MX Linux Forum

hey guys!

I have a question about file timestamps and I'm not sure about the right answer, i preferred to ask it here, if anyone has data recovery experience, I'll be thankful.

the story is that my fiend's laptop got completely wet , he left the laptop to dry for 2 days and was afraid to turn it on,he took the laptop to a service shop. after a few days they call and tell him that the laptop's hdd is dead and can not be repaired and it's replaced with a new one. they tell him that all the data is recovered from the dead hdd into the new one. now my friend is suspicious about whether or not he's been scammed because all his files are exactly the same and also filenames have not been changed a bit, everything's intact. I told him to check the files timestamp and he said the timestamps are the same as before this incident happens. now my question is:

does the file timestamps get updated after data recovery from a hdd? are there any other ways to discern if the files got really recovered or just copied from the previous hdd?

sorry if it took so long.

thanks in advance.

Lupin wrote: Sun Oct 27, 2019 2:43 pmtell him that the laptop's hdd is dead and can not be repaired and it's replaced with a new one. they tell him that all the data is recovered from the dead hdd into the new one.

Yes, but how? If it wasn't "dead", there're several ways to copy, including the simple dd.

Lupin wrote: Sun Oct 27, 2019 2:43 pmdoes the file timestamps get updated after data recovery from a hdd?

No!

are there any other ways to discern if the files got really recovered or just copied from the previous hdd?

These are basically the same thing.

It's possible the old drive was not damaged and this was a bit of a rip-off. I'm sure they replaced the drive. I'm not certain it needed to be replaced but I have no evidence either way. The mechanical parts of hard drives are sealed so that should be fine. I'd be mostly concerned about the electronics and the connector. OTOH, if I'm running a repair shop and I see something funky in the hard drive diagnostics after the machine had a bath then I would probably replace the hard drive too even if I can currently copy all the data from it. BTW: The smart drive tool available on MX will tell you how long the drive has been used so it would be trivial to detect if the drive was not replaced.

If this happens again, I suggest you buy a large (5lb? 10lb?) bag of rice and put the wet machine in that rice for a few days after you shake out as much water as you can. Certainly remove the battery if that's possible. The rice will do a good job of pulling all the water out. Most equipment can survive getting wet (but maybe not being submerged) IF you dry it out well before you turn it on. Water is fine (except for corrosion) it is the combination of water and electricity that causes problems.

If you are still concerned then I suggest you ask the shop why they thought the hard drive needed to be replaced. Email would b perfect so you could share the answer here. Certainly run the smart control program on the current drive but I would be amazed if it hadn't been replaced.

Huckleberry wrote: Sun Oct 27, 2019 3:11 pm

Lupin wrote: Sun Oct 27, 2019 2:43 pmtell him that the laptop's hdd is dead and can not be repaired and it's replaced with a new one. they tell him that all the data is recovered from the dead hdd into the new one.

Yes, but how? If it wasn't "dead", there're several ways to copy, including the simple dd.

thanks!
yea that's why he is concerned because he is not sure what has happened in the store, whether the hdd is really swapped or the default hdd has been remained healthy and he has paid for nothing.

BitJam wrote: Sun Oct 27, 2019 3:38 pm

Lupin wrote: Sun Oct 27, 2019 2:43 pmdoes the file timestamps get updated after data recovery from a hdd?

No!

are there any other ways to discern if the files got really recovered or just copied from the previous hdd?

These are basically the same thing.

It's possible the old drive was not damaged and this was a bit of a rip-off. I'm sure they replaced the drive. I'm not certain it needed to be replaced but I have no evidence either way. The mechanical parts of hard drives are sealed so that should be fine. I'd be mostly concerned about the electronics and the connector. OTOH, if I'm running a repair shop and I see something funky in the hard drive diagnostics after the machine had a bath then I would probably replace the hard drive too even if I can currently copy all the data from it. BTW: The smart drive tool available on MX will tell you how long the drive has been used so it would be trivial to detect if the drive was not replaced.

