Case studies

Simultaneous failure of 2 disks in a RAID 5 holding historical transactional data.

We gave them a fixed quote up front and handled the case with full confidentiality; the bank simply waited for the result.

99.7% of data recovered in 4 days. Forensic report delivered for internal audit.

Synology DS1815+ NAS with volume error after a power outage. Degraded RAID 5.

The studio handed us the equipment and we took care of everything, with clear reports at every stage.

8 months of audiovisual projects recovered at 100%. 7 TB of material delivered on external disk.

Server encrypted by LockBit 3.0. 480 GB of sensitive legal documents.

We handled the case with the utmost discretion and without paying any ransom; the firm received clear progress reports.

85% of files recovered without paying ransom. Forensic report for legal proceedings.

RAID 6 corrupted after a failed rebuild. 4.5 TB of DICOM patient studies.

We treated the case as a priority with confidential handling of sensitive patient data; the hospital simply awaited delivery.

100% of DICOM studies recovered in 6 days. HIPAA-equivalent DR compliance maintained.

BlackBerry Bold 9900 stored in a drawer for over 8 years. Will not power on. Customer needed to recover unique family photos and contacts.

The customer just brought us the phone and we gave a fixed quote; we accompanied them warmly given the family memories involved.

Photos, videos, contacts, and BBM messages recovered at 95%. Delivery on USB organized by category.

HDD with progressive bad sectors on a partner's laptop. BitLocker volume will not mount. Customer has the 48-digit recovery key.

We handled the case with full confidentiality and reported honestly what was intact and what was not; the firm just waited for the result.

92% of firm files recovered. Critical case documents intact. Report listing which files remained partially corrupted.

Research department server holding 12 years of master's, doctoral theses and academic publications. After a power outage, RAID 10 lost 2 disks and ext4 filesystem marked dirty.

The university handed us the server and we took care of everything, with a clear quote and reports at every stage of the work.

100% of academic corpus recovered. 5 TB delivered on external disk organized by original folder. Zero corrupted files.

Municipal surveillance DVR with HDD that stopped recording after months of 24/7 use. Unit reports 'no disk'. Recordings from 3 specific days needed for administrative investigation.

We handled the case discreetly with a documented chain of custody, delivering exactly the recordings from the requested days.

Recordings of the 3 requested days fully recovered. Delivered with documented chain of custody for the administrative file.

Accountant partner's laptop fell. NVMe SSD no longer detected by BIOS. Contains accounting books, ITBIS and income tax filings of several clients. Disk with OS-native encryption.

We gave a fixed quote and handled the clients' accounting data with full confidentiality; the firm kept its monthly close running.

100% of accounting books and filings recovered. Current fiscal period saved. Client continued monthly close uninterrupted.

SDXC card stopped responding mid-shoot for a commercial. Camera reports 'damaged card'. Content: 4 hours of 4K footage that cannot be re-shot (location closed, talent unavailable).

We handled the case with priority and discretion; the production company got its footage back in time to deliver the commercial.

100% of 4K footage recovered and editable. Commercial delivered on time to the client.

Main project server SAS HDD clicks and is not detected. Contains AutoCAD and Revit drawings of 18 active jobs, including MOPC committed deliverables.

The construction firm just handed us the equipment and we took care of everything; it met its committed deadline on time.

98% of drawings recovered. Zero critical files lost. MOPC delivery met on time.

Regional corporate client shipped from Miami via DHL an 8 TB external HDD that does not power on after a flight. Holds consolidated regional accounting backups. Local Miami option quoted 4 weeks; +DR quoted in 24h.

We quoted within 24h and coordinated all shipping both ways; the client just sent the drive from Miami and waited for the result.

100% of 8 TB recovered in 12 days, half the time quoted by Miami providers. Return shipping coordinated via DHL.

Core switch of a regional ISP failed after a power surge. Unit will not boot and holds VLAN, ACL and customer mapping config not backed up off-box.

We handled the case as a priority given its operational urgency; the ISP just handed us the unit and received its configuration ready to use.

Full configuration recovered and delivered as plain text. ISP restored operation on replacement hardware in less than a day.

Retail SMB with Windows server encrypted by Phobos. Client refuses to pay ransom. Suspected orphan backups exist on an undocumented secondary partition.

We handled the case discreetly and without paying any ransom, with honest scope reports; the SMB resumed invoicing quickly.

70% of operational data recovered without paying attacker. Client resumed invoicing in 2 days with discovered backup.

Mac mini M1 no longer powers on. SSD is not removable (NAND soldered directly on board). Contains software projects with local repos not synced to remote.

The client just brought us the machine and we gave a clear quote; he got his projects back, delivered ready on an external disk.

100% of projects and dev environment configuration recovered. Client received external disk with full clone of Mac state.

RAID 10 lost both disks of the same mirror during operation. Oracle 19c tablespaces with active policies became inaccessible.

We handled the case with full confidentiality and a fixed quote; the insurer simply waited for the verified result.

98% of datafiles recovered. Policies and last-year movements intact. Delivered in 9 days.

