6 min read

How I got scammed buying drives from the orange site

How I got scammed buying drives from the orange site

Soooo, it's time that i should start writing technical things here, and there's no better story than the time i got scammed buying two Seagate Ironwolf Pro drives from 3rd party vendor.

Everything began when i wanted to build a NAS at home, i wanted redundancy because better be safe than sorry, and i wanted a decent storage, i compared prices and decided that the most cost-effective way to build it would be spend about 45k Turkish liras in total, yes that was a lot of money at that time.

So i bought the parts, 15k for the CPU, Ram, Motherboard, Case, SSD, and a cheap GPU, this was before the whole AI boom so the specs was decent but nothing too fancy, and then i found the drives i wanted for this, two brand new Ironwolf Pro 16TB drives, because i wanted to future proof my setup.

The drives were about 15k each, which wiped a good chunk of my savings, but all is well when you have the disposable income for it and want to learn new things, right?

Anyways, after ordering the drives, i built the system, minus the drives, patiently waiting for them to arrive. Eventually they arrived, looking back, i should've noticed there's something fishy as the drives had no serial numbers on the label, but lets give that to my inexperience and doing this for the first time.

I installed the drives to the box and booted ventoy to install TrueNAS, in which i should've noticed the second red flag of drives showing up as Toshiba instead of Seagate, but again, new homelabber excitement.

I useed the system like that for almost a year before i get an email from the NAS. Uh oh.

The email no sysadmin wants to see.

"Okay, that's weird, IronWolf Pro drives come with a 5 year warranty, they should not fail this soon, i'll check when i get back home" i thought to myself, reading the email from my phone as i was outside at that time hanging out, trying to relax and such.

Second email that a sysadmin never wants to see.

Uh oh #2, knowing that all my personal data is there, i immediately pay up my coffee tab and rush home to investigate. While on a red light, i get another email, i check it.

Third dreadful email

"Toshiba? i dont have a Toshiba drives there- oh shit green light" cue me nyooming my ass to home without catching another red light, thank god, finally i'm at home, can ssh into the box and see what the fuck is up. first, i run a ZFS scrub to see if it helps, which it does.

Alerts getting cleared, this is good.

Well from that point , i go ask Claude cause i'm still not that experienced and somewhat panicing. While i try to understand the full extend of things, i get another email.

Oh no, this is sdb, not sda like the previous ones

Well, shit, both drives have some sort of issue, let me just run a smart test, check smart data and see what the fuck is up.

size of the sda's smartctl snapshot
size of the sdb's smartctl snapshot
sda smartctl -x output, at least the beginning of it
sdb smartctl -x output, at least the beginning of it

Well, this is weird, they're not even the same models, let alone neither of them are IronWolf Pros. At that point i realize something's up and feed the output to Claude, saying "hey i brought new IronWolf pro drives last year, but these aint Seagate",

sda's attributes, 37.7k hours powered on, math aint mathing.

Well, this drive has more than 4 years of runtime, i only had those for a year at most, plus this one seems to be spun up for only 7.6k hours, maybe used as cold storage before? I dunno beats me and that's beside the point. There's nothing else interesting on that file. Lets look at the sdb now.

I'm not SMART, but this doesn't look good.

Well, that's a good start, lets dig deeper.

Oh no, 3 uncorrectable

Well, for an enterprise drive at 7000 hours, having 3 uncorrectable sectors is REALLY BAD. Anyways, next part of the data is the error logs, lets see what it says...

I don't know what half of those mean but those LBA's are close by...
And the 3rd one

Well, two LBA's that are basically next to each other and a 3rd one.... this can't be good.

What is "Overlimit Shock Events"...

Well, reading there's 5 "Overlimit Shock Events" made me look up the drives specs.... turns out triggering one of those require a significant G force application.... Welp, i dunno what others are but this aint good. Lets finish checking the digital files before i pull up the photos of the drives. Here we come to the ZFS diagnostic command chain Claude gave me.

Thank god for the mirrors.

Well that could've been worse. Anyways, i wont go too technical on the zpool-events file cause it gives me headache. Time to check the physical drives. I poweroff the NAS at this point, taking the drives out to actually check them closer.

Backside of the drives, after taking them out.
Front of the drives.
Picture of the drives inside the case, before i removed them.

Before you draft an angry email and call me stupid, yes, i am stupid. Anyways, lets plug those back in and find a place to offload my data.... Wait, i have google workspace cause i was lazy to set up my own mailserver, thanks google, lets upload the 500GB of backup to google drive with only 50 megabits of upload....

While waiting for the upload, lets ask the seller some questions... Ima ask Gemini to translate the exchange and screenshot it to paste here, cause Turkish.

Well, they admited they are refurbished imports...

Welp, here comes the goldmine, they admitted through the platform's messaging system that the drives are refurbished imports.

You see, this is a smoking gun on so many layers, because in Turkey we have laws about consumer protection, under the law number 6502 article 61/3, if you're selling a refurbished product, you need to disclose it prior to the sale, otherwise you're breaking the law.

Anyways, this is getting long, i basically opened up a case against the seller using the legal channels, waiting on the result.