If this happens again, I suggest you buy a large (5lb? 10lb?) bag of rice and put the wet machine in that rice for a few days after you shake out as much water as you can. Certainly remove the battery if that's possible. The rice will do a good job of pulling all the water out. Most equipment can survive getting wet (but maybe not being submerged) IF you dry it out well before you turn it on. Water is fine (except for corrosion) it is the combination of water and electricity that causes problems.

If you are still concerned then I suggest you ask the shop why they thought the hard drive needed to be replaced. Email would b perfect so you could share the answer here. Certainly run the smart control program on the current drive but I would be amazed if it hadn't been replaced.

thanks BitJam for this informative post.

and by the way, he actually runs windows on his laptop, not linux. I told him now to check his hdd with HDDExpert(on windows) to check the hdd's status, as you suggested..

he sent a photo of HDDExpert, I attached the photo he sent me(quality is damn low he can't send a screenshot,I apologize on his behalf) . the repair shop has told him that the hdd they've installed is brand new. the picture says it all i guess. what do you think?

Lupin wrote: Sun Oct 27, 2019 5:37 pm he sent a photo of HDDExpert, I attached the photo he sent me(quality is damn low he can't send a screenshot,I apologize on his behalf) . the repair shop has told him that the hdd they've installed is brand new. the picture says it all i guess. what do you think?

407 hours and 400-some cycles does not look new to me. Perhaps your friend has some idea of how long they've had the laptop on. It's even possible that the disk is off when the laptop is on to save power but I don't know much about that stuff.

The cycles and the hours make it look like it may have been on an hour a day for a little over a year. Or every other day for two years, or twice a day for half a year. I'd but there are other people here who have a much better idea of what those numbers actually mean. I'm kind of guessing.

It's not unusual for restored files to be identical to the originals. That's the point. But that drive does not look new which IMO is nuts because if you are paying to have someone swap out a drive then you should make sure you get a new drive. They usually don't cost that much.

Maybe I'm off base here. I suggest you wait for some more opinions before coming the a conclusion.

BitJam wrote: Sun Oct 27, 2019 7:22 pm 407 hours and 400-some cycles does not look new to me. Perhaps your friend has some idea of how long they've had the laptop on. It's even possible that the disk is off when the laptop is on to save power but I don't know much about that stuff.

The cycles and the hours make it look like it may have been on an hour a day for a little over a year. Or every other day for two years, or twice a day for half a year. I'd but there are other people here who have a much better idea of what those numbers actually mean. I'm kind of guessing.

It's not unusual for restored files to be identical to the originals. That's the point. But that drive does not look new which IMO is nuts because if you are paying to have someone swap out a drive then you should make sure you get a new drive. They usually don't cost that much.

Maybe I'm off base here. I suggest you wait for some more opinions before coming the a conclusion.

yeah you're right. I don't think the software is lying. they've said it is brand new, if the working hours were like 10-20 I wouldn't bother returning the hdd, but 400+ hours...
I told him to take the laptop to the shop and show them the screen, and clarify this.

thank you very much BitJam

They may have run a burn-in test on the "new" HDD. But 400 hours is over 16 days. How long did they even have the computer in their custody?

Normally if a repair shop replaces a component they also return the old defective one to the customer. They also contact the customer and get pre-approval prior to swapping parts. If they didn't give your friend the old HDD back, that raises suspicions. It sounds like they may have scammed your friend just like unscrupulous auto-repair shops do, or used to do.

Regarding the original question, I think even copying with rsync preserves the original files' date and time stamps.

(I tried the rice trick on my wireless mouse after I got water in it from cleaning the outside. It helped somewhat, but it took me an hour to get the grains of raw rice out of it that had gotten inside the works. I ended up just using a hair dryer on it. There were still a few grains of rice in it a moment ago: I could hear them rattling around when I shook the mouse. I just got them out: no more rattling.)

JayM wrote: Mon Oct 28, 2019 5:09 am They may have run a burn-in test on the "new" HDD. But 400 hours is over 16 days. How long did they even have the computer in their custody?

Normally if a repair shop replaces a component they also return the old defective one to the customer. They also contact the customer and get pre-approval prior to swapping parts. If they didn't give your friend the old HDD back, that raises suspicions. It sounds like they may have scammed your friend just like unscrupulous auto-repair shops do, or used to do.