ZFS pool marked FAULTED after abrupt outage during scrub. Vessel docs, customs manifests and load plans inaccessible.

The shipping company handed us the equipment and we took care of everything, with clear reports; it recovered its full critical documentation.

100% of critical datasets recovered. 3 historical snapshots rescued. 11 days.

PMS and bookings database encrypted by BlackCat. Attackers demanded Monero ransom. Offsite backups 11 days stale.

We handled the case discreetly and without paying any ransom; the hotel resumed operations with our clear scope reports.

82% of bookings and check-ins recovered without paying ransom. Operations resumed in 6 days.

ERP VM encrypted by REvil inside ESXi. Snapshots also encrypted via privilege escalation.

We handled the case discreetly and without paying any ransom, with honest scope reports; the company brought its operations up to date.

75% of ERP data recovered. Inventory and accounts receivable up to date. 10 days.

Voltage spike burned the drive PCB. Drive-specific firmware ROM partially readable. Disk held digitized tape backups.

We gave a fixed quote and handled the case with full confidentiality; the bank simply waited for the verified result.

100% of disk imaged. Backups recovered with no loss. 5 days.

NVMe SSD no longer detected by BIOS. Holds clinical records and DICOM radiographs of last quarter, unbacked.

We handled the case as a priority with confidential handling of clinical data; the clinic just handed us the unit and awaited delivery.

96% of clinical files recovered, including DICOMs. 12 days.

Three disks of the same Seagate Constellation ES.3 batch entered BSY state simultaneously due to known firmware bug. RAID 6 inoperative.

We handled the case as a priority with confidential treatment; the agency simply waited for the result and restored its systems.

100% of data recovered. Citizen file systems restored. 8 days.

Fileserver with academic materials and grades encrypted by Conti. Backups on internal NAS also encrypted due to network share.

We handled the case discreetly and without paying any ransom, with honest scope reports; the school kept its official records.

78% of academic files recovered. Grades and official records intact. 7 days.

4 disks marked UNAVAIL in a RAIDZ3 pool (which tolerates only 3). 80 TB of 8K footage from ongoing shoots, without full backup.

The production company handed us the equipment and we took care of everything, with clear reports; it never had to reschedule shoots.

94% of footage recovered. Ongoing shoots not rescheduled. 14 days.

Btrfs reported parent transid verify failed after kernel panic. Filesystem won't mount. Customer base and current-month CDRs inaccessible.

We handled the case as a priority with confidential treatment; the operator just handed us the unit and recovered its customer base.

99% of customer base and 97% of CDRs recovered. 6 days.

Failed POS software update left all 23 SQLite databases corrupted with sales not yet synced to HQ.

We handled the case as a priority for the whole chain; the client just handed us the units and consolidated the day's sales.

100% of day's sales recovered and consolidated. 4 days.

DVR's WD Purple disk with thousands of bad sectors. Incident footage for insurance claim inaccessible.

We handled the case with priority and discretion, delivering exactly the incident footage the client needed for the insurance claim.

Complete incident footage (3 cameras, 4 hours) delivered to adjuster. 5 days.

External SSD unplugged while saving final Revit model revision. exFAT filesystem won't mount. No remote backup.

The client just brought us the device and we gave a clear quote; they recovered their complete models within a few days.

100% of BIM models recovered with metadata intact. 3 days.

iPad used in refrigerated warehouse with condensation. Severe board corrosion. Holds delivery signatures and waybills not synced.

The client just handed us the damaged unit and we took care of everything; they recovered their signatures and waybills with confidential handling.

89% of warehouse app files recovered. Signatures and waybills intact. 15 days.

One of the two child RAID 5s in the RAID 50 lost 2 disks. SCADA telemetry history and plant operation logs inaccessible.

We handled the case as a priority with confidential treatment; the plant just handed us the unit and completed its audit with the data.

97% of historical telemetry recovered. Regulatory audit completed with data. 10 days.

MacBook won't power on after liquid spill. SSD NAND soldered to board. FileVault active. Digitally signed contracts with no backup.

The client just brought us the machine and we gave a clear quote; they recovered their signed contracts with full confidentiality.

100% of files recovered with encryption preserved. 11 days.

LTO-7 tape with process plans backup bent during international shipping. Drive head cannot read it.

The client just sent us the damaged media and we took care of everything; they recovered their full technical documentation with confidential handling.

100% of process plans and technical documentation recovered. 9 days.

Phobos encrypted the VHDX inside the CSV. Inventory and customs management system down.

We handled the case discreetly and without paying any ransom, with honest scope reports; the importer recovered its inventory and customs data.

81% of inventory and customs declarations recovered without paying ransom. 9 days.

Custom recovery flash left phone in bootloop with FBE encryption active. Holds SSH keys and unpushed project code.

The client just brought us the phone and we gave a clear quote; they recovered their code and keys with full confidentiality.

92% of user files recovered including SSH keys and local repos. 13 days.

CF in a Siemens PLC with ladder program and production recipes won't boot. No backup of latest program version.

We handled the case as a priority to minimize line downtime; the client just handed us the card and resumed production.

100% of PLC program and recipes recovered. Production line restored. 7 days.