thrashing (SMR GC).

• Head performance test: one weak head with high soft-ECC, causing massive latency and retries—root cause of the “takes too long” symptom.

Lab actions

1. Pre-imaging firmware prep (Seagate utility)

   • Disabled background media scan and relocation; set conservative timeouts and queue depth = 1 to avoid thrash on SMR zones.

   • Captured SA modules and adaptives; saved translator.

2. Head-stack replacement

   • Donor HSA matched by family, head map, micro-jog parameters.

   • Swap performed with head combs; sliders/flex bonded; preamp bias checked.

   • Post-swap, recalibrated adaptives; verified clean SA reads.

3. SMR-aware imaging

   • PC-3000 + DeepSpar: outer cylinders first (best SNR), then long sequential passes through shingled zones.

   • Reverse pass over slow areas; targeted retries on file system metadata and InDesign package directories.

   • Error map persisted; no relocation allowed on the patient.

4. Filesystem & file validation

   • Volume mounted from the clone (read-only).

   • Verified .INDD/.IDML open in InDesign; checked linked /Links assets (TIFF/JPEG/AI/PSD).

   • Restored directory timestamps; produced manifest.

Outcome

• 100% logical recovery (minor unreadables confined to unallocated space).

• Delivered on encrypted external SSD with hash list and an imaging report noting weak head + SMR latency as the combined failure mode.

Case Study 3 — Synology “DS223j” (client label) — 4-disk RAID 5 with I/O errors

Note: The DS223j chassis is a 2-bay model. The four disks we received carried Synology mdadm metadata from a larger chassis. We treated it as a 4-member mdadm RAID 5 set imaged on our bench (not in the original enclosure).

Intake symptoms

• NAS reported I/O device errors to clients; two drives flagged as “degraded/abnormal”.

• A local IT firm attempted recovery; array would not assemble.

Technical diagnosis

• Per-disk tests:

  • Disk 2: severe read instability; numerous UNC clusters; weak heads.

  • Disk 4: non-spinning; spindle seizure (bearing lock), no SA access.

  • Disks 1 & 3: readable with scattered pending sectors.

• mdadm headers indicated RAID 5, left-symmetric, 64 KB chunk, standard superblock.

• Filesystem layer: btrfs with multiple subvolumes (typical for Synology).

• This is a “two-down” RAID 5 condition—unmountable without physical remediation of at least one failed member.

Lab actions

1. Mechanical remediation (2 members)

   • Disk 4 (seized spindle): Platter stack transplant to a matched donor base (concentric alignment fixture); original HSA retained after inspection; SA accessible post-swap.

   • Disk 2 (weak heads): Head-stack replacement with donor HSA; adaptives re-learned; SA verified.

2. Forensic imaging (all members)

   • Each disk imaged independently with head-mapped strategies; error maps preserved.

   • For disks 1 & 3, we prioritised regions overlapping btrfs metadata and recent snapshots.

   • Unreadable sectors were left as gaps (no write-back to patients).

3. Virtual RAID reconstruction

   • Rebuilt the array virtually from the four images; validated member order, chunk size, and parity rotation by XOR tests over directory blocks.

   • Resolved half-stripe/torn writes caused by the prior IT attempts using majority logic and btrfs tree checks.

4. Filesystem repair & extraction (btrfs)

   • Reconstructed chunk tree, root tree, extent tree; selected the newest consistent transaction ID (transid).

   • Mounted the reconstructed image read-only; exported shares (project, render, and archive).

   • Verified large video assets (the client’s deliverables) and CAD/print assets where present.

Outcome

• Full logical recovery of active shares; a small number of files in a stale snapshot had partial damage matching unreadable gaps in Disk 2’s error map.

• Turnaround under 48 hours once parts arrived; engineering report included: SMART/terminal captures, mdadm geometry, btrfs tree summary, and SHA-256 manifest.

Notes on methodology

• We never run filesystem repair on original media—only on cloned images.

• For mechanical work (head/spindle/platter operations), we maintain servo alignment and adaptive parameter continuity (ROM/NVRAM/SA).

• For arrays, we reconstruct geometry off-host (order, chunk, parity rotation) and let the filesystem’s own structures (MFT/superblocks/btrfs trees) validate the build.

• Deliverables include a hash manifest, a concise engineering report, and sample-open verification of the client’s priority files.