Chapter 13 — Exercises

A mix of concept checks, equipment-and-pricing calculations, hands-on labs (verify a signature, calculate and verify a hash, build a delivery timeline, write the report), and judgment calls — because the recovery business is more decision tree and conscience than technique. (answer in Appendix) = worked solution in Answers. ⭐ = stretch. Where a lab references a practice image, see Appendix J — Practice Images and Lab Setup. Do every hands-on exercise only on devices and media you own — the same custody-on-every-job discipline that protects a client protects your own bench.

Group A — The industry and the capability ladder

13.1 Data recovery is unusual among technical trades in two specific ways that shape every business decision in this chapter. Name both, and then explain in three or four sentences why, taken together, they make trust the only real credential a recovery shop has — and why that trust is "earned transaction by transaction and destroyed in a single bait-and-switch." Finally, given that the customer cannot diagnose their own drive and cannot tell you apart from a charlatan by any external credential, name three observable behaviors of your process (not claims, but things the customer can actually witness) that a discerning customer could use as honest signals of competence. (answer in Appendix)

13.2 Reproduce the four-tier capability ladder from memory: for each tier give its one-line capability ("read the drive / fix the drive / open the drive / take anything"), its rough capex band, and the single defining piece of equipment or environment. Then state the structural rule that links the tiers ("each tier needs the one below it") and give a concrete example of why it is true — e.g., why you cannot do a head swap without first being able to do logical recovery on the image you pull off the patient. Finally, state which tier most shops actually occupy, and describe the two honest ways a Tier 1 shop handles the Tier 3/4 work it receives (referral fee to a partner lab, or a small markup as the customer-facing contact) — and why neither is "shameful."

13.3 ⭐ A counterintuitive fact runs the economics of this business: most jobs are logical (Tier 1), but most of the revenue and margin live in the hardware tiers (2–4). Explain the paradox in your own words, then state the two sustainable responses to it (climb the ladder deliberately, or specialize narrowly). Name two narrow specializations where expertise commands a premium and competition thins, and explain why a shop that drifts upward "by accident" — advertising rungs it does not actually stand on — is both a business risk and an ethics problem.

Group B — What it costs to open the doors

13.4 (Calculate.) Itemize and total a Tier 1 logical bench you would actually trust your own family's photos to: one hardware write blocker, one imaging workstation with enough fast scratch storage to clone every drive you take in, a dock/adapter kit, one commercial recovery license, and ESD protection. Put a defensible dollar figure on each line, total it, and write one sentence explaining why that number is "the floor under every quote you will ever give." (answer in Appendix)

13.5 The equipment is the part new owners budget for; the part that sinks them is everything else. List five non-equipment recurring or hidden costs and give one sentence each on why it matters: errors-&-omissions / professional-liability and cyber/data-breach insurance; secure access-controlled storage; climate, power, and a UPS; destination media as a per-job consumable; and time-before-revenue (training, sacrificed practice drives, reputation-building). Then do a small calculation: if you take in 20 jobs a month and deliver each on its own new drive while keeping a working image until the job closes, roughly how much storage do you consume in a month for an average 1 TB job — and why is "destination media" a line item that never goes to zero, unlike the one-time write blocker?

13.6 ⭐ A "dead" drive arrives. To a Tier 1 shop, a firmware-bricked drive and a mechanically failed drive can look identical (both undetected by BIOS, both "won't come ready"). Explain how the two failures differ at the level of what is actually wrong, name the class of tool that addresses each (a professional imager / a firmware-repair suite such as the PC-3000 family for the electronic case; a clean bench and donor for the mechanical case), and explain why "budget for the learning curve, not just the purchase" is the real lesson of Tier 2 — including how a misused firmware tool can convert a recoverable drive into a paperweight.

Group C — The cleanroom: myth vs. reality

13.7 (Calculate / scale.) A modern read/write head flies roughly 3–10 nm above the platter; a tobacco- or oil-smoke particle is roughly 500–1,000 nm. Compute the approximate ratio of particle size to flying height, and use it to defend the chapter's "boulder on a runway under a landing jet" analogy. Then state precisely why a platter scraped by a head riding over such a particle is unrecoverable — what physically happens to the data in that track, and why no software, firmware tool, or price brings it back. (answer in Appendix)

13.8 The relevant cleanliness standard for opening drives is ISO 14644-1, and internal hard-drive work is done at ISO Class 5 — the modern equivalent of FED-STD-209E Class 100. State the particle limit that defines ISO Class 5 (particles ≥0.5 µm per cubic meter), state roughly how dirty ordinary indoor air is on the same scale (ISO Class 8–9), and explain in two sentences why a head swap specifically demands Class 5 rather than "a tidy room." Then distinguish the two filter grades you will see quoted — HEPA (99.97% at ≥0.3 µm) and ULPA (99.999% at ≥0.12 µm) — and explain why ULPA is the better choice for this work given the particle sizes from Exercise 13.7.

