Data Recovery Case File · Water Damage · Multi-Device

The sink case: an 8TB G-RAID, an external, and half an iMac Fusion Drive — 24 hours underwater

Some enquiries tell you the stakes in the first sentence. These three drives hadn't failed; they'd been deliberately submerged in a sink of water and washing-up liquid by a third party and left there for a day — circumstances we didn't need details of to understand what the data meant to its owner. He wrote knowing he had one shot, and asked us to make it count.

The enquiry

“I have three hard drives which have been deliberately damaged, at least two containing data that's completely irreplaceable, professionally and personally. I'm aware I only have one shot at getting the data back, and it's crucially important I make the right move now. The G-RAID was submerged under water for 24 hours, in a sink with some washing-up liquid.”

What water actually does — and doesn't — do

The customer's decisive contribution to his own case was what he didn't do: power anything on, or dry anything out on a radiator. Water alone rarely destroys the magnetic data on platters. The damage comes from three other directions: electricity applied to wet circuitry, which converts a cleaning job into a burned-out one; corrosion, which starts on damp boards and connectors within hours and accelerates for days; and — the underrated one — drying. As contaminated water evaporates it leaves everything dissolved in it behind, and this water carried surfactants. A drive that's been submerged and then "dried out" carries residue films exactly where a head must fly at nanometre clearance. Wet drives should stay unpowered, be kept from drying aggressively, and travel to a lab quickly. These did.

The recovery, drive by drive

All three were stripped promptly. Boards were decontaminated and treated for corrosion, with donor PCBs (and their obligatory ROM transfers) substituted where corrosion had gone too deep to trust. Each sealed drive assembly was opened under laminar airflow to answer the question that decides an immersion case: did water pass the breather filter into the head-disk assembly? Where internals had stayed dry, the drives were rebuilt on cleaned or replaced electronics and imaged. Where moisture had reached the platters, the full decontamination process ran — platter-by-platter chemical cleaning to strip residue without touching the magnetic layer — with head-stacks replaced as a matter of course, since heads that have sat in a contaminated wet environment are never trusted again. Every drive was then imaged, write-blocked, on the TaskForce 2, and all further work ran against images.

The G-RAID pair was treated as one logical patient: the enclosure's configuration was established from the drives' own on-disk metadata rather than assumed, the volume assembled virtually in Data Extractor, and the owner's working archive extracted and verified.

The Fusion Drive complication, stated honestly

The third patient carried a caveat that matters to every iMac owner. A Fusion Drive is not one drive: it's a hard drive and a separate blade SSD fused into a single logical volume, with data — and critical filesystem metadata — distributed across both. The spinning half alone is half a volume. We recovered what it held, which for a Fusion pairing is typically the large majority of bulk file content, and reconstructed what could be reconstructed — but completeness in a Fusion case depends on both halves, and we said so before the work, not after. If a Fusion iMac ever comes apart for recovery, the blade must travel with the drive.

Outcome

The archive that mattered came back. The case settled into the pattern immersion jobs follow when the owner does the right things fast: the water was an emergency, not an ending. What deserves the last word is the first decision — three drives, 24 hours submerged, and not one of them ever powered wet. That single act of restraint is why this file describes a recovery.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.