Case Study 2 — The Log That Cleared the Lab

No criminal charge, no warrant — a recovery shop sued for allegedly destroying a client's data. The recovery engineer had never imagined testifying. The disciplined log she kept "just because that's how we do it" — image first, map the bad regions, hash the result — turned out to be the same armor a forensic examiner wears in court. It exonerated her in an afternoon.

Background

This is the recovery side of the dual lens, in the territory of the book's first anchor case — the deleted family photographs — but seen from the witness box rather than the bench. A small accounting firm sent a failing 4 TB office server drive to a data-recovery shop after it began "clicking" and stopped mounting. On it were seven years of client records the firm had no current backup of. The shop recovered most of the data, but roughly 2 GB across a cluster of dying sectors never read. Months later, after a tax dispute went badly, the accounting firm's insurer — through subrogation — sued the recovery shop, alleging that the shop's "negligent handling destroyed recoverable records," a spoliation theory: that a party who had a duty to preserve evidence had instead destroyed it.

The recovery engineer who had done the work, a vocational-track technician with no courtroom experience, was suddenly a witness. She would be deposed, and possibly testify at trial. What saved her was not eloquence. It was the log.

The recovery, and the log she kept

Months earlier, the technician had treated a clicking drive exactly as the trade demands (Chapter 8): the original is sacred not because it is evidence but because it is irreplaceable and dying, so you image first and work on the copy. She photographed the drive on intake, recorded its make, model, and serial, and noted the clicking and the failure to mount in her intake log — establishing, in writing and contemporaneously, the condition in which the drive arrived. Then, rather than hammering a failing patient with recovery software, she used ddrescue, which grabs the easy data first, maps the unreadable regions, and only then gently retries the hard ones:

# First pass: capture everything that reads easily, build the map.
ddrescue -d -n /dev/sdc /mnt/recovery/server-item01.dd /mnt/recovery/server-item01.map

# Later passes: retry only the bad regions a few times, then stop.
ddrescue -d -r3 /dev/sdc /mnt/recovery/server-item01.dd /mnt/recovery/server-item01.map

The map recorded, honestly, exactly what could and could not be read:

ddrescue map summary  (recorded at recovery, item 01)
  rescued:   3,997,861 MB  (99.95%)
  bad areas: 2,139 MB in 188 regions
  status:    finished  (source non-deterministic in 2 marginal zones)

And — though no court was anywhere in sight — she hashed the image she produced and recorded it, because integrity is about truth, not only admissibility:

$ sha256sum /mnt/recovery/server-item01.dd
6d2f0b9a3e7c14a8f5b0d62e9c41a703f8b5d1e0a2c4f6b8d0e3a5c7f9b1d3e5  server-item01.dd

She had also noted that two marginal zones returned different bytes on re-read — the dying platter was not deterministic — so there was no single reproducible whole-disk hash of the source to be had. Her integrity record therefore became three things together: the hash of the image she actually produced, the ddrescue map of the 188 unreadable regions, and a note that the source's instability prevented a reproducible source hash. None of this was done for a lawsuit. It was simply how the shop worked.

The deposition

In deposition, opposing counsel ran a version of the attacks any forensic examiner would recognize — and the log answered each one. Here the Recovery vs. Forensics dual lens is sharpest: the same disciplined log that makes evidence admissible for the court is the log that exonerates the recoverer.

DEPOSITION — PLAINTIFF'S COUNSEL vs. THE RECOVERY ENGINEER

Q: "Your shop destroyed recoverable data, didn't it?"
A: "No. The drive arrived clicking and would not mount — I photographed it
    and logged that condition on intake. I never ran recovery against the
    failing original; I imaged it first with ddrescue and worked on the copy."

Q: "How do we know the 2 GB you say you couldn't read wasn't readable when
    you got it?"
A: "The ddrescue map records the 188 specific regions that failed to read on
    multiple passes — a pattern consistent with localized media failure, not
    with anything my process did. I worked only on a copy; the original was
    never written to, so my process could not have created those bad regions."

Q: "Can you prove the files you returned are the ones you recovered?"
A: "Yes. I recorded the SHA-256 of the recovery image and can show the
    delivered files match it. Nothing changed between recovery and delivery."

Q: "Are you telling this deposition the drive was unrecoverable?"
A: "I'm telling you what my imaging established: 99.95% read successfully and
    was delivered; 188 regions did not read on repeated attempts. Whether a
    specialized clean-room effort could reach those regions is outside what I
    did or am qualified to opine on."

Notice the last answer. Asked to overstate — to declare the data definitively unrecoverable by anyone — she declined, courteously, to go past what her work established, and named the limit of her expertise. That refusal is the cardinal rule in the recovery context, and it is exactly what an honest forensic expert does on the stand. The subrogation claim, which depended on showing the shop caused the loss, collapsed. There was no gap to exploit, because there was no missing page in the log. The matter was dismissed before trial.

The analysis

1. The disciplined log is discipline-blind armor. "Image first, map the failures, hash the result" is taught as recovery craft and as forensic procedure. It is the same log, and it does the same job in both worlds: for the examiner it proves the evidence is unaltered for the court; for the recoverer it proves she did not cause the loss she was accused of causing. Document every recovery as though you will defend it, because sometimes you will.

2. Contemporaneous intake documentation decides causation. The single most valuable artifact was the intake note and photograph recording that the drive arrived already clicking and failing. Because the condition was documented before any work began, the spoliation theory had nothing to stand on — the failure pre-existed the shop's involvement.

3. The ddrescue map is testimony in a file. A whole-disk "it didn't all read" is an assertion; a map naming 188 specific failed regions across repeated passes is evidence, and its pattern points to media failure rather than mishandling. The map did on the recovery side exactly what a corroborated timeline does on the forensic side: it turned an attack into a display of thoroughness.

4. Hashing is not only for court. She hashed a recovery image with no legal stakes, and months later that hash proved the delivered files matched what she recovered. Good habits do not switch off when the judge leaves the room — and the day a routine recovery becomes a case, those habits are what survive.

5. Refusing to overstate protects you, too. Pressed to declare the data unrecoverable by anyone, she stated what her work established and named the limit of her expertise. An examiner who had overclaimed — "no one could ever recover it" — would have invited a clean-room expert to contradict her. Staying inside her evidence left nothing to impeach. The cardinal rule guards the recoverer's credibility exactly as it guards the expert's.

Discussion questions

1. Contrast this case with Case Study 1. Both turned on documentation and on the cardinal rule, but one witness was vindicated and the other excluded. Identify the single discipline that separated them, and explain why it operated identically across a criminal-adjacent forensic matter and a civil recovery dispute.

2. The intake photograph and condition note were "done before any work began." Explain why contemporaneous documentation of the drive's arriving condition is what defeated the spoliation claim, and what would have happened to the shop's defense if that note had been written from memory after the lawsuit was filed.

3. ⭐ The technician was asked to declare the data definitively unrecoverable and refused, naming the limit of her expertise. Map her refusal onto the chapter's source-attribution vs. user-attribution discipline: what is the recovery-world equivalent of "stating the finding and disclaiming the leap," and why is the disclaimer a strength rather than a hedge?

4. The ddrescue map is described as "testimony in a file." Draft the two-sentence answer the engineer gives when asked "isn't it possible your process created those bad sectors?" — using the map and the fact that she worked only on a copy — and explain why working on the copy is what makes the answer airtight.

5. The shop hashed a recovery image with no court in view, and a colleague argues that in a high-volume shop "time is money" and routine hashing is wasted effort. Argue both sides, then state what, concretely, the hash bought this business the day the subrogation claim arrived.