13.9 (Judgment.) Most reputable shops do not own a walk-in cleanroom — and that is correct, not a corner cut. Explain what a laminar-flow clean bench actually does (draw room air through a HEPA or ULPA filter, push it down across the work surface as a unidirectional curtain that sweeps shed particles down and away from the open drive), give the rough cost band, and state when a six-figure walk-in room would be over-building. Then explain the "clean window" limitation: why contamination is cumulative and time-dependent, why a clean bench protects the air but not your bad habits, and why opening a drive is a chance you take once.

13.10 ⭐ (Judgment.) A customer brings a clicking drive that a previous shop "tried in a clean environment" — a bathroom with the shower running for steam, on the theory that humidity settles dust. The platters now show a perfect circular scrape. Explain exactly what went wrong physically (redeposited debris in the flight path, head contact, magnetic material gouged off), why the data in that band is not "hard to recover" but gone, and what you tell this customer about prognosis now. Then write the two-sentence honest statement you would give any customer about what opening a drive does and does not promise.

Group D — Pricing models and the evaluation

13.11 Compare the three pricing models — flat fee, tiered by difficulty, and no-data-no-charge (NDNC). For each, give one strength and one failure mode. Then explain why "tiered, with NDNC and a firm quote before any billable work" has become the honest consumer standard, and why a pure flat fee is honest "only if your work is genuinely uniform — which recovery never is." (answer in Appendix)

13.12 (Judgment.) NDNC has sharp edges that must be defined in writing. For the wedding-photos job, write an explicit, concrete definition of "success" (not "we recovered something" but a target-file threshold the customer agreed to). Explain why a vague threshold becomes a dispute when a drive yields, say, 400 GB of unreadable fragments and zero openable photos, and state two ways NDNC is not "no cost" (parts/donors, possibly evaluation or return shipping) that you must disclose up front.

13.13 (Calculate.) Using the chapter's Job quote model (base bands: logical 100–600, firmware 300–1,200, mechanical 700–3,000, complex 1,000–5,000; +25% on both ends if capacity > 4,000 GB; donor adds +150 low / +400 high; rush ×1.5; emergency ×2.5), verify by hand that the mechanical, 2,000 GB, donor-required job WED-0931 produces the pre-evaluation band (850, 3400). Then compute, showing the arithmetic in order, the band for: (a) a logical 8 TB (8,000 GB) job, no donor, standard turnaround; and (b) ⭐ a mechanical 2 TB emergency job that needs a donor. State in one sentence what the evaluation then does to that wide pre-eval band.

13.14 (Write the report.) A 2 TB SATA drive arrives with the symptom "files disappearing, drive getting slow"; your read-only image attempt shows rising bad-sector density but the drive is electronically and mechanically alive — a firmware/degraded-media job, prognosis good if imaged carefully now. Write the EVALUATION RESULT block the customer actually receives, following the chapter's format: device, serial, symptom, findings, tier, prognosis, firm quote (or tight not-to-exceed band), NDNC terms, turnaround, the customer's stated targets, and the explicit next step. Then write the single authorization_text sentence the customer signs, generated from the same numbers as the quote — and explain in one sentence why keeping the customer-facing words and the bench's price logic in one source of truth is what closes the gap "between what the front desk said and what the back room charged."

13.15 ⭐ (Judgment.) Describe the classic bait-and-switch in its usual shape ("$300 flat data recovery!" → drive shipped → "unfortunately yours is a *Level 4 critical* failure, it'll be $1,900") and the opposite shape that marks an honest shop (free or low-cost evaluation → firm quote you approve before any work → NDNC on the recovery → drive back on request, no hostages). Then write the two or three sentences you actually say to a customer who is comparison-shopping you against a too-good price — describing how your process protects them, without trashing the competitor by name.

Group E — Managing the human

13.16 (Write the communication.) Write the three sentences you will say to a frightened, possibly crying customer before you ever face one: your acknowledgment line (you get what the data means), your honesty line (you operate on truth, not hope-merchandising), and your "first, do no harm" line (what you will and will not do to the drive). Then explain in two sentences why rehearsing these until they are reflexive beats improvising under stress. (answer in Appendix)

13.17 (Judgment.) Customers say "everything"; they rarely mean it. Write the single triage question that uncovers the real target behind "everything," and then explain the three things triage accomplishes: it lets you prioritize recovery effort, it gives the customer a meaningful win even on a partial recovery ("300 of your 340 NICU photos" vs. "78% of your sectors"), and it defines the NDNC success threshold concretely. Give one example of a "everything" that was really a "these specific things."

