Case File Library · Volume Forty-Two

Cases 2051–2100

Volume Forty-Two continues site nine and its subject: what a single observation establishes. A man runs five recovery programs and gets nothing from any of them, which is one method tried five times rather than five results. A drive lists its folders happily and stops spinning the moment one is opened — and stopping is the finding, because a drive that merely cannot read keeps turning. Water reaches a drive while it is switched off, which is the most favourable detail a liquid case can carry. A camcorder moves footage to a card, writes nothing and deletes everything. Discs recorded at home read as blank because they were never closed. An owner asks whether recovery can be done without anyone reading her files, and the answer is structural rather than a promise. And at case 2100, a dropped drive with a small piece missing from its socket — one detail that fully explains the fault and equally suggests something far worse, where the test that would tell them apart is the one that is unsafe under half the possibilities. Every case is a genuine enquiry, its identifying details changed or removed, its lesson kept whole. Every recovery names its instruments: the ACE Lab PC-3000 Express with Data Extractor and PC-3000 Flash with Spider Board, MRT Ultra, Atola TaskForce 2 and Atola Insight Forensic, DeepSpar USB Stabilizer 10Gb and RapidSpar, the Rusolut Visual NAND Reconstructor, Flash Extractor, Passware Kit Forensic, and OSForensics.