The Reason Why People Hate Data Recovery Labs

Thu Sep 29, 2016 1:51 pm

I'm starting to see why people hate data recovery companies. Many of them are just plain despicable criminals who lie, cheat and steal from their customers.

Today I get in a Seagate ST2000MD001 (probably should have been a typical media cache fix). Unfortunately they went to another data recovery company first who quoted too high, then sabotaged the ROM code filling it with FF before giving it back to the customer who declined. Likely because they couldn't undo the media cache fix.

Now, I'm a constructive type of person and rather than just quickly tear them down to the customer I try to give the other company a chance to set things right. So I email, ask to talk with the tech who handled the case, and I asked him about it. First just asking about the evaluation, and not mentioning the obvious sabotage. They say:

Client declined proceeding with the recovery so we never got to do the actual recovery of the media so we don’t have a lot of information to provide though we do have a recovery plan in place that will allow us to recover the data from it.

So obviously if they have a "recovery plan" then they have the ROM code. I tell the guy that I haven't said anything to the customer yet, but if he refused to provide their backup of the ROM I'll have to notify the customer that the drive was sabotaged. Then I get a series of increasingly angry emails, demanding to speak to my supervisor :lol:

(that would be me) and even saying that I must have destroyed it. Yeah, like it's really easy to "accidentally" overwrite a ROM with the letter F :roll:

.

I'm starting to hate data recovery people, and I'm one of them.

It's morons like this that give us all a bad name. They should all be locked up.

pc3000 · Fri Sep 30, 2016 3:48 am

Right, but not the only reason.
I think that people do not like data recovery companies
This is because they think that the data recovery labs charge them too expensive prices,
And They have no idea how much it costs a data recovery equipment, and the amount of hours

Bankole Oladoja · Fri Sep 30, 2016 11:58 am

I think there should be a standard law that guide DR Companies. I have had a similar experience with Original PCB swapped with a bad one. It took days to match original rom version.

michael chiklis · Fri Sep 30, 2016 2:08 pm

I had a ROM sabotage case too about 2 years ago, where my customer sent me his drive after he declined previous lab quote (they've quoted to him 890 €).
His drive was Barracuda 7200.11 ST3320613AS with PCB number 100504364
I found that hdd did power on with donor pcb (and its donor rom code), but once i physically transferred original rom chip from patient pcb into donor pcb, this last one didn't work (no spin up).
At this point i began to suspect that patient rom chip was damaged or that rom code got damaged/sabotaged, so i unsoldered it and tried to read the code inside via my Willem eprom programmer, it had read rom code successfully, so that mean the chip was good.
I examined the rom code, it seem to be ok, so i written it on donor pcb rom.
SUCCESS, hard drive spin up again and works perfectly!!

After further investigation, i've found that previous lab had physically swapped the original rom chip with another type of chip (ATMLH828), which couldn't be detect by pcb MCU. Seagate doesn't use this type of rom chip on Barracuda 7200.11 drives!
Fortunately the assholes of previous lab didn't think to overwrite the original rom code, they have only copied it on a rom chip type which couldn't be detect by any pcb.
Original issue was only PCB faulty, they've charged to him 890 € for a simple PCB swap.

I hate this people :evil:

pcn · Wed May 03, 2017 5:38 am

Today I was hit too by a sabotage case where a customer send me a Seagate 500G drive in for a second opinion (quote was more than 1400€!). Drive was dropped by the client. First I was happy to see that the drive was opened by the competitor because we see many cases where a analysis fee was taken but no in-depth diagnosis was made. So I checked the drive in our lab and it looked ok: No fingerprints, no dirt, only very small scratch but a recovery should be doable with reasonable price. Heads also looked fine so far.
So I connected the drive to PC3K and it does not spin at all (client wrote it should spin but not be detected). In terminal I then saw this:

: ROM_Booterror.png (5.57 KiB) Viewed 1586 times

Argh! So I first tried to read the ROM with PC3K which results in a zero-filled ROM. So I unsoldered the ROM and read it externally and there it is. Serial Number matches patient drive. So our beloved competitor tampered with the ROM code. Ok, I searched and found a ROM-Version that should match, did an import of adaptives and burned that to a donor-pcb. Attached it to the drive and it starts to spin. Sadly it now clicks and keeps bsy all the time. So this will become a trial and error recovery with rather low chances to get the clients data because I know ROM code is not original and I don't know what else they have done (original heads, tampered SA, original adaptives, ...) What the hell have these guys in mind when doing this? :evil:

RolandJS · Thu May 04, 2017 1:53 pm

In other places I've been parroting the advice of making a clone or full image of the source HD onto any reliable target HD before doing one of two things: 1) send source HD to a DR company/specialist; or 2) Start DIY DR. If a person has this clone, that does lessen the data loss impact of bad things happening to the original HD, am I correct?

Thu May 04, 2017 2:01 pm

RolandJS wrote:In other places I've been parroting the advice of making a clone or full image of the source HD onto any reliable target HD before doing one of two things: 1) send source HD to a DR company/specialist; or 2) Start DIY DR. If a person has this clone, that does lessen the data loss impact of bad things happening to the original HD, am I correct?

I agree about cloning first if you're going to DIY. However, if you're willing to pay for professional service it's not worth the extra risk of DIY cloning. Leave it to the pros to do that, as it should be the first thing any professional lab does. You just have to be careful where you send it as there are a lot os shady companies out there that are sub-par at recovering data and prefer to just scam people. I've actually started keeping a list in the Secrets section of this forum to keep track of such companies. Perhaps one day if I retire from this business and am not afraid of lawsuits I'll move it to the public section for all to see who the scammers are.

RolandJS · Thu May 11, 2017 1:28 pm

Sub par does not necessarily mean scammer; I've run across businesses that make mistakes and do a poor job, and I've run across businesses that only desire to make money and purposely do a poor job.

Mikeethestud · Fri May 11, 2018 3:43 pm

Do not go to data recovery companies as there prices are very high instead of that you can try data recovery software and recovery the data n number of times and you have to pay money only for upgrade

Sun May 13, 2018 5:48 pm

Mikeethestud wrote:Do not go to data recovery companies as there prices are very high instead of that you can try data recovery software and recovery the data n number of times and you have to pay money only for upgrade

This is quite possibly the worst advice ever given on this forum. Granted, there are some situations where good data recovery software may suffice, but there are many many cases where the fault is hardware related and trying to recover data using only software is likely to end in disaster.

My suspicion is that the person I'm quoting here is just a spammer who's about to chime in with a recommendation for some useless software.