Chapter 13 — Quiz

14 questions: 10 multiple choice, 2 true/false, 2 short answer. Answers and a scoring band at the bottom. No peeking until you have committed to an answer.

Multiple choice

Q1. Which statement best describes the regulatory landscape of consumer data recovery in most U.S. states? - A) A state board licenses recovery shops and certifies technicians. - B) It is almost entirely unregulated — no license to obtain, no statute saying who may call themselves a recovery company. - C) Only shops that operate a cleanroom must be licensed. - D) Federal law requires CHFI certification before opening a shop.

Q2. On the capability ladder, which tier of work specifically requires a controlled clean environment? - A) Tier 1 — logical recovery of deleted/formatted/lost-partition data. - B) Tier 2 — firmware repair and reading degraded media. - C) Tier 3 — physical recovery: head swaps, motor and platter transplants. - D) None — modern drives can be opened safely on any tidy bench.

Q3. Internal hard-drive work (e.g., a head swap) is done at which air-cleanliness class? - A) ISO 14644-1 Class 5, the modern equivalent of FED-STD-209E Class 100. - B) ISO Class 9, the same as ordinary indoor office air. - C) Whatever class a bathroom reaches with the shower running for steam. - D) BSL-2, the biosafety standard.

Q4. Why is a single particle of smoke or dust on a platter so destructive during a head swap? - A) It carries a static charge that erases the magnetic surface. - B) The read/write head flies only ~3–10 nm above the platter, so a ~500–1,000 nm particle is a "boulder on the runway" the head strikes, gouging the magnetic material off. - C) It blocks the SATA data signal. - D) It increases the drive's operating temperature past the failure point.

Q5. For a frightened consumer who cannot tell whether their job is easy or hopeless, which pricing approach is the most trust-building and has become the consumer-market standard? - A) A firm flat fee charged regardless of outcome. - B) An hourly rate billed from the moment the drive arrives. - C) No-data-no-charge on the recovery fee, paired with a firm quote before any billable work and no obligation to proceed. - D) A nonrefundable "diagnostic fee" taken up front.

Q6. What is the primary purpose of the evaluation (diagnostic) step? - A) To perform the recovery as quickly as possible. - B) To bill the customer for time before a quote is given. - C) To determine, by a bounded read-only, image-first investigation, the tier, prognosis, and therefore the price — so the quote can be firm before work begins. - D) To wipe the drive and start fresh.

Q7. Why should a recovery shop image the drive first and work on the copy, even for a consumer job that will never see a courtroom? - A) Because the law requires a forensic image of every drive. - B) Because the original is the one irreplaceable safety net — if an attempt corrupts something you can re-image and retry, whereas a mistake made on the original is permanent. - C) Because imaging is faster than reading the original directly. - D) Because customers always demand a forensic image.

Q8. A customer later claims "a file you delivered is missing or corrupt." Which delivery-time practice resolves the dispute cleanly? - A) A signed flat-fee receipt. - B) A SHA-256 manifest of the delivered set, so both sides have the hash list of exactly what was handed over, intact, at handover. - C) A photograph of the customer's new drive. - D) The customer's verbal confirmation at pickup.

Q9. During an ordinary recovery you recognize apparent CSAM. What is the correct first response? - A) Open more files to confirm and gauge the scope before deciding. - B) Quietly delete the material and finish the rest of the job. - C) Stop work; do not view further, copy, or alter; secure and isolate the media; document facts only; do not investigate or warn the customer; report to law enforcement / the NCMEC CyberTipline and your attorney; preserve chain of custody. - D) Confront the customer and give them a chance to explain.

Q10. Which statement about cleanroom requirements is accurate for most reputable recovery shops? - A) Every shop must build a six-figure walk-in ISO Class 5 room. - B) A laminar-flow clean bench, which creates an ISO Class 5 work zone a few cubic feet in size, is adequate for head swaps and is what most shops actually use. - C) A box fan and a furnace filter create an adequate clean zone. - D) Humidity from a running shower is an accepted substitute for filtered air.

True/False

Q11. A pure flat fee (one price for any recovery) fairly prices the work because nearly all recovery jobs cost about the same to perform. (True / False)

Q12. You only need to keep a chain-of-custody record on jobs you already know are headed to court. (True / False)

Short answer

Q13. In two or three sentences, explain why "image first, work on the copy" applies even to an emotional consumer job that will almost certainly never become a legal matter.

