The server that was emptied on purpose.

This was a recovery and an evidence job at once, so it was handled as both from the first minute: the server photographed, each disk labelled with its bay, serials logged, and a documented chain of custody opened before a single connector moved. To the firm’s credit, after one failed attempt to re-create the virtual disk they had stopped and pulled the power — the single best decision in the whole story, because every further write was both lost data and spoiled evidence.

Deleting a RAID volume on a PERC controller erases the array’s configuration — the paperwork — not the terabytes striped across the platters. The failed re-creation attempt had complicated things by writing fresh metadata over parts of the old, but the stripes themselves, and the filesystem inside them, were substantially intact. The job was to solve the original geometry from the data’s own patterns and to document, precisely and neutrally, what had been done and when.

All five members were imaged read-only. From the images, the original disk order, stripe size and parity rotation were worked out from the data itself, and the volume reassembled virtually — the controller’s opinion no longer required. In parallel, the forensic side was written up: controller event logs, filesystem timestamps and the deletion sequence, compiled into a plain-English report with the chain of custody attached, fit to hand to a solicitor.

The full volume came home — orders, invoices, production schedules, the accounts folder — restored to fresh storage and verified against a file listing before handover, alongside the signed report. Recovery was quoted in the from-£500 + VAT multi-disk band and the forensic side from £800 + VAT to the job, both in writing before work began. What the firm did with the report is their business; that it existed, and stood up, was ours.