Computer Forensics Data Recovery

Sheffield’s No.1 Desktop HDD & SSD Recovery Specialists — 25+ years

We provide engineering-led recovery for all desktop PCs and workstations, across Windows, macOS and Linux. From head crashes and seized motors to NVMe controller faults and APFS/NTFS corruption, our lab is equipped for both physical and logical failures.

Submission: Place your drive in an anti-static bag, cushion in a padded envelope or small box, include your contact details, and post or drop it in. Diagnostics are free; we’ll confirm findings and recovery options before any work begins.

Supported interfaces (legacy → modern)

PATA/IDE (3.5″), SATA I/II/III, SAS 3/6/12Gb/s, Parallel SCSI (Ultra/Ultra160/Ultra320), Fibre Channel/FC-AL (enclosures/workstations), USB 2.0/3.x/UASP (external caddies), FireWire 400/800 (legacy externals), eSATA, Thunderbolt (1–4) enclosures, PCIe Gen3/4/5, NVMe, M.2 (B/M/B+M; 2242/2260/2280/22110), U.2 / SFF-8639 / U.3, mini-SAS (SFF-8087/8643/8644), MicroSATA (1.8″), ZIF/LIF (legacy), hybrid/Fusion pairings (HDD+flash).

Top 30 desktop manufacturers (representative popular models)

Dell (OptiPlex, XPS Desktop, Precision, Alienware Aurora) · HP (ProDesk/EliteDesk, Pavilion, Envy, OMEN, Z-series) · Lenovo (ThinkCentre M-series, Legion T, IdeaCentre, ThinkStation) · Acer (Aspire TC, Predator Orion) · ASUS (ROG Strix, TUF, ProArt, ExpertCenter) · MSI (MAG Infinite, MPG Trident, Creator P) · Apple (iMac, Mac mini, Mac Studio) · Corsair (ONE) · Gigabyte (AORUS Model X/S) · NZXT (BLD prebuilt) · Intel (NUC/Atlas Canyon; minis as boot hosts) · Shuttle (XPC) · ZOTAC (ZBOX Magnus) · Beelink (mini PCs) · MINISFORUM (DeskMini series) · System76 (Thelio) · Fujitsu (ESPRIMO) · Medion (Akoya/Erazer) · Alienware (Dell) · Packard Bell (legacy) · eMachines (legacy) · ASRock (DeskMini/DeskMeet) · TUXEDO (Aura/Magnus) · Supermicro (workstations) · iBUYPOWER · CyberPowerPC · PCSpecialist/Clevo · Overclockers/8Pack systems · Scan 3XS · Chillblast.
(Models are examples; we service all families/generations.)

What fails — and how we fix it (lab workflow overview)

Mechanical (HDD)

• Head crash / clicking: Match donor HSA by micro-code/head map → replace → rebuild translator/defect tables → head-map imaging (good heads/zones first).

• Seized spindle / no spin: Spindle swap or platter migration to donor base (maintain radial alignment/clocking) → SA validation → clone good surfaces.

• Stiction (heads stuck): Controlled release → pre-amp check → immediate short-timeout imaging to avoid re-adhesion.

• Platter surface wear: Multi-pass cloning with declining block sizes, reverse reads, adaptive retries; later logical rebuild around unreadable gaps.

Electronics & Firmware

• PCB failure / TVS/regulator short: Replace protection components or donor PCB with ROM/EEPROM transfer → safe power-up → image.

• Pre-amp short: HSA swap; bias verification; per-head stability tests; clone.

• Firmware translator / SA module corruption: Read SA copies, rebuild translator from P/G-lists, rewrite modules (DIR/overlay) → restore LBA access → clone.

SSD/NVMe (desktop)

• Controller lock / firmware crash: Force ROM/SAFE mode; vendor admin cmds; extract FTL (L2P map); image per namespace.

• NAND wear / ECC maxed: ECC threshold tuning, majority-vote multi-reads, channel/plane isolation; partial imaging; file repair.

• Power-loss metadata damage: Rebuild FTL/journals; if maps lost, fall back to chip-off with ECC/XOR/interleave reconstruction.

Logical / File-system

• APFS/HFS+ (macOS): Rebuild object map/spacemaps, enumerate snapshots; repair catalog/extent B-trees; graft orphans.

