A scheme involving the resale of used Seagate Exos enterprise-grade hard drives as new was uncovered earlier this month, but we have now learned that it reportedly affects not only Exos HDDs but also Seagate's IronWolf Pro HDDs, according to an investigation conducted by Lutz Labs from Heise.de. Fraudsters erase usage records, alter serial numbers, and modify labels to deceive buyers, but it is still possible to determine that the particular drive had been in use, and by now, there are multiple ways to detect such falsified HDDs.
Both Exos and IronWolf Pro are extremely reliable hard disk drives. Seagate's Exos HDDs are aimed at enterprises and hyperscale cloud service providers and are meant to operate 24/7, whereas IronWolf Pro is designed for enterprise-grade NAS environments that also work in 24/7 mode. While these drives share a lot in terms of hardware platforms, they have different firmware. Given the reliability, performance, and capacity points of IronWolf Pro HDDs, they are good candidates for use in Chia mining. As such, the current theory is that Chia miners are selling off used hard drives from mining farms, and it would make sense they may have both Exos and IronWolf Pro devices.
Falsified Seagate's Exos and IronWolf Pro hard drives are sold by retailers in different countries and generally look almost like new. The drives appear unused to the software because their internal usage logs, specifically SMART parameters, were wiped. However, a closer look at these drives may reveal slight dents and scratches on the chassis as well as scratches on their SATA connector, which are clear signs of previous use.
Also, the QR codes on counterfeit units have been tampered with. Instead of linking to Seagate's usual verification page, they redirect to a warranty check that does not display the serial number or storage capacity, making it harder to verify authenticity. Since the labels on the drives are false, there are slight variations in label alignment and scaling. Finally, tools like smartmontools that can read Seagate's FARM (field-accessible reliability metrics) values reveal that some had operated for over 50,000 hours.
So far, no similar cases have been reported for Toshiba or Western Digital. However, detecting tampering in these brands is more difficult since they lack Seagate's FARM values (which are only available on Exos, IronWolf, IronWolf Pro, and perhaps SkyHawk drives, according to Heise.de), which store extensive usage history.
Seagate has acknowledged the problem, stating that fraudulent practices involving IronWolf-series drives are not new. The company is conducting an active investigation into how these modified drives enter the market.