Regarding the original question, I think even copying with rsync preserves the original files' date and time stamps.

(I tried the rice trick on my wireless mouse after I got water in it from cleaning the outside. It helped somewhat, but it took me an hour to get the grains of raw rice out of it that had gotten inside the works. I ended up just using a hair dryer on it. There were still a few grains of rice in it a moment ago: I could hear them rattling around when I shook the mouse. I just got them out: no more rattling.)

he says his laptop's been there for about 4 days.
and he also says that the repair shop did call him and ask for his approval, but they didn't return the old hdd to him, which is why he got suspicious at first place and asked me after that.
this is unfair, i mean whether the store has sold a second-handed hdd as a new one to him OR if the store has not changed the hdd and has sold his own hdd to himself again. both of these possibilities are unacceptable. I'll encourage him to take a legal action against the store.

and thank you so much for the info and tricks you shared JayM.

If he has an invoice and a warranty for the "brand new" one then no need to get into argument: "yes, you will , no we won't .." Just ask them once and do it legally. Generally the car services (garages) do tricks like that, which's so frustrating.

Good ones ask you even when the old part is absolutely "rubbish" : "would you like us to throw it in the rubbish box or would you like to do it yourself?, it's here..". Because it still belongs to you no matter it's old or rubbish. You decide what to do. (For example on car parts you may want to strip it and reuse some smaller parts in it etc.. )

Huckleberry wrote: Mon Oct 28, 2019 8:59 am If he has an invoice and a warranty for the "brand new" one then no need to get into argument: "yes, you will , no we won't .." Just ask them once and do it legally. Generally the car services (garages) do tricks like that, which's so frustrating.

Good ones ask you even when the old part is absolutely "rubbish" : "would you like us to throw it in the rubbish box or would you like to do it yourself?, it's here..". Because it still belongs to you no matter it's old or rubbish. You decide what to do. (For example on car parts you may want to strip it and reuse some smaller parts in it etc.. )

they didn't give him any physical warranty papers for the hdd,they've just told him that there's a serial number on the hologram on the back of the drive, and they did give an invoice.

we made a phone call to the store yesterday and asked for clearance, the guy behind the line told us that:

"... yes, we know that your hdd is used, that's a refurbished hdd we installed on your laptop because nearly all of the hdds being sold today on the market are refurbished and you can not find an actuall 'new' hdd..."

I can't judge this statement because I'm not sure what he says is true or false.

is he true about the refurbished thing?

Lupin wrote: Tue Oct 29, 2019 2:55 amis he true about the refurbished thing?

NO! It is a lie. Go to Amazon or NewEgg. New hard drives galore!

How long has your friend had the computer? Can you estimate how many hours it has been on or how many times it was turned on? I seriously doubt the hard drive was damaged by the water. They are sealed. Their story about it being hard to get new hard drives is ridiculous. Perhaps they didn't even replace the drive. That's my guess now. That makes more sense than spending the time swap drives and rip you off with a "refurbished' one. I can't be certain but their story stinks.

Sorry.

An honest, scrupulous repair shop would have contacted your friend and asked for approval prior to doing any parts replacements. They would have said at that point that they planned to use a refurbished drive rather than a sealed brand-new unit, rather than surprising their customer afterward.

Hard drives are available as new, refurbished, recertified and used. Refurbishing means that a used drive was opened up inside of a clean room and everything inside the case was replaced with new components. Recertification means that a used drive was tested and found to be free of defects and has been certified as such. Both of these will then have an additional sticker affixed to the drive stating that it was refurbished or recertified as the case may be. Used is self-explanatory: you get what you get and good luck to you.

While it's true that replacement drives due to in-warranty repairs are almost always refurbs or more often recerts rather than brand-new ones it is certainly possible to buy brand-new drives in sealed anti-static bags with a full factory warranty. If the person you talked to said otherwise they were either lying or you misunderstood them.

