A question about data recovery

[Lupin]

hey guys!

I have a question about file timestamps and I'm not sure about the right answer, i preferred to ask it here, if anyone has data recovery experience, I'll be thankful.

the story is that my fiend's laptop got completely wet , he left the laptop to dry for 2 days and was afraid to turn it on,he took the laptop to a service shop. after a few days they call and tell him that the laptop's hdd is dead and can not be repaired and it's replaced with a new one. they tell him that all the data is recovered from the dead hdd into the new one. now my friend is suspicious about whether or not he's been scammed because all his files are exactly the same and also filenames have not been changed a bit, everything's intact. I told him to check the files timestamp and he said the timestamps are the same as before this incident happens. now my question is:

does the file timestamps get updated after data recovery from a hdd? are there any other ways to discern if the files got really recovered or just copied from the previous hdd?

sorry if it took so long.

thanks in advance.

[Huckleberry Finn]

tell him that the laptop's hdd is dead and can not be repaired and it's replaced with a new one. they tell him that all the data is recovered from the dead hdd into the new one.

Yes, but how? If it wasn't "dead", there're several ways to copy, including the simple dd.

[BitJam]

does the file timestamps get updated after data recovery from a hdd?

No!

are there any other ways to discern if the files got really recovered or just copied from the previous hdd?

These are basically the same thing.

It's possible the old drive was not damaged and this was a bit of a rip-off. I'm sure they replaced the drive. I'm not certain it needed to be replaced but I have no evidence either way. The mechanical parts of hard drives are sealed so that should be fine. I'd be mostly concerned about the electronics and the connector. OTOH, if I'm running a repair shop and I see something funky in the hard drive diagnostics after the machine had a bath then I would probably replace the hard drive too even if I can currently copy all the data from it. BTW: The smart drive tool available on MX will tell you how long the drive has been used so it would be trivial to detect if the drive was not replaced.

If this happens again, I suggest you buy a large (5lb? 10lb?) bag of rice and put the wet machine in that rice for a few days after you shake out as much water as you can. Certainly remove the battery if that's possible. The rice will do a good job of pulling all the water out. Most equipment can survive getting wet (but maybe not being submerged) IF you dry it out well before you turn it on. Water is fine (except for corrosion) it is the combination of water and electricity that causes problems.

If you are still concerned then I suggest you ask the shop why they thought the hard drive needed to be replaced. Email would b perfect so you could share the answer here. Certainly run the smart control program on the current drive but I would be amazed if it hadn't been replaced.

[Lupin]

tell him that the laptop's hdd is dead and can not be repaired and it's replaced with a new one. they tell him that all the data is recovered from the dead hdd into the new one.

Yes, but how? If it wasn't "dead", there're several ways to copy, including the simple dd.

thanks!
yea that's why he is concerned because he is not sure what has happened in the store, whether the hdd is really swapped or the default hdd has been remained healthy and he has paid for nothing.

does the file timestamps get updated after data recovery from a hdd?

No!

are there any other ways to discern if the files got really recovered or just copied from the previous hdd?

These are basically the same thing.

It's possible the old drive was not damaged and this was a bit of a rip-off. I'm sure they replaced the drive. I'm not certain it needed to be replaced but I have no evidence either way. The mechanical parts of hard drives are sealed so that should be fine. I'd be mostly concerned about the electronics and the connector. OTOH, if I'm running a repair shop and I see something funky in the hard drive diagnostics after the machine had a bath then I would probably replace the hard drive too even if I can currently copy all the data from it. BTW: The smart drive tool available on MX will tell you how long the drive has been used so it would be trivial to detect if the drive was not replaced.

If this happens again, I suggest you buy a large (5lb? 10lb?) bag of rice and put the wet machine in that rice for a few days after you shake out as much water as you can. Certainly remove the battery if that's possible. The rice will do a good job of pulling all the water out. Most equipment can survive getting wet (but maybe not being submerged) IF you dry it out well before you turn it on. Water is fine (except for corrosion) it is the combination of water and electricity that causes problems.

If you are still concerned then I suggest you ask the shop why they thought the hard drive needed to be replaced. Email would b perfect so you could share the answer here. Certainly run the smart control program on the current drive but I would be amazed if it hadn't been replaced.

thanks BitJam for this informative post.

and by the way, he actually runs windows on his laptop, not linux. I told him now to check his hdd with HDDExpert(on windows) to check the hdd's status, as you suggested..

[Lupin]

he sent a photo of HDDExpert, I attached the photo he sent me(quality is damn low he can't send a screenshot,I apologize on his behalf) . the repair shop has told him that the hdd they've installed is brand new. the picture says it all i guess. what do you think?