Q14. A customer asks why you cannot just give them a firm price over the phone from their description. Explain, in two or three sentences, why an honest shop evaluates before it quotes firmly.

---

Answer key

Q1 — B. In most jurisdictions there is no license, board, or statute governing who may operate as a recovery company; the low barrier to entry is real, which is exactly why trust must be earned transaction by transaction.

Q2 — C. Tier 3 physical work — opening the sealed drive for head/motor/platter work — is what requires the clean environment; Tiers 1 and 2 do not open the drive.

Q3 — A. Internal drive work is done at ISO 14644-1 Class 5, equivalent to the older FED-STD-209E Class 100; ordinary indoor air is ISO Class 8–9, thousands of times dirtier.

Q4 — B. The head flies ~3–10 nm above a surface spinning thousands of RPM; a ~500–1,000 nm particle is 50–300× that gap, so the head strikes it and scrapes magnetic material off the platter — permanently destroying the data in that track.

Q5 — C. No-data-no-charge transfers risk from the frightened consumer to the expert who can judge it, but it is only ethical when paired with a firm quote before work and no obligation to proceed — which together also defeat the bait-and-switch.

Q6 — C. The evaluation is a bounded, read-only, image-first investigation whose only goal is to set the tier, prognosis, and price so the quote is firm before any billable work — not to perform the recovery.

Q7 — B. The original is the only irreplaceable copy and your one safety net (theme two, the original is sacred); working on a verified image means a mistake is recoverable by re-imaging, whereas a mistake on the original is permanent.

Q8 — B. A SHA-256 delivery manifest gives both parties a dispute-proof record of exactly what was delivered and that it is bit-for-bit identical to what was recovered.

Q9 — C. Stop, secure, document (facts only, never the content), do not investigate or warn, report (law enforcement / NCMEC CyberTipline and your attorney), and preserve chain of custody. Continuing to view or copying the material is itself a crime under 18 U.S.C. §§2252/2252A; Chapter 28 owns the full treatment.

Q10 — B. A laminar-flow clean bench creates an ISO Class 5 work zone right where the open drive sits and is adequate for head swaps; a full walk-in room is overkill for most shops, and "clean" bathrooms, box fans, and steam are drive-destroying myths.

Q11 — False. Recovery difficulty (and cost) spans more than two orders of magnitude; a pure flat fee loses money on every cleanroom job and overcharges on every twenty-minute partition fix, so flat-fee shops in practice either refuse hard jobs, secretly tier anyway, or cut corners.

Q12 — False. You keep a custody record on every job, because the divorce drive, the IP-theft laptop, and the discovery of contraband never announce themselves at intake; the shop that logs everything can pivot to evidence handling, while the shop that did not has destroyed its own defensibility.

Q13 — Model answer. The original is the only irreplaceable copy and your single safety net: if a recovery attempt corrupts something, you can re-image from the untouched original and try again, whereas a mistake made directly on the original is permanent. It is the same image-first discipline forensics uses for admissibility, stripped of the legal language — and it lets you pivot to a forensic posture the day a "routine" consumer job turns out to matter legally, which happens more often than expected.

Q14 — Model answer. A drive's actual problem can range from a corrupt partition table fixable in twenty minutes to a seized motor needing a cleanroom platter transplant — a difference of more than two orders of magnitude in cost — and the customer cannot diagnose which they have. An honest shop runs a bounded, read-only evaluation to determine the tier, then gives a firm quote the customer approves in writing before any billable work; a firm price quoted blind over the phone is either a loss the shop eats or the first move of a bait-and-switch.

Scoring: 13–14 correct — you could open a trustworthy bench tomorrow; you understand the pricing, the cleanroom, and the duties alike. 10–12 — solid; revisit the pricing-models and evaluation sections and the cleanroom scale. 7–9 — you have the vocabulary but not yet the boundaries; re-read "Pricing: the most honest thing about your shop" and "The things you will find that you did not go looking for." Below 7 — re-read the chapter before any customer conversation; in this business the cost of getting it wrong is a customer's only copy and your reputation.