I would say that if the computer is now working OK, then great, but I would certainly do regular backups of data (which your friend should have been doing all along anyway.) I would also no longer do any business with that repair shop as they seem to be less than straightforward with their customers.

I had the CPU fan repaired in my current computer, a 9-year-old 15.6" HP laptop that was given to me due in part to it not working because of the fan being DOA. The repair shop gave me a (quite low) cost estimate over the phone including parts and labor so I took it to them one morning a couple of days later. The next afternoon the tech texted me saying he would first attempt to repair the original fan but would replace it if he couldn't fix it, gave me price quotations for both scenarios when I asked for them, and he asked for my approval before continuing. The following morning he texted again saying he had repaired the fan (it had a blown capacitor on the fan controller) and I could come and get it. Before working on it the tech recorded details including serial numbers of its AC power supply, battery, memory modules, wifi card and hard drive and gave me a copy, then verified them all again before releasing the computer to me. He also demonstrated that the fan was working and that the computer was able to boot up and run.

About a year and a half ago I bought a slightly-used Asus 13" ultrabook (which I've since sold) from the same person who gave me the HP (my sister-in-law.) She had taken it to a local authorized service center as the fan for its Nvidia GPU (this was one of those dual-GPU bumblebee machines) was noisy. As she was leaving town I was the one who went to get the machine when it was repaired (I had an acknowledgement receipt of sale.) They had replaced the fan and gave me the old defective one back, not that I had any use for it but that's what an honest shop does: return defective parts that were replaced to the customer as they're their property. Your friend's shop will probably just wipe the data from the old drive, maybe do a SMART test on it, then sell it to someone else as "refurbished."

BitJam wrote: Tue Oct 29, 2019 4:03 am

Lupin wrote: Tue Oct 29, 2019 2:55 amis he true about the refurbished thing?

NO! It is a lie. Go to Amazon or NewEgg. New hard drives galore!

How long has your friend had the computer? Can you estimate how many hours it has been on or how many times it was turned on? I seriously doubt the hard drive was damaged by the water. They are sealed. Their story about it being hard to get new hard drives is ridiculous. Perhaps they didn't even replace the drive. That's my guess now. That makes more sense than spending the time swap drives and rip you off with a "refurbished' one. I can't be certain but their story stinks.

Sorry.

JayM wrote: Tue Oct 29, 2019 4:46 am Hard drives are available as new, refurbished, recertified and used. Refurbishing means that a used drive was opened up inside of a clean room and everything inside the case was replaced with new components. Recertification means that a used drive was tested and found to be free of defects and has been certified as such. Both of these will then have an additional sticker affixed to the drive stating that it was refurbished or recertified as the case may be. Used is self-explanatory: you get what you get and good luck to you.

thank you BitJam and JayM for sharing info and your experiences, it is really valuable.

I just asked him about his usage, he told me that he bought this laptop about 4 year ago (it is a HP Pavilion TouchSmart 15-n013dx) and he's barely used it over 80-100 hours approximately during these years, he's just used it for watching family pictures and movies time to time.

BitJam wrote: Tue Oct 29, 2019 4:03 am I seriously doubt the hard drive was damaged by the water. They are sealed.

BitJam wrote: Tue Oct 29, 2019 4:03 am Perhaps they didn't even replace the drive. That's my guess now.

JayM wrote: Tue Oct 29, 2019 4:46 am I would say that if the computer is now working OK, then great, but I would certainly do regular backups of data (which your friend should have been doing all along anyway.) I would also no longer do any business with that repair shop as they seem to be less than straightforward with their customers.

I've another unanswered question to come to a solid conclusion about whether the store has really changed the hdd or not, we can't charge them right now, and we don't know what brand/model the old hdd was.
considering the real cause of this incident in more details, which is that the laptop was left outdoors under the rain for 24+ hours, is there a any possibility for the hdd to crash? because the repair guy also told us yesterday that :
".. the hdd had crashed because of water and humidity, we had no choice but replacing it with another one and recovering all your data into the new one.."

the replaced hdd is now a Hitachi travelstar 500GB, we don't know what hdd model/brand this particular laptop had when it came out of the company. and I think it's a hard thing to find...