13.18 Customers arrive having already "tried things." For each of the four common DIY myths — the freezer, repeated power-cycling, running consumer recovery software on a failing drive, and the DIY open — state in one or two sentences the specific harm it does (condensation/added head-contact; spending finite remaining life; finishing off marginal hardware and overwriting recoverable data; contaminating the platters) and the kind way you correct it without scolding a customer who already feels guilty. Then name the single most damaging thing a panicked customer commonly does, justify your choice, and write the one-sentence "none of this is your fault" framing you would lead with before correcting any of these myths.

13.19 ⭐ (Judgment.) Write a one- to two-sentence "guarded but real" prognosis for a mechanical job whose odds genuinely depend on a donor match you do not yet control — neither crushing hope nor inflating it. Then explain the under-promise/over-deliver rule using turnaround: contrast the customer told "ten days" who hears from you on day six with the customer told "two days" who hears nothing on day three, and state why you quote the dependency (donor sourcing) rather than a fantasy date.

Group F — The workflow: image-first, verify, hash

13.20 "You are not preparing for court; you are recovering a grandmother's photos — image first anyway." Explain the recovery reason for image-first (the original is the only irreplaceable safety net; if an attempt corrupts something you re-image and retry, whereas a mistake on the original is permanent) and the forensic reason (admissibility), and then explain why these are literally the same act — the chapter's signature Recovery-vs-Forensics lens — and why a shop that images-first by habit can pivot to a forensic posture "without having destroyed anything." As a concrete check, describe what is irreversibly lost if a shop instead "just plugs the original in to take a look" on a job that later turns out to be evidence — name at least two specific things that booting the original can change, and why their alteration is unprovable-after-the-fact. (answer in Appendix)

13.21 (Recover from this image / verify the signature.) A recovered file's first bytes are:

00000000  FF D8 FF E1 22 7E 45 78  69 66 00 00 49 49 2A 00   ...."~Exif..II*.

(a) Identify the file type and say what FF D8, FF E1, the ASCII Exif, and II 2A 00 each tell you. (b) Give the two-byte marker that ends such a file. (c) Explain why confirming the Exif block — not just the SOI marker — lets you tell a parent "these are really the NICU photos from that winter" rather than random fragments. (d) Write the file and exiftool commands you would run to confirm structural validity and read the capture date/model/GPS.

13.22 (Calculate and verify a hash.) Build a delivery manifest over a recovered folder and then audit a copy against it. (a) Write the one-line PowerShell that hashes every recovered file (SHA-256) into a CSV manifest the customer keeps, and the two hashdeep commands that build a manifest and then audit the customer's copy. (b) State exactly what a hashdeep audit exit code of 0 proves, and what a non-zero exit tells you to do. (c) Explain in two sentences why this few-minute manifest is "dispute-proof" when the customer later says "a file is missing" or "this one's corrupt." (d) Bonus: compute the SHA-256 of the ASCII string WED-0931 with any tool and record the value, simply to confirm your hashing toolchain works. (e) Explain in one sentence why a pure recovery job — with no court in sight — still benefits from hashing the delivery, and one reason you would choose SHA-256 over MD5 for the manifest even though either would catch an accidental change.

13.23 (Build the timeline.) You carve and recover six photos for a client; their Exif CreateDate values are 2016-07-09 16:20 (the wedding), 2014-03-02 11:05, 2019-11-30 08:14, 2016-07-09 15:58, 2021-05-17 19:43, and one file with no Exif date at all. The client's last external-drive "last write" timestamp is 2021-06-01. (a) Put the dated photos in chronological order. (b) State which would and would not plausibly predate the client's last-write date, and why that matters for setting expectations. (c) Explain what the Exif-less file's missing date does and does not tell you about when the photo was taken. (d) ⭐ Name one filesystem or carving artifact (MAC times, a filename counter, folder position) you might use to place the undated file, and one reason that placement is weaker evidence than an Exif capture date.

