Data Recovery Case File · Honest Limits · The Clone Hunt

When the original is already gone: hunting the last copies of a deadline's work inside a rescue-app clone — recovered in part, accounted in full

This archive publishes its partial recoveries with the same care as its triumphs, because the partials carry the expensive lessons. The sequence, as he told it with complete candour: a difficult few months had kept him from the desk; then a storm took out his iMac's 3TB Fusion Drive. Nearly everything was backed up — except half a dozen of the most recent and most important pieces of work, which "were supposed to have been temporarily made safe on iCloud Drive, but that does not seem to have happened." He did one very right thing: used a data-rescue application to clone the failing 3TB drive. Then, under deadline pressure and after Disk Utility's repair attempts from Recovery ("I fear it did more harm than good"), he made the irreversible call: wiped the faulty drive and restored his backup to it — whereupon it became clear what the backup didn't hold. By the time he wrote in, the original was gone. The clone was the case.

The sequence, graded kindly — and what a clone can and cannot hold

Grading first, with the gentleness deadline decisions deserve. The clone: excellent — the single move that made this page a recovery instead of an obituary. The Disk Utility repairs from Recovery: understandable and risky, for the reason this archive's repair cases keep documenting — repair tools write into damaged structures, and on a failing drive they can prune what they can't reconcile. The wipe-and-restore: the machine needed to work and the deadline was real — but it was the irreversible step, taken while the drive it erased was still the best source in the house; everything before that moment was recoverable in principle, and this page's central plea is simply that the wipe come last, after the missing files are confirmed found, never before. Now the clone's honest physics. A Fusion Drive is two devices — SSD and hard drive — presented as one volume, and a consumer rescue app cloning a failing one captures what the sick hardware would serve on that day: an image that is mostly complete and unknowably incomplete, its gaps invisible until someone goes looking. Within such an image, missing recent files can survive in several forms — intact in the cloned filesystem, held in older snapshots the volume kept internally, present as auto-saved versions and application working copies, or recoverable only as carved fragments — and the hunt's job is to try each layer in turn, promising nothing until the evidence votes.

The hunt — and the honest ledger

The clone was treated as the read-only crime scene it was, and worked layer by layer: its filesystem structures parsed and reconciled, the volume's internal snapshots enumerated and mounted, application auto-save and version territories searched by name and by signature, and the unindexed remainder carved for the document types his inventory named. The ledger, delivered in writing against his list of six: four of the works recovered — two intact in the cloned volume itself, two as near-final versions from snapshot and auto-save territory, close enough to their last states that reconstruction cost hours rather than the feared month; two beyond reach — their territory falling, on the evidence, in regions the failing drive had never successfully served to the rescue app, present in the clone only as fragments below usable coherence, and their last true copies erased with the wipe. Each verdict came with its evidence; the four came back verified and were returned alongside the report; and the two were named plainly, because a partial recovery honestly itemised is worth more than a fuller-sounding one that hides its edges.

Outcome — and the three lessons, priced by one deadline

Four of six recovered from a source that technically no longer existed — and the lessons, in the order they'd have changed the story. First: verify the cloud, every time it matters. "Supposed to have been made safe on iCloud" is this archive's silent-lapse genre wearing Apple's clothes — sync clients sign out, pause, and fill quietly, and the two minutes spent confirming a file actually shows in the cloud is the cheapest insurance in computing. Second: the wipe comes last. A failing drive, however inconvenient, is evidence — keep it powered down and untouched until every missing file is confirmed recovered from somewhere; restoration deadlines can be met on a replacement drive while the original waits in a drawer. Third: a rescue clone is a good deed that needs finishing — made early (his was), preserved unmodified, and handed over with the machine's story, it can carry a case alone, as this one carried his. He did the right thing first, the risky things under pressure, and the irreversible thing too soon — and his candour about all three is why this page can now stand between the next reader and the same sequence. Two works were the tuition. This entry is the receipt.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.