[BitJam]

he sent a photo of HDDExpert, I attached the photo he sent me(quality is damn low he can't send a screenshot,I apologize on his behalf) . the repair shop has told him that the hdd they've installed is brand new. the picture says it all i guess. what do you think?

407 hours and 400-some cycles does not look new to me. Perhaps your friend has some idea of how long they've had the laptop on. It's even possible that the disk is off when the laptop is on to save power but I don't know much about that stuff.

The cycles and the hours make it look like it may have been on an hour a day for a little over a year. Or every other day for two years, or twice a day for half a year. I'd but there are other people here who have a much better idea of what those numbers actually mean. I'm kind of guessing.

It's not unusual for restored files to be identical to the originals. That's the point. But that drive does not look new which IMO is nuts because if you are paying to have someone swap out a drive then you should make sure you get a new drive. They usually don't cost that much.

Maybe I'm off base here. I suggest you wait for some more opinions before coming the a conclusion.

[Lupin]

407 hours and 400-some cycles does not look new to me. Perhaps your friend has some idea of how long they've had the laptop on. It's even possible that the disk is off when the laptop is on to save power but I don't know much about that stuff.

The cycles and the hours make it look like it may have been on an hour a day for a little over a year. Or every other day for two years, or twice a day for half a year. I'd but there are other people here who have a much better idea of what those numbers actually mean. I'm kind of guessing.

It's not unusual for restored files to be identical to the originals. That's the point. But that drive does not look new which IMO is nuts because if you are paying to have someone swap out a drive then you should make sure you get a new drive. They usually don't cost that much.

Maybe I'm off base here. I suggest you wait for some more opinions before coming the a conclusion.

yeah you're right. I don't think the software is lying. they've said it is brand new, if the working hours were like 10-20 I wouldn't bother returning the hdd, but 400+ hours...
I told him to take the laptop to the shop and show them the screen, and clarify this.

thank you very much BitJam

[JayM]

They may have run a burn-in test on the "new" HDD. But 400 hours is over 16 days. How long did they even have the computer in their custody?

Normally if a repair shop replaces a component they also return the old defective one to the customer. They also contact the customer and get pre-approval prior to swapping parts. If they didn't give your friend the old HDD back, that raises suspicions. It sounds like they may have scammed your friend just like unscrupulous auto-repair shops do, or used to do.

Regarding the original question, I think even copying with rsync preserves the original files' date and time stamps.

(I tried the rice trick on my wireless mouse after I got water in it from cleaning the outside. It helped somewhat, but it took me an hour to get the grains of raw rice out of it that had gotten inside the works. I ended up just using a hair dryer on it. There were still a few grains of rice in it a moment ago: I could hear them rattling around when I shook the mouse. I just got them out: no more rattling.)

[Lupin]

They may have run a burn-in test on the "new" HDD. But 400 hours is over 16 days. How long did they even have the computer in their custody?

Normally if a repair shop replaces a component they also return the old defective one to the customer. They also contact the customer and get pre-approval prior to swapping parts. If they didn't give your friend the old HDD back, that raises suspicions. It sounds like they may have scammed your friend just like unscrupulous auto-repair shops do, or used to do.

Regarding the original question, I think even copying with rsync preserves the original files' date and time stamps.

(I tried the rice trick on my wireless mouse after I got water in it from cleaning the outside. It helped somewhat, but it took me an hour to get the grains of raw rice out of it that had gotten inside the works. I ended up just using a hair dryer on it. There were still a few grains of rice in it a moment ago: I could hear them rattling around when I shook the mouse. I just got them out: no more rattling.)

he says his laptop's been there for about 4 days.
and he also says that the repair shop did call him and ask for his approval, but they didn't return the old hdd to him, which is why he got suspicious at first place and asked me after that.
this is unfair, i mean whether the store has sold a second-handed hdd as a new one to him OR if the store has not changed the hdd and has sold his own hdd to himself again. both of these possibilities are unacceptable. I'll encourage him to take a legal action against the store.

and thank you so much for the info and tricks you shared JayM.

[Huckleberry Finn]

If he has an invoice and a warranty for the "brand new" one then no need to get into argument: "yes, you will , no we won't .." Just ask them once and do it legally. Generally the car services (garages) do tricks like that, which's so frustrating.

Good ones ask you even when the old part is absolutely "rubbish" : "would you like us to throw it in the rubbish box or would you like to do it yourself?, it's here..". Because it still belongs to you no matter it's old or rubbish. You decide what to do. (For example on car parts you may want to strip it and reuse some smaller parts in it etc.. )