Hi, I am in sort of problem right now. I purchased an open box laptop from a shop and my mistake that I had not verified the specs at the time of purchase. After a use of about 3-4 days, it revealed that it was a different laptop packed in wrong box.

I went to shop; they are not able to help me as

1. There are some of my Microsoft Word files they have recovered from my system showing a date created before the date of purchase. (I removed all of my data before bringing to the shop). I checked at my other PC, all of the dates they are quoting are in fact date modified. Technical staff at shop is not buying this reason.

BECAUSE

2. They are saying that they found these files in a formatted partition. I am unable to get it as I never formatted the Hard disk of this laptop. And the partition was formatted well before the date of purchase.

I hate being implied as a thief if I am not. Any one who has gone through these things or know any such mechanism they can result in this odd situation.

If they were a real shop, I'm sure they were aware of what they were really selling. Semi-dishonest people will back down when caught. Truly hard-core thieves will accuse you of being a thief. I seriously doubt they are going to do a forensic investigation, they are just trying to intimidate you into going away.

Then again, how different was the Laptop from what it was supposed to be?

It was Intel Core 2 T5250 @ 1.5 , 2GB RAM, 150 GB HD compared to AMD TURION TL-62@2.1, 4GB RAM and 250 GB HD .. and i purchased the things at Best Buy in Canada

If you bought an open box and it could have a used drive inside.
Even if you format your drive, there is 99% chance to recover files that have been fomated before.
Your case is very difficult due to the fact that you had totally different machine inside a box.

I would recomend calling corporate office of Best Buy and talk to them, they might be more polite to a customer.

_________________
www.datarecoveryne.com

Hmmm .. I will sure contact the CS of Best Buy.

Can you please tell me .. Have you ever heard that .. A file is deleted and on recovery it is found in Formatted Partition and the computer was never formatted after that delete. Is there any theoretical reason for this ..

Since this was an open box, and there are files on there from before you purchased it, it would make sense from their evidence that they sold it to someone, that someone returned it, and then they sold it to you.

Anyway, if you're asking if a file can be recovered after being deleted, yes. Deleting a file simply removes the 'link' to it, and marks the space it takes up as usable for data. The file is still on the drive, unless if you purposelfuly overwrite it, or by using the computer the space occupied by the deleted file gets overwritten.

If i understand correctly 'Formatted Partition', then as far as i know .. Every partition is to be formatted before being used. So if they find a deleted file on system .. it is not a big deal .. i used laptop for three days. Then why the guys at Best Buy are accusing me.

May be they mean that this recovered file is a remnant from some previous format. I never formatted it .. just copied the file on system and moved it to another device. Is it by any means possible to get this file associated to some previous format incident.

Best Buy Technicians are Geek Squad. From my experience, Geek Squad are complete idiots. I suspect they hire people off the streets with no experience, and I've heard they don't even bother to train them. There MIGHT be a good tech in there, but if they were really good, they'd soon work elsewhere. Feel free to tell them so.

As for what you're asking, either something is getting lost in translation, or it's complete BS. If I understand you right, they are saying that you created a separate partition, put data on it, formatted it, and they can somehow tell that you did that. Even if they could do that, so what? If it was in your posession, and you owned it, you can format it 50 times if you want. If you had any spyware problem, and called your Laptop's tech support, they likely might have talked you through formatting it. If you had Geek Squad work on it, they might have formatted it too. If your dispute is about the specs of the computer, what you did with it the past 3-4 days has nothing to do with it.

I'm not sure why it's relevant, but if you created a partition, put data on it, and simply formatted the partition, you can recover the partition and see files, and file dates with the right software. That means you'd either have an extra drive on your computer, or unused space on your drive, which can be seen in Control Panel -> Administrative Tools -> Computer Management-> Disk Management. Make them show you. If it's not in space that's not part of a partition (And their tools likely wouldn't tell them that), or you don't have a second drive letter that's got a partition on it, then they can't tell. They might be able to find old files, but they won't be able to say it was from a formatted partition unless if one of those two things are true.

I'm reaching here, but maybe this is what's happening... Many new computers come with a hidden partition, used for various purposes. Often, it is used to restore the computer to like-new condition. (This genius move is so they don't have to give you a $1.00 CD that will do the same thing). Sometimes, this partition backs up some files from your main partition. Maybe that is what they saw?

Anyway, either a big part of the story is missing, or they are BS'ing you. From what you described, they didn't even have a reason to look for hidden partitions, other than maybe to look for the identity of the person who had it before you.

One last part... Changing the system date is a trivial task. Since someone can change the date, and then save files, format partitions, etc, this certainly isn't definitive evidence of anything.

Yeah .. That was the perfect, most precise answer i sought whole day. I appreciate your support.