13.24 (Judgment.) During an ordinary recovery you encounter what appears to be child sexual abuse material (CSAM). Reproduce the correct first-response sequence in order — STOP → SECURE → DOCUMENT → DO NOT (investigate / delete / alter / warn the customer) → CONTACT (law enforcement and/or the NCMEC CyberTipline, plus your attorney) → PRESERVE — and explain, clinically and without describing any content, why "looking through it just to gauge the scope" is both ethically wrong and legally perilous (knowing possession and further copying are themselves crimes under 18 U.S.C. §§2252/2252A). Note which chapter owns the full ethical and well-being treatment. (answer in Appendix)

13.25 Explain the scope of the federal mandatory-reporting statute 18 U.S.C. §2258A: whom it binds by its terms (electronic-communication and remote-computing service providers), and why a data-recovery shop's likely status outside that definition is not permission to do nothing. Name the other source of obligation that often applies (state laws imposing reporting duties specifically on computer technicians / IT professionals), and state the two things you should do before you open your doors rather than after a discovery (learn your jurisdiction's law; retain a relationship with an attorney who understands these duties). Then explain why "I'm not a §2258A provider" is a dangerously incomplete answer on its own, and why — whatever the statute's literal scope — stop-secure-document-report remains the only defensible course for both the victim's sake and your own legal protection.

13.26 (Judgment.) Most of what you see is legal but intensely private — medical and financial records, intimate photographs, a third party's data on a drive your customer owns, a business's trade secrets. State the four professional duties that govern this material (data minimization / scope discipline; confidentiality, including NDAs for business clients; defined retention followed by secure destruction; and recognizing regulated-data triggers). For the last, name what may attach the moment you touch the data: a HIPAA Business Associate Agreement, GDPR processor duties, a CCPA/CPRA service-provider role. Then work a concrete case: a consumer's drive you are recovering also contains a folder of another person's medical records (a relative's, say). State whether your confidentiality and minimization duties change because the records belong to a third party rather than your customer, whether handling them could make you a HIPAA business associate, and what you do and do not say to your customer about them. Finally, explain why "I was just checking that it opened" is not a license to browse a stranger's life.

13.27 ⭐ (Recovery vs. Forensics — when a recovery quietly becomes evidence.) You take in a businessman's corrupt QuickBooks file as a routine recovery; three months later a subpoena arrives because that file is at the center of his divorce — or you take in a departing employee's laptop drive that turns out to be anchor #2, the IP-theft matter. (a) Explain why the custody-log-on-every-job habit is what lets you become a credible witness rather than a liability. (b) State the first three things you do (and do not do) the moment you realize a job may be legal. (c) Name the chapters that own the chain-of-custody rigor and the legal/ethical duties you now need.

13.28 (Progressive project — professional-practice interlude.) The Forensic Case File does not advance in this chapter; it resumes with formal acquisition in Chapter 14. Instead, if your path is 💾 Data Recovery, draft a one-page service agreement and price sheet for a hypothetical shop, containing all five required elements: (1) tier-based price bands and surcharges; (2) NDNC terms with an explicit written definition of "success"; (3) the evaluation process and turnaround tiers; (4) a liability limitation and an abandoned-property/return policy sketch (flagged for attorney review); and (5) a one-paragraph data-confidentiality and retention/destruction statement. Keep it to a single page the customer would actually read. Hold onto it for Chapter 37 and Chapter 40.

13.29 ⭐ (Judgment — limitations, knowing when to stop.) "The evidence is that this data is gone" is a valid, professional finding. Give three distinct, technically grounded scenarios in which it is the correct finding (a platter physically scraped by a prior head crash; an SSD whose controller TRIM-ed and garbage-collected the deleted blocks; data behind strong full-disk encryption with a lost key), and explain why saying so plainly and early serves the customer better than "a long, expensive, false maybe." Then connect this to the other two limits the chapter names — knowing the limit of your tier (refer out rather than gamble a customer's only copy) and the limit of your role (lawyer, law enforcement, therapist) — and why recognizing the edge of your competence is itself a core competence.

Self-check. You have mastered this chapter when you can do three things without notes: stand at a counter and convert a frightened customer's "my life is gone" into a tier, an honest prognosis, and a firm quote with a defined NDNC threshold; run an end-to-end workflow — image-first, recover on the copy, verify signatures, hash the delivery, and log custody on every job — and explain why each step serves both speed and admissibility; and execute, cold, the contraband first response (stop, secure, document, do not investigate, report, preserve) and the legal-but-private duties (minimize, keep confidential, retain then securely destroy). If the pricing math, the cleanroom scale, or the contraband sequence still feels shaky, re-read the matching section before you ever stand behind the counter. Next, Chapter 14 — Forensic Acquisition tightens the image-first discipline you have been practicing as good recovery hygiene into the courtroom standard that makes an image admissible.