• NTFS/ReFS (Windows): Pair $MFT/$MFTMirr; replay $LogFile; repair $Bitmap; recover orphaned files.

• exFAT/FAT32: Boot sector + FAT chain reconstruction via cluster signatures; carving for missing chains.

• EXT/XFS/ZFS (Linux/WS): Backup superblocks, journal/intent log replay; metaslab/txg reconciliation; readonly export.

• BitLocker/FileVault/LUKS: Decrypt with provided credentials/recovery keys; then perform standard FS rebuild. (Without keys: raw carving of any plaintext residues only.)

Imaging strategy (all media)

Hardware imagers (PC-3000, DeepSpar) with unstable-media profiles: head-select, zone prioritisation, progressive block sizes, reverse passes, per-error backoff/timeouts. Always clone first, never “repair” the original.

Verification & delivery

SHA-256 manifests, sample file open tests, directory audits. Secure delivery per your requirements.

Top 75 desktop HDD/SSD faults we recover (diagnosis → remedy)

1. Clicking on spin-up → head crash → donor HSA + translator rebuild → head-map clone.

2. No spin, 5V short → TVS/regulator replace; ROM transfer; image.

3. Spins, not detected → translator corrupt → regenerate from P/G-lists.

4. Reports 0MB capacity → overlay bug → patch firmware; restore native LBA.

5. BSY lock (busy state) → vendor terminal unlock; clear SMART; access SA → clone.

6. Slow responding (SRT) → SA module rewrite; defect handling; staged imaging.

7. Grinding (bearing) → spindle swap/platter move; SA calibrate; image good zones.

8. Stiction on inner diameter → media release; HSA swap if needed; immediate cloning.

9. Platter scoring → donor heads; isolate damaged surfaces; partial clone.

10. Weak head on one surface → disable bad head; per-head cloning.

11. Mass reallocated/pending sectors → reverse reads; small-block passes; reconstruct FS.

12. UNC at fixed LBAs → targeted retries; variable block sizes; fill map.

13. SA copy 0 unreadable → use mirror SA; module repair; proceed.

14. Corrupt ROM/adaptives → rebuild from donor family; patch adaptives; boot.

15. Wrong donor PCB fitted → move ROM; retrain adaptives.

16. USB bridge fault (desktop external) → bypass to native SATA; decrypt if enclosure uses on-board crypto.

17. FireWire external dead → transplant bridge or direct SATA; image.

18. SMR write log damage → reconstruct shingled translator; logical rebuild.

19. Drop shock → HSA & spindle assessment; contamination control; quick clone.

20. Off-track servo → adaptive calibration; low-speed track follow; image.

21. Servo wedge damage → skip wedges; interleave reads; reconstruct with gaps.

22. SMART trip blocks access → clear SMART → access user area → image.

23. Power loss mid-write → journal replay (NTFS/APFS/EXT); carve.

24. Partition table loss (GPT) → recover secondary GPT; infer from FS signatures.

25. MBR overwritten → re-create partitions; verify boundaries from superblocks.

26. BitLocker volume no key → require key/recovery; else carve only.

27. FileVault2 (APFS) locked → password/recovery key; decrypt container; rebuild.

28. LUKS header damaged → use backup header; PBKDF; decrypt; mount readonly.

29. APFS container damage → object map rebuild; snapshot export; orphan extents.

30. APFS spacemap inconsistency → regenerate spacemaps; salvage files.

31. HFS+ catalog B-tree corrupt → rebuild catalog/extent trees; graft orphans.

32. HFS+ journal stuck → replay/zero; mount clone; export.

33. NTFS $MFT corrupt → pair with $MFTMirr; recover records; rebuild dirs.

34. NTFS $LogFile missing → heuristic reconstruction + deep carving.

35. NTFS $Bitmap wrong → repair allocation; recover orphans.

36. exFAT boot sector lost → rebuild BPB; repair FAT; carve.

37. exFAT allocation bitmap corrupt → rebuild from used-cluster analysis.