I think first of all, it is my friend's fault for not letting me or someone else know about this incident before he takes the laptop to the repair-shop. he didn't even turn the laptop on to see whether it runs or not after it was dried for 48 hours, he's gone straight to the shop. and that's why it's hard now to know if that hdd was really faulty or not. only the repair guy knows and I don't think If ever we ask him he will be telling the truth.

It's certainly possible that moisture was affecting the old hard drive and that the shop tech was just lucky to be able to get it to run long enough to access and copy the data from it before it failed. I've had that happen before with a drive that was failing but not completely dead yet.

At this point I would just let it go. The laptop is working now, which is the main thing. But I would advise your friend to avoid going to that repair shop in the future because they replaced parts without an authorization to do so, then didn't give back the old parts after the repair job was completed.

(It's also your friend's fault for leaving his laptop outside in the rain for a day. )

JayM wrote: Tue Oct 29, 2019 6:04 am It's certainly possible that moisture was affecting the old hard drive and that the shop tech was just lucky to be able to get it to run long enough to access and copy the data from it before it failed. I've had that happen before with a drive that was failing but not completely dead yet.

At this point I would just let it go. The laptop is working now, which is the main thing. But I would advise your friend to avoid going to that repair shop in the future because they replaced parts without an authorization to do so, then didn't give back the old parts after the repair job was completed.

(It's also your friend's fault for leaving his laptop outside in the rain for a day. )

I totally agree, I'm still wondering why would someone leave his laptop in the backyard in a rainy day! weird! but that's how he explained it to me.

Okay then ,I think i got all necessary answers , and I should tell my friend to forget all about this due to lack of proof(which is his own fault too). but i think we have the right to ask the store to replace the hdd with a new hdd not a refurbished one, and I hope they don't reject this.

Anyways, I thank all you guys for the info you shared. cheers

Lupin wrote: Tue Oct 29, 2019 6:57 amOkay then ,I think i got all necessary answers , and I should tell my friend to forget all about this due to lack of proof(which is his own fault too). but i think we have the right to ask the store to replace the hdd with a new hdd not a refurbished one, and I hope they don't reject this.

I think this is your best course of action. Unfortunately. I would even skip asking for a new hd from such unscrupulous people. They may "spit in the salad" so to speak. That hd is still young enough and fine even if it is the original one. Disk drive lifetimes (in usage) are 20,000 hours or more so you've used only 2% or less. IMO the risk in asking them to actually replace it far exceeds any possible real-world gain you would get even if they were competent and honest (both of which I highly doubt).

Perhaps you can buy a punching bag instead to get out some of the frustration.

On the plus side the laptop is working. it has all of the original data, and that drive will likely last many more years. The other components may become obsolete before the hard drive wears out.

BitJam wrote: Tue Oct 29, 2019 4:32 pm I think this is your best course of action. Unfortunately. I would even skip asking for a new hd from such unscrupulous people. They may "spit in the salad" so to speak. That hd is still young enough and fine even if it is the original one. Disk drive lifetimes (in usage) are 20,000 hours or more so you've used only 2% or less. IMO the risk in asking them to actually replace it far exceeds any possible real-world gain you would get even if they were competent and honest (both of which I highly doubt).

Perhaps you can buy a punching bag instead to get out some of the frustration.

On the plus side the laptop is working. it has all of the original data, and that drive will likely last many more years. The other components may become obsolete before the hard drive wears out.

thanks for your reply BitJam.

he decided to skip that request and just go with it. I felt sorry for him but i think he learnt a good lesson.
he called me about an hour ago and told me that he's decided to sell this laptop and buy a new one cause he is feeling bad about it after that incident.(which is non of my concern cause it's his property)


Mod note: part of post removed due to being offensive, you can contact forum staff if you wish.

Just had to apologize everyone who was offended by that last line of my last post. I respect women, I'm not an anti-feminism, I really feel ashamed now.

Thank you, and it is ok. You didn't get slapped with that fish I swing around, so ... don't feel too bad now

Water over the damn dam!

Nothing to see here, folks, just move on...