They scanned the computer to verify that there are no files belonging to me before the date of purchase. Now the whole scenario is clear to me and your reply has provided me with ample stuff to reason with geeks.

I again appreciate your support. If i get any problem again then will post message tomorrow in this thread. Danke!

After a long consultancy,
A single word to say, "Data is recovered until it is overwritten" After deleting data is recoverable 100% successfully. You need right software and you need proper information about the deleting period (if difficult task), you need experience/technic (if data could not be recovered in one chance by the software)

The link might help you regarding this information...
http://forum.csebd.net/viewtopic.php?f=13&t=44

_________________
__________
There is no substitute for education and experience
THANK YOU
SHAHI
shahi.mahbub@gmail.com

If the partition is formatted by Windows with high-level formatting, the data may be recovered.
If it is low-level formatting(physical formatting), the data will not be recovered.

_________________
Data Recovery Wizard
Partition Table Doctor
EASEUS Partition Manager
http://www.easeus.com/

In data recovery the data is recovered against the 'Date Modified' or against the 'Date Created'? Because, they recovered a word file which was modified on January 21, but i copied it on that hard disk on June 16th. After recovery it is showing date of January 21.

So, this makes me guilty in their books as the laptop was purchased by me on June 13 and recovered file is dating to January 21.

I think that the File data contains only 'Date modified', as logically it is the 'Only absolute time information' in the file structure. So when file is recovered it refers to the date in file data structure not the date when it was created on the Hard Disk. What is your opinion?

I guess the fundamental principle here is that Best Buy are "alledging" that you bought the open box laptop, took it home, swapped it for another machine, put that old machine back in the box and then returned it claiming they sold you the old computer.

Not sure which jurisdiction you are in, but guessing US. In the UK you might be able to hold them to a Property Misdescriptions claim....but clearly there needs to be some independent verification as to the heritage of the computer you are returning.

Forensically, one might check:
(a) Event log (application, security, system) for time based evidence
(b) Entries in $MFT file
(c) Date of manufacture of hard disk and components/PCB of the laptop

etc etc...

Yeah you are right .. they are accusing me of fraud. I went to the shop today and the tech is saying

"Our data recovery software can recover all low level format layers and data of magnitude up to 600 GB on a 120 GB HD. Your files, which we recovered, were behind a low level format layer. This format was done before the date of purchase. How can you Explain it?"

I have no idea what to say. I never formatted it. How the data moved behind a format layer.

They have s/w that can recover 600Gb of data from a 120Gb drive that's been low-level formatted?

BULL-CRAP!

_________________
PC Image Data Recovery
http://www.pcimage.co.uk

New!! HDD-PCB.COM for all your PCB and donor HDD requirements!

Look at the created date of the file ..
when coping files from one hard drive to another ..the modified date
stays as it was .. the created date becomes the date it was copied.
SO..if the created date is newer than the modified date , that is proof that the file was copied from another location

Yeah .. that is very true .. I have now started to develop a feel that either the guys are extremely incompetent or they are just saving some thief amongst them.

Anyways, is by any means existence of following scenario is possible?

Step 1: Disk is high level formatted
Step 2: A file is copied after format
Step 3: File is deleted/moved from the HD
Step 4: File is recovered by using some data recovery software.

and the file recovered is behind high level format layers created in step 1.

If you computer was opened and used before, there have to be files created before your purchase date.
This is very common.

_________________
www.datarecoveryne.com

if you didn't format the drive , it's not even that complicated.

1.You copied a file to the drive .created date is the date you copied it .. modified date is the date you last modified it on other computer.
2.You deleted the file ..( the file is not really deleted even if you emptied the recycle bin)
3. I guess they could have some data-recovery software
but if they had any idea what they are doing , they would know that the creation date CAN'T be AFTER the modified date if it was created in that location..

4 Best-Buy ( Geek Squad ) don't know their ass from a hole in the ground ( in my opinion )


Even if it was a NEW computer , there would be files dated before the purchase ( depending on the OS , they could be 2 years old or older)
if you format a drive and install windows , there will be OLD dates on the drive(even if the drive was zeroed out)

A fresh operating system was on the computer. So, there were no visible user files. It went okay. I copied my data on laptop and on knowing the configuration of computer, i moved my whole data to an external HD.

They have recovered that all, recovered files are showing the modified dates as the date of creation. Which is understandable as files meta data contains only modified date. Created date is relative to the system. Up till here, there is no problem.

Problem arises when they say, "The recovered files were detected behind the last format layer", implying that at the time of last format the system was in my possession and the date of last format is before the date of purchase.

I am unable to get it, as i never formatted the HD. Is there any possibility/theoretical explanation for this.