The accident was serious: a metal splinter thrown by an industrial machine struck the operator's eye, and he lost his sight. In the labor lawsuit, the dispute came down to one question: was he wearing his safety glasses? The company provided the protective equipment and trained its use; the employee's glasses, collected after the accident, bore no mark or perforation, which suggested they were not on his face at the moment of impact. But in the shock of the first hours, with all attention on the rescue, nobody preserved the scene, and days later no one even knew where the glasses were. That left the cameras.
The footage from the main circuit showed the operator too far away to distinguish the equipment. There was, however, a second DVR, with three cameras much closer to the machine, and one problem: the unit had been broken for a long time. Inside it, a 10 TB disk emitted the rhythmic snap laboratories know as the "click of death". The disk was collected at the company itself, with the procedure photographed and the chain of custody recorded from the first touch, and opened in the laboratory's clean room, inside the laminar flow cabinet. The diagnosis: the read head had touched the surface of one of the platters, damaging one of the faces.
The read head was replaced with a compatible donor unit, and the head corresponding to the damaged face was disabled: insisting on it could compromise the rest. All the other faces were read and the content indexed on a recovery server. Because the DVR records in blocks of a few minutes per camera, most of the video from all cameras was recovered; only the blocks residing on the damaged face were lost, and about them the report declares the only honest fact possible: there is no way to know what they contained.
Three examinations, one verdict
The recovery delivered the material to the second stage, computer forensics, which preserved and organized the evidence; and that fed the third, the image examination. Cameras far from the accident site showed the employee moving through the factory with the safety glasses resting on his head and without his helmet. And one of the recovered cameras, close to the machine, captured the decisive moment: the glasses were on his forehead, not over his eyes, when the chip flew. There was no obstruction because there was nothing to obstruct. The situation is regrettable, a professional lost his sight, but the role of the forensic examination is to demonstrate the fact: the protective equipment was provided and trained, and it was not used as it should have been. Responsibility for the accident did not lie with the company.
"Forensic work is an obligation of means, not of results. What exists inside damaged media, nobody knows before opening it, replacing the component, and reading what survived. Whoever promises results before that is selling something else."
When cheap recovery destroys everything
The counterpoint came in another case. A professional association kept a storage array with ten disks, unmaintained for years, and only noticed the problem when the set stopped for good. The IT department searched the internet, opened a bidding round, and hired the cheapest proposal. Sixty days later, the company returned the disks with its verdict: unrecoverable.
The laboratory's examination told another story. The disks that had failed had electrical and electronic defects on their controller boards, fixable in hours: some required component replacement, one demanded the transplant of the entire logic board. The disks that were healthy, however, had been destroyed, not by the failure, but by the vendor: connected to an ordinary Windows workstation, they were initialized when the system, failing to recognize the storage partitions, offered to format them, and someone accepted. Entire areas were overwritten. On one of the disks, formatted as NTFS, the recycle bin created by the operating system recorded the username of the vendor's own workstation: the involuntary signature of the party that caused the loss. The whole array was gone, in a job that, in the right hands, would have taken a few hours.
Recovering data is not recovering evidence
The two cases teach by contrast. In the first, the media arrived at the laboratory sealed, with custody documented from the collection at the company, and what came out of it decided a lawsuit. In the second, the media passed through hands without method, and what was lost was not just the data: it was the possibility of any evidence at all. Recovery with forensic value demands what commercial recovery ignores: a record of every intervention, a forensic image of what remained of the media, a hash that authenticates the dataset, a report that declares what was recovered, what was lost, and why.
The honest limit and the second search
When data proves unrecoverable, the client is informed immediately, without evasion. And there is still a second search available: data carving, the sweep of the media for copies of the file in other areas of the disk, temporary versions, reassemblable fragments. Sometimes it finds them; sometimes it does not. What never exists is an advance guarantee: the extent of what is recoverable is only known after the damaged component is replaced and what survived is actually read.
Before handing your media to anyone
- Check who the professionals are and how long they have worked in data recovery;
- Ask about real training, beyond the "technician" label: the market is full of empirical practice built on distance-learning courses;
- Demand a clean room for opening media and a documented working method;
- If the data could become evidence, demand a chain of custody from collection onward;
- Distrust promises of results: serious recovery is an obligation of means.
A clicking disk is not the end of the story; sometimes it is the beginning. Between the drive that died and the evidence that decides the case there is a narrow path, which runs through the clean room, the donor part, the custody, and the honesty about what the lost face took with it. The cheap shortcut, as the professional association learned, tends to cost everything.
