Case Study 2 — Image First, Cry Later: A Failing Drive and Ten Years of Photographs

No warrant, no courtroom, no opposing expert — just a distraught client, a dying external drive, and a decade of family photographs that existed nowhere else. This is the recovery side of the cardinal rule, where "image first, work on the copy" protects something irreplaceable, and where a failing source teaches that a perfect hash is not always possible — only an honest one.

Background

This is the book's first anchor case — the deleted wedding photos — but seen at the acquisition step, and from the recovery trade rather than the forensic one. A client walked into a data-recovery shop with a 2 TB USB external drive that had begun "clicking" and would no longer mount. On it: ten years of family photographs, including her wedding, her children's births, and her late father's last birthday. There was no backup. There was no second copy. There was no legal dimension at all. And yet the cardinal rule applied with exactly the same force, for a different reason: in forensics the original is sacred because it is evidence; in recovery it is sacred because it is irreplaceable and, in this case, dying.

A competitor across town had already quoted the client a "quick fix" — they would run recovery software directly against the drive and pull what they could. The shop she ultimately chose explained why that was the worst possible plan: every minute a failing drive spins, and every read it is forced to perform, may be its last. Running file-recovery software against the original would hammer a patient that was already failing, and if the drive died mid-scan, both the files and the chance to image them would be gone together.

The recovery

The technician's first move was not recovery at all. It was acquisition — get a stable copy off the patient before it dies, then work on the copy. A clicking drive is a mechanical-failure case (Chapter 8), so plain dd was exactly the wrong tool: its crude retry behavior could spend hours grinding on a single bad region and finish the drive off. Instead the technician used ddrescue, which maps unreadable regions, grabs all the easy data first, and only then returns to retry the hard sectors — and which keeps a map file so an interrupted run can resume:

# First pass: grab everything that reads easily, build the map.
ddrescue -d -n /dev/sdc /mnt/recovery/photos-item01.dd /mnt/recovery/photos-item01.map

# Later passes: retry only the bad regions, a few times, then stop.
ddrescue -d -r3 /dev/sdc /mnt/recovery/photos-item01.dd /mnt/recovery/photos-item01.map

The map told the story honestly:

ddrescue map summary
  rescued:   1,998,539 MB  (99.91%)
  bad areas: 1,791 MB in 214 regions
  status:    finished

Roughly 1.8 GB across 214 small regions never read — almost certainly a cluster of dying sectors on one platter zone. The technician then did something that surprises people who assume recovery is sloppier than forensics: she hashed the image she had captured and recorded it, because even with no courtroom in sight, she wanted to be able to prove that the file she handed the client matched the one she recovered, and that nothing changed it afterward.

$ sha256sum /mnt/recovery/photos-item01.dd
2f9c7a1e4b0d63a8c5e21f7d90ab43c6e8d1f02a3b4c5d6e7f80910a2b3c4d5e  photos-item01.dd

But here the failing-drive reality bit. When she re-read a few regions of the source to double-check coverage, the drive returned different bytes in two of the marginal areas — the dying platter zone was not deterministic. There was, in plain terms, no single reproducible whole-disk hash of the source to be had: image it twice and you would get two different digests, through no fault of the technician's. This is the honest limit the chapter warns about. Her integrity record therefore became three things together: the SHA-256 of the image she actually produced, the ddrescue map documenting exactly which 214 regions were unreadable, and a note that the source's instability prevented a single reproducible source hash. She worked only on that image from then on — never the original drive, which she powered down and set aside in case a future clean-room attempt could reach the bad zone.

Analysis on the copy was its own chapter (logical recovery in Chapter 6, carving in Chapter 7), but the outcome was shaped entirely by the acquisition: because she had imaged first, the 99.91% she captured was safe on healthy media, immune to the drive's continued decline. The unreadable 1.8 GB cost a few dozen photographs — some recoverable as partial JPEGs from carved fragments, a handful lost entirely. The wedding album, the births, the last birthday: all recovered, because they happened to live in the 99.91% and because she copied that 99.91% before asking the dying drive to do anything else.

The analysis

1. The cardinal rule is discipline-blind. "Never work on the original; image first, work on the copy" is usually taught as a courtroom rule. It is not. Here there was no court, yet violating it would have destroyed the data exactly as surely as it destroys admissibility. Recovery and forensics arrive at the same rule from opposite directions — irreplaceability and provability — and both are right.

2. Match the imaging tool to the source's health. Plain dd would have retried bad sectors crudely and might have killed the drive. ddrescue grabbed the easy 99.91% first, mapped the bad regions, retried them gently, and could resume after interruption. On a failing drive the order in which you read matters as much as that you read.

3. A failing source may never give you a clean hash — and that is not your failure. When a drive returns different bytes on re-read, there is no single reproducible whole-disk digest. The honest record is the hash of the image you produced plus the ddrescue map of unreadable regions. Documenting the limitation is the professional move; pretending the drive was deterministic would be a lie.

4. Hashing is not only for court. The technician hashed a recovery image with no legal stakes, because integrity is about truth, not just admissibility: she could prove the delivered files matched what she recovered and detect any later corruption in storage or transfer. Good habits do not switch off when the judge leaves the room.

5. The human cost is the point. Behind the drive was a person and ten years she could not get back. The technical decisions — image first, choose ddrescue, work on the copy — were in service of that. The competitor's "quick" plan optimized for speed; this shop optimized for not losing what could never be replaced. The slower, disciplined path is the one that honored the stakes.

Discussion questions

1. Contrast this acquisition with Case Study 1. Both followed "image first, work on the copy," but the reason differed. Name the reason in each case, and explain how the differing reason changes what the technician/examiner must document.

2. The technician hashed a recovery image even though no court would ever see it. Argue for and against this practice in a high-volume recovery shop where time is money. What, concretely, does the hash buy a recovery business?

3. ⭐ The source was non-deterministic, so no single whole-disk hash existed. Suppose this had instead been a forensic case — a failing evidence drive in a criminal matter. Write the two-to-three-sentence statement of integrity and limitation the examiner would put in the report, and explain why it is stronger in court than claiming a clean hash that cannot be reproduced.

4. The competitor proposed running recovery software directly against the failing original. List three specific things that could have gone wrong, and explain why "image first" defends against all three at once.

5. Of the captured image, 99.91% was good and 1.8 GB across 214 regions was lost. Using the offset model from Chapter 2, explain why a photograph stored in a single unreadable region is likely lost entirely, while a photograph spanning the boundary of a bad region might be partially recoverable by carving — and what the ddrescue map tells the recovery technician about where to even look.