Three Losses, One Order of Work

The decode

Triage relies upon timeframes rather than loss severity. Corrosion develops hourly on the wet Samsung laptop, and it must never be powered again until it is properly cleaned; this is the most urgent directive, even if it is the least valuable of the devices. The failing NAS drive only degrades further when it runs, so it is at no risk while it stays disconnected from power. The reset phone has no clock at all, for the bleakest of reasons.

The My Cloud's lights indicate an internal hard disk issue hiding behind network terminology. Orange to red with clicking indicates that the enclosure is reporting that its single internal hard disk fails its checks; network interfaces (dashboard and ethernet) are irrelevant to a mechanism unable to read the disk. The drive is removed, connected natively via SATA, and treated as an ordinary degraded-disk imaging operation with one exception: the volume inside holds a Linux file system which no Windows machine will mount, so extraction is done with the proper tools against an image of the drive, not by simply connecting the bare drive to a PC.

Give the phone the honest answer, once and plainly. Modern Android devices encrypt storage file by file, with the keys held in hardware. A factory reset destroys those keys, and destroying the keys is the actual erasure. The chips still contain data, but nothing in existence can decrypt it. No laboratory can recover it, and any service that says it can is describing something that cannot exist. The honest money goes somewhere else.

Somewhere else means the traces the failed transfer left behind. Before it died, the dock-and-desktop copy may well have written partial file sets, caches or staging folders, either on the portable SSD or on the Dell. What looks like "no trace" to someone browsing is not the same as no trace to a signature sweep run under a write-blocker. Whatever the transfer managed to move before it failed is all that can be recovered for that phone, so both of these targets need to be searched thoroughly.

The wet laptop will be the cheapest save in this whole enquiry. Water damages electronics slowly through corrosion and instantly through short circuits when power is applied. If it is kept switched off, cleaned and inspected under magnification, most water-damaged laptops give up their drives intact, even if the computer itself never works again.

Presenting all three together was the right instinct. Handled as one case, in sequence (first stabilise the wet laptop, then image the NAS drive, sweep the transfer targets, and finally answer the phone question honestly), the enquiry gets the greatest possible recovery without wasting money on something that cannot be done.

On the bench

The laptop was opened first, and its board was thoroughly cleaned using isopropyl alcohol and ultrasonic treatment. After cleaning, the board was inspected under a stereo microscope, and the laptop's drive was removed for write-blocked imaging. The My Cloud was taken out of its casing and its drive imaged on the DeepSpar Disk Imager with head-mapping, with PC-3000 UDMA working behind the unstable heads. The ext4 volume was then mounted read-only from the image in UFS Explorer for extraction. Finally, the portable SSD and the Dell were each swept under a hardware write-blocker for partial transfer sets, and the findings for the reset handset were reported plainly, for what they are.

The outcome

The wet machine was stabilised and its drive secured, the NAS volume was recovered from a head-mapped image, the transfer targets were swept for partial files, and the phone question got an honest answer. The assessment is free, and you get one fixed written figure, plus VAT; where a drive has to be opened, 50% of parts and labour is payable upfront, with the balance only if we recover your data. The decode: three faults, each on its own clock. The wet laptop is the urgent one, the clicking drive is the valuable one, and the kind thing to do about the phone is to refuse to sell you hope.

Our case files are written up from genuine enquiries our lab has handled for customers across Sheffield and South Yorkshire, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery approach our engineers apply to that fault, using the equipment listed.