Diagnostic assessment for data recovery in Hawke's Bay

For Hawke's Bay, a New Zealand request begins by recording shock, moisture, power events and required data. Regional transport is planned after those risks are understood.

Request a quote

Case intake Gather the storage details, failure chronology, prior actions, encryption information and priority files.
Technical diagnosis Determine the physical and logical risks and select an acquisition approach suited to the medium.
Source protection Use protected images where possible to rebuild arrays, volumes and file structures outside the source.
Result validation Test representative priority data, describe incomplete results and prepare readable files on healthy storage.

data recovery laboratory — data recovery

Assess the fault before acting

A noisy hard drive, an SSD that is not recognised and a degraded RAID volume do not call for the same actions. The diagnostic assessment separates physical failure, logical corruption, encryption and combined incidents.

The timeline also helps assess the effect of a knock, power issue, deletion or rebuild that has already been started.

The timeline connects the last healthy use, first warning, regional transport and every later restart before the fault layers are classified.

Encrypted volume that no longer unlocks normally

Encrypted data becomes usable only when readable blocks, intact container metadata, and valid keys align.

TPM, boot, or controller faults can be mistaken for an incorrect passphrase.

Capture the medium, preserve key identifiers, and gather recovery material from authorised accounts. Strong encryption is not bypassed; the objective is to restore a legitimate unlock path.

Check business key escrow, personal account portals, and printed recovery copies before clearing trusted hardware, changing firmware, or reinstalling the original system.

For inter-island transport, keep the device unpowered and recovery-key records separate.

Preserve recovery keys and passphrases exactly as recorded
Avoid a TPM reset, operating-system reinstall or re-encryption
Note the device, user account and last successful unlock

Acquire evidence before reconstructing data

Where the medium remains stable enough, a controlled image provides a repeatable source for file-system work. RAID metadata, encryption keys, VM descriptors and recorder time settings are retained with it.

Reconstruction is performed on working material so a mistaken hypothesis does not rewrite the only remaining source.

Unstable ranges are read by priority, capturing structural metadata and essential folders first while gaps are logged rather than repeatedly forced.

Interrupted camera recording on a memory card

Interrupted footage can remain on a memory card even when its container will not open.

Many cameras write segmented video and finalize index data only when recording ends normally.

Safeguard the card from writes, reconstruct fragment order, and compare codec settings with a reference clip stored elsewhere. Verify the required time window after playback is restored.

For dashcam, trail-camera, or incident footage, retain the source card and document clock settings, recording mode, and the precise event period requested.

Remove the card and engage its write-protect switch where available
Decline repair or formatting prompts from the camera
Record the camera model, resolution, frame rate and time window

Make file checks reflect the case requirements

Describe required accounts, work folders, image dates, database tables or camera window. Priorities guide reads when a disk is unstable.

Keep enclosures, chargers, card adaptors, array logs and recovery keys. Decline resets, formats and in-place repairs.

Recovered documents, media and application data are sampled for opening, dates and consistency. Handover identifies gaps and partial content.

The stages of a defensible data recovery

A virtual disk is inseparable from its descriptors, extents, snapshots, and datastore allocation.

Replacement VMs and snapshot consolidation may consume blocks or metadata needed by the missing guest.

Preserve configuration first, rebuild dependencies on copies, and test essential guest files or databases. A boot screen alone is not sufficient validation.

Record datastore extents, hypervisor version, and snapshot parent identifiers. One incorrect dependency can present an older guest while hiding the latest application state.

Do not create a new VM or datastore on the affected storage
Preserve configuration files, descriptors and snapshot names
List critical guest data and the last known working state
Open priority samples and describe every material limit.

A practical brief for the diagnostic assessment

A tablet boot loop may come from board electronics, soldered flash, encryption, or system corruption.

Factory reset, update, and repeated restarts can overwrite user data on eMMC or UFS.

Document charging, impact, moisture exposure, accounts, and the last successful unlock. Verify authorised logical access before any lower-level acquisition.

Soldered storage normally depends on the original processor and security components, so replacing the board is not comparable to moving a removable card.

Do not approve a factory reset or operating-system reinstall
Record charging behaviour, impact, liquid exposure and last normal use
Keep the unlock code and legitimate account-recovery details available
Earlier restarts, scans, repairs or rebuilds.
Essential folders, formats and date ranges.
For arrays: bay order, alerts and encryption.

Data recovery laboratory — Hard Drive Recovery in an ISO 5 Clean Room

For media arriving from Hawke's Bay, essential folders, dates and access details are agreed before laboratory acquisition. The result is checked against those priorities and separates usable, partial and unavailable content.

Virtual recovery aligns datastores, VMDK or VHDX descriptors, snapshot chains, file systems and application data on working copies. This system-level reconstruction does not require opening a hard drive.

Hard Drive Recovery in an ISO 5 Clean Room

Assess mechanical warning signs without repeated power cycles

For Hawke's Bay, clicks, delayed spin-up, intermittent detection and read errors must be recorded together. The drive stays powered down until electronics, heads and platter condition can be assessed, and clean-room opening is considered only for confirmed internal mechanical damage.

The source is not repaired in place. A sector-level or device-appropriate acquisition is created where condition permits, and every read limitation remains logged for later reconstruction.

File systems, containers, arrays or application layers are analysed on a separate working copy. This prevents an incorrect assumption from changing the only available source.

FAQ

Frequently asked questions

Can media from Hawke's Bay be sent between islands for assessment?

Transport can be coordinated after review. Use confirmed case details, pack against movement and keep labelled array members together.

What should happen after moisture or earthquake shock?

Disconnect power safely, leave the device closed and record the event. Avoid heat, rice, hard-drive opening or another test startup.

Can an encrypted drive be recovered without its key?

Properly implemented strong encryption cannot realistically be bypassed. All legitimate key sources should be checked before technical work continues. Preserve escrow identifiers before changing trusted security hardware.

Why will a visible video file not play after the camera lost power?

The container may not have been finalised or video fragments may be missing. Playability and timeline continuity must be reconstructed and checked separately. Compare the requested interval with camera clock drift.

Should an orphaned virtual disk be attached directly to a new VM?

Not from the original storage. Mounting can write metadata; secure dependencies and a read-only image before testing an attachment. Map datastore extents and snapshot parents before attachment.

Will a factory reset help a tablet that is stuck in a boot loop?

A reset is intended to return the device to use and can erase user data. It should not be performed when the priority is data recovery. Keep authorised unlock and account-recovery details available.