Case File Library · Volume Forty-Three

Cases 2101–2150

Volume Forty-Three continues site nine and its subject: what a single observation establishes. A cracked disc holds house documents whose only other copies a solicitor deleted. A drive destroyed by the wrong power supply, where the smoke was the protection working exactly as designed. A console hard drive in perfect health that will never give up a file, because the key lives in the broken machine beside it. A folder whose name survived while the list it pointed to did not. Indicators flashing in unison because a controller took them over to say it could not find a drive. A card formatted in a camera, where the owner had worked out the right question and drawn the wrong conclusion from it. A backup that could not restore a system and could still be read file by file. And at case 2150, two absences in one enquiry meaning opposite things — no signs of failure, which rules things out and proves nothing, and a device that stopped existing partway through a write, which proves a great deal. Every case is a genuine enquiry, its identifying details changed or removed, its lesson kept whole. Every recovery names its instruments: the ACE Lab PC-3000 Express with Data Extractor and PC-3000 Flash with Spider Board, MRT Ultra, Atola TaskForce 2 and Atola Insight Forensic, DeepSpar USB Stabilizer 10Gb and RapidSpar, the Rusolut Visual NAND Reconstructor, Flash Extractor, Passware Kit Forensic, and OSForensics.