38. EXT superblock lost → use backups; fsck with journal replay.

39. XFS log corruption → xfs_repair (logzero if needed); salvage trees.

40. ReFS metadata error → copy-on-write rollback; shadow copy mining.

41. ZFS single-disk pool → import readonly; zdb map; copy files.

42. CCTV disk reused in desktop → timeline carving (H.264/265), GOP index rebuild.

43. Thermal throttling (NVMe) → active cooling; reduced QD; staged imaging.

44. NVMe not detected by OS → PCIe link train fixes; direct controller imaging.

45. NVMe controller lockups → admin reset; FW recovery; namespace clone.

46. NAND wear (SSD) → ECC tuning; multi-read voting; partial clone.

47. Power rail noise from PSU → bench PSU; stabilise; image.

48. Bridge UASP instability → fall back to BOT; stabilise link; image.

49. Bad SATA cable/backplane → re-host; capture clone via hardware imager.

50. Disk shows RAW in Windows → image; FS repair on clone; export.

51. “Access denied” on user profile → take ownership on clone; export data.

52. Windows update rollback failure → $LogFile/$UsnJrnl replay; restore.

53. Mac won’t mount after update → APFS object map repair; snapshot recovery.

54. Linux LVM PV/VG lost → scan headers; rebuild VG; mount LV readonly.

55. Btrfs degraded single-disk → btrfs restore; copy files.

56. Vendor password (ATA lock) → unlock with user key (client-provided) or vendor routine where lawful.

57. Ransomware logical damage → offline parse; prior states; carve pre-encryption.

58. Malware hidden files → attribute restore on image; AV scan; export.

59. Duplicate GUIDs after cloning mishap → rebuild GPT; fix UUIDs; recover.

60. Hidden OEM/Recovery partitions → image all; mount individually; export.

61. Hybrid HDD+SSD cache corruption → identify pair; reconstruct mapping; image HDD + cache.

62. Fusion/Intel RST fake RAID on desktop → virtualise array; rebuild metadata; export.

63. Disk repeatedly drops under load → current profiling; short bursts; thermal management.

64. Frequent CRC during copy → hardware imaging with tight timeouts; avoid OS retries.

65. Bad sectors at start-of-disk → image outer zones; rebuild boot/partition data; mount from image.

66. Media noise but mounts intermittently → clone immediately; avoid OS “repairs”.

67. Excessive re-calibration cycles → tune firmware; disable weak head; head-select imaging.

68. Firmware microcode mismatch (donor) → adaptives transfer; SA re-training.

69. Helium drive acoustic anomaly → treat as mech; HSA & spindle checks; partial clone.

70. Seagate BSY/LED faults (families) → terminal patch; clear logs; restore access.

71. WD “slow issue” on SED → module repair; translator re-gen; clone.

72. Toshiba translator loop → purge G-list; re-build translator; image.

73. SMR host-managed anomalies → reconstruct ZAC/ZBC mapping; logical rebuild.

74. NVMe namespace hidden by OEM → expose via admin cmds; clone each namespace.

75. File fragmentation (large video/projects) → signature/heuristic reassembly; fix container indexes.

Professional recovery process (end-to-end)

1. Intake & write-protection → serial logging, SMART baselines; write-blocked handling.

2. Power-on triage → oscilloscope + current profiling; SA access tests; failure path decision.

3. Electronics/firmware repair → ROM/EEPROM transfer; SA module work; translator rebuild.

4. Mechanical interventions → head stack replacement; spindle swap/platter alignment; pre-amp validation.

5. Imaging → PC-3000/DDI multi-pass with head/zone strategy; reverse and small-block recovery for weak areas.

6. Logical/data recovery → APFS/HFS+, NTFS/ReFS, exFAT/FAT, EXT/XFS/ZFS; journal/log replay; B-tree & metadata repair; carving where required.

7. Verification & delivery → SHA-256 hashes, sample opens, directory audits; secure transfer on customer-approved media.

Why choose Sheffield Data Recovery

• 25+ years of desktop HDD/SSD engineering and forensic workflows.

• Multi-vendor expertise across consumer, workstation and enterprise hardware.

• Advanced tools & donor inventory to maximise recovery success.

• Free diagnostics with clear, evidence-based recovery options before work begins.

Ready to start? Package the drive safely (anti-static + padded envelope/small box) and post or drop it in. We’ll handle the rest.