Case Studies

Case Study 1: IBM RAID Server Not Booting

Client Issue

An IT Director arrived on a Friday morning to find that a critical IBM RAID server would not start. The system was hanging on the initial boot screen and repeatedly failed to progress any further.

On entering the RAID SCSI configuration utility, he noted that Disk 1 in a 6-disk array was showing as failed. The server hosted live business data and there was no recent backup of the affected array.

In an attempt to restore service, the failed disk was replaced and a RAID rebuild was initiated. The rebuild process, however, aborted at 58%, leaving the volume inaccessible and the system still unable to boot.

Technical Assessment

This scenario is typical of a degraded RAID array where:

• One disk has failed and been replaced;

• A rebuild is attempted while another disk is marginal or beginning to fail; or

• Parity information has become inconsistent due to the partial rebuild.

A failed or incomplete rebuild can corrupt parity, logical block addressing and stripe order, meaning that any further attempts to rebuild or reinitialise can permanently damage the logical structure of the array.

Our Recovery Process

1. Drive intake and documentation
   The IT Director contacted us at 1pm. The drives were delivered to our Edinburgh facility by 2pm the same day. All six disks were individually labelled, catalogued and write-protected.

2. Non-destructive imaging of all working members
   Rather than working on the live disks, our engineers imaged the five remaining operational drives using dedicated hardware imagers capable of handling unstable sectors and degraded media.

   • Each drive was cloned sector-by-sector to a controlled storage environment.

   • Any weak areas were handled using read-retry, head-map and time-limited reading strategies to maximise data capture while preventing further physical degradation.

3. Virtual RAID reconstruction
   Using the images, we reconstructed the RAID virtually, rather than on the original hardware. This involved:

   • Identifying the RAID level (e.g. RAID 5 or RAID 6),

   • Determining stripe size, block order, parity rotation and disk order,

   • Analysing metadata and parity to correct for the interrupted rebuild and restore a consistent view of the array.

4. File system repair and data extraction
   Once the virtual RAID volume was rebuilt, we mounted the logical volume in a controlled environment and:

   • Scanned for file system inconsistencies,

   • Repaired corrupt metadata structures,

   • Verified directory trees and file references,

   • Extracted the full data set to a separate, stable storage platform ready for return to the client.

Outcome

All business-critical data was successfully recovered. The complete dataset was returned to the client in time for the start of business on Monday morning, minimising operational downtime.

Unlike many companies, we do not perform recovery work on live disks. We always work from full forensic-grade images, ensuring your original media remains untouched once imaged.

Case Study 2: LaCie Big Disk – External Drive Not Recognised

Client Issue

A professional photographer relied on a 2TB LaCie Big Disk external drive to store all client photographs from the last four years. The drive contained multiple recent weddings, including four shoots from the previous week that were time-critical for delivery.

When the drive was connected to the computer, there were no power LEDs, no spin-up noise and no detection by the operating system. Over the phone, our engineers suspected an electronic fault affecting either the external enclosure, the interface bridge board, or the internal drive electronics.

Technical Assessment

LaCie Big Disk units often contain one or more internal SATA drives connected via a proprietary interface/bridge board (frequently configured as JBOD or RAID0). A failure can occur at several levels:

• External power supply or voltage regulation,

• USB/FireWire/Thunderbolt bridge electronics,

• Internal drive PCB and firmware,

• Less commonly, mechanical damage inside the drive itself.

In this case, we anticipated a PCB or enclosure-level electronics failure preventing the disk from initialising.

Our Recovery Process

1. Initial electronic diagnostics
   On arrival, the unit was tested with a known-good power supply and diagnostic tools to confirm that:

   • The enclosure electronics had failed, and

   • The internal drive(s) were not spinning up under normal conditions.

2. Controlled disassembly and drive isolation
   The LaCie enclosure was carefully opened and the internal hard drive(s) were removed. We then:

   • Connected each drive directly to our specialist imaging systems, bypassing the LaCie bridge board,

   • Checked for PCB-level faults, firmware corruption and any abnormal power draw.

3. Electronics and firmware remediation
   We identified an electronic fault and carried out:

   • PCB replacement or repair (as appropriate),

   • Firmware alignment to ensure the replacement electronics remained fully compatible with the drive’s service area and adaptive data.

4. Sector-by-sector imaging
   The repaired drive was then imaged:

   • Full binary sector-by-sector imaging was performed to our secure server,

   • Weak or damaged sectors were handled with controlled read-retry procedures, ensuring maximum data capture.

5. Data reconstruction and verification
   Once the image was complete:

   • The file system was scanned and reconstructed,

   • All photo folders were checked for structural integrity,

   • Sample files from each shoot were opened to verify data quality.

Outcome

100% of the photographer’s data was successfully recovered. All files were copied to a new portable hard drive and returned to the client.

We then provided free advice on setting up a robust, multi-tier backup strategy (on-site plus off-site) to reduce the risk of similar incidents in the future.

This case was completed within 24 hours. Our engineers have over 25 years’ specialist experience recovering data from external hard drives and multi-disk external units.

Case Study 3: MacBook Only Booting to Question Mark Folder

Client Issue

A university student’s MacBook would only boot to the flashing question mark folder icon, indicating that the system could not find a valid startup disk.

The student brought the machine to the Apple Store Genius Bar, where the internal drive was tested and diagnosed with a physical hard drive failure. Apple replaced the internal drive to restore the MacBook’s functionality but were unable to recover any data from the original failed disk. The student then brought the failed drive to our Edinburgh lab.

Technical Assessment

A Mac displaying a question mark symbol typically suggests:

• The start-up volume cannot be found,

• The internal drive is no longer being detected properly, or

• The file system is so severely damaged that macOS cannot mount it.

Our initial diagnostics indicated a read/write head failure – a common mechanical fault where the heads can no longer reliably read data from the platters, resulting in repeated click noise, timeouts or non-detection.

Our Recovery Process

1. Mechanical diagnostics and confirmation
   We connected the drive to our diagnostic platform and confirmed:

   • The drive was not initialising correctly,

   • SMART attributes indicated serious read errors,

   • Behaviour was consistent with failing or failed read/write heads.

2. Head assembly replacement
   The student chose our standard service option. Our engineers:

   • Matched a compatible donor drive of the same model and microcode,

   • Transferred the read/write head assembly from the donor into the patient drive under controlled conditions,

   • Performed alignment checks to ensure the new heads could properly access the drive’s system area and user data.

3. Full forensic imaging
   Once the drive was stabilised:

   • We performed a full sector-by-sector image of the disk to our secure server,

   • Any marginal regions were treated with adjusted read parameters and retry limits to maximise recovery.

4. Mac file system reconstruction and data extraction
   The image was then mounted for logical recovery:

   • The Mac file system (HFS+ / APFS, depending on the model) was scanned for volume and catalog corruption,

   • The directory structure was rebuilt where necessary,

   • All user data – including documents, coursework, and personal files – was extracted.

5. Data delivery
   The recovered data set was written to an external hard drive as requested by the client, allowing easy use on the replacement drive in the MacBook.

Outcome

We successfully recovered 100% of the data from the failed MacBook drive. The entire process, from head swap to final extraction, was completed within 48 hours.

We work to some of the fastest realistic turnaround times in the UK, without compromising on the thoroughness of our diagnostic and imaging procedures.