Diagnostic assessment for data recovery in the Bay of Plenty
For a data recovery request from the Bay of Plenty, the first useful decision is whether the device can be read safely at all.
- Case intake Gather the storage details, failure chronology, prior actions, encryption information and priority files.
- Technical diagnosis Determine the physical and logical risks and select an acquisition approach suited to the medium.
- Source protection Use protected images where possible to rebuild arrays, volumes and file structures outside the source.
- Result validation Test representative priority data, describe incomplete results and prepare readable files on healthy storage.
Assess the fault before acting
A noisy hard drive, an SSD that is not recognised and a degraded RAID volume do not call for the same actions. The diagnostic assessment separates physical failure, logical corruption, encryption and combined incidents.
The timeline also helps assess the effect of a knock, power issue, deletion or rebuild that has already been started.
The timeline connects the last healthy use, first warning, regional transport and every later restart before the fault layers are classified.
A server or virtual workload lost after storage failure
Protect the underlying disks before rebuilding services on top of an uncertain datastore.
A server outage may originate in the array, datastore, virtual disk, guest file system or application database.
Create a map of physical storage, RAID or SAN configuration, hypervisor, virtual disks, encryption and backup points. The recovery objective can then be narrowed to the business-critical database, file share or virtual machine and its required date, rather than a blind copy of the entire environment.
- Pause automated boot, replication, repair and snapshot-merge tasks.
- Preserve logs and configuration separately if that can be done without stressing the source.
- Confirm the priority service and the last independently verified backup.
Acquire evidence before reconstructing data
Where the medium remains stable enough, a controlled image provides a repeatable source for file-system work. RAID metadata, encryption keys, VM descriptors and recorder time settings are retained with it.
Reconstruction is performed on working material so a mistaken hypothesis does not rewrite the only remaining source.
Unstable ranges are read by priority, capturing structural metadata and essential folders first while gaps are logged rather than repeatedly forced.
A surveillance recorder missing the required footage
Recorder disks, channel metadata and the local clock all contribute to a usable video result.
An NVR may lose access after disk errors, a reset or accidental setup, while continuous recording can progressively overwrite an older incident.
Preserve the recorder model and bay order and note the camera, displayed time zone and exact period sought. Any recovered sequence should be tested for playback, continuity and correct channel and time, with gaps reported rather than concealed in a total file size.
- Stop recording before the target period leaves the retention window.
- Photograph the disk order, camera labels and displayed date and time.
- Set the smallest practical incident window for each relevant channel.
Make file checks reflect the case requirements
Describe required accounts, work folders, image dates, database tables or camera window. Priorities guide reads when a disk is unstable.
Keep enclosures, chargers, card adaptors, array logs and recovery keys. Decline resets, formats and in-place repairs.
Recovered documents, media and application data are sampled for opening, dates and consistency. Handover identifies gaps and partial content.
The stages of a defensible data recovery
Contamination and power are a dangerous combination even after visible moisture disappears.
Floodwater, sea spray and drinks leave salts or residue that can corrode boards and bridge fine contacts.
Remove power safely and record what liquid reached the equipment and whether it was operating. Different media require different cleaning and assessment; heating, shaking or opening a hard drive can add damage rather than remove contamination.
- Keep batteries, USB and mains power disconnected.
- Do not use rice, an oven, a heat gun or direct sun.
- Note the liquid type, duration, power state and any drying already attempted.
- Separate physical, electronic, array and logical faults.
A practical brief for the diagnostic assessment
Avoid new writes and preserve the incident record before trying to restore normal operation.
Deleted files are not necessarily erased immediately, but updates, sync clients, downloads and locally installed recovery tools can reuse their space.
Ransomware cases need containment as well as data assessment. Isolate affected systems and shared storage, retain encrypted copies, notes and logs, and follow the organisation's response process. Verified backups and the exact encryption and overwrite state determine options; a generic promise would be misleading.
- Stop using the affected disk, share or virtual volume.
- Contain ransomware systems without deleting evidence or reformatting them.
- List affected data, the first observed time and known-good backup points.
- Precise warning, noise or detection behaviour.
- Last healthy use and incident sequence.
- Earlier restarts, scans, repairs or rebuilds.
Data recovery laboratory — Hard Drive Recovery in an ISO 5 Clean Room
For media arriving from the Bay of Plenty, essential folders, dates and access details are agreed before laboratory acquisition. The result is checked against those priorities and separates usable, partial and unavailable content.
A reconstructed virtual disk is not automatically a working service. Validate sample files, database consistency, expected dates and application exports, while recording missing snapshots, keys and unresolved corruption.
Define the required period and verify playable or readable content
For the Bay of Plenty, required dates, channels, time zone, format, controller and overwrite risk are fixed before acquisition. Containers, indexes and structures are preserved, then representative media are opened rather than judged by names or thumbnails alone.
The source is not repaired in place. A sector-level or device-appropriate acquisition is created where condition permits, and every read limitation remains logged for later reconstruction.
File systems, containers, arrays or application layers are analysed on a separate working copy. This prevents an incorrect assumption from changing the only available source.
The result is checked by opening priority documents, media, archives or application data and comparing them with known dates and structures.
FAQ
Frequently asked questions
Can media from the Bay of Plenty be sent between islands for assessment?
Transport can be coordinated after review. Use confirmed case details, pack against movement and keep labelled array members together.
What should happen after moisture or earthquake shock?
Disconnect power safely, leave the device closed and record the event. Avoid heat, rice, hard-drive opening or another test startup.
Can a datastore be repaired in place to bring servers back quickly?
An in-place repair changes metadata and may sacrifice an alternative reconstruction path. Preserve the original state before repair is considered.
Does exporting other footage help test a damaged NVR?
It also keeps the recorder writing and reading. When overwrite risk or disk instability exists, preserve the target window before attempting routine exports. Note channels, clock offset and the recorder's export format.
Is salt-water exposure different from fresh water?
Yes. Salt is highly conductive and corrosive, but every liquid incident still needs the media to remain unpowered until its condition is assessed.
Will reinstalling the operating system help after ransomware?
It may overwrite recoverable data and destroy incident evidence. Preserve the affected storage before rebuilding systems on separate healthy media.
Diagnostic assessment
Unsure about a storage device or fault?
Datastrophe assesses the risk before any recovery attempt and points you towards the safest next step.