Case File Library · Volume Thirty-Three

Cases 1601–1650

Volume Thirty-Three is about the questions worth asking before the technical one. Whether a folder was deleted at all, given that undelete software found nothing. Whether the quantity of data has anything to do with the price. Whether the thing you remember doing is the thing that happened. Alongside them, owners whose own words did the work: a manifest generated during an offload, a format type named exactly, a count of unallocated gigabytes, an admission that the machine did not matter. And at case 1650, a laptop encrypted by somebody whose stroke took the five years containing the passphrase — where the route is the recovery credential, and the prior question is who has the right to use it. Every case is a genuine enquiry, its identifying details changed or removed, its lesson kept whole. Every recovery names its instruments: the ACE Lab PC-3000 Express with Data Extractor and PC-3000 Flash with Spider Board, MRT Ultra, Atola TaskForce 2 and Atola Insight Forensic, DeepSpar USB Stabilizer 10Gb and RapidSpar, the Rusolut Visual NAND Reconstructor, Flash Extractor, Passware Kit Forensic, and OSForensics.