Help determining if a circuit was tampered with

Thread Starter

Redux

Joined Feb 4, 2016
13
Hello All!
This is my first post here, so thank you in advance for any answers and I'm happy to be part of the community.

I work for an electronics restoration company. We clean, repair, test and restore electronics after smoke, fire or water.
I am the primary IT electronics tech. So when it comes to circuitry I am a bit above a novice but not much. I can identify components and solder easy things but I am in no way advanced or even a strong intermediate.

The issue
A client had an incident involving water. The item were being stored and were not powered on or connected to power at the time of the loss. At most these items had some dampening from the water and were no where near soaked. We see this all of the time. Items are cleaned with deionized water and solvents and placed in a static free dry room then they are tested or in this case items were cleaned using denatured alcohol and contact cleaner and dried. All common practice that yields 90% positive results.
After cleaning and drying the items are tested. The items in question are a Flashforge Dreamer 3D printer and a Cisco SG500X-48 Managed Switch. We cleaned and dried them and they tested fine. The switch was tested to power on and handle a little bit of network traffic. The 3D printer was tested with a 4hr print and a 14hr print both prints went well and the unit was on for about 48hrs.
Both the 3D printer and Switch were returned to the customer. A few days later he complained about the items not functioning properly when he tested them. The client is extremely tech savvy. I guarantee he knows more about circuitry than I do. His complaints were that one of the extruders on the 3D printer wasn't functioning properly and that the switch had a loud fan.
We picked up the items and brought them back to test. Upon return of the items the switch was plugged into power and the tech went to the bathroom. Literally 2min later one of the network jack arrays started smoking the board. It is a perfect circle under the first nic connection array. The 3D printer I had up printing via sd card. It was functioning well. Later I plugged in the usb to test other settings via the pc software and 2 min later more magic smoke and an IC behind the usb port fried and caused the unit to fail.

Now these issues are consistent with what water could be expected to do to a circuit. However they did this after we followed a very much practiced restoration process and after we tested them and the client tested them. This seems very fishy to me. It is highly uncommon as we do this all of the time. So my question is what could be done to these circuits or components to cause this? As in is there a way to tamper with the devices to yield the issues observed. The switch went first so I visually inspected the 3D printer prior to working on it. Please see attached photos. I saw nothing odd about the components of circuits involved upon visual inspection, I did not break out a meter prior.
I have attached pictures with the affected boards and components highlighted.
20160203_105614.jpg 3d printer prior
20160203_105623.jpg 3d printer prior
20160203_151905.jpg 3d printer after
DSCN6567.JPG Switch prior
DSCN6571.JPG Switch prior
DSCN6572.JPG Switch prior
DSCN6728.JPG Switch after
DSCN6729.JPG Switch after
 

Attachments

Kermit2

Joined Feb 5, 2010
4,162
I've done warranty repair on radios in the past. Tamper proofing does help weed out the devious customers.

Tiny scratches made with a graver, that go down the side of a screw head and make a matched mark on the outside surface. Examed visually with a 5X eye loupe one will easily see if the screws have been moved in any way.
Very very thin short strip of white paper, the shape of Christmas tree tinsel can be held at the edge of plug in connectors and the mating plug inserted. If tampered with the little fleck of paper gets removed.

Last straw and one my boss came up with.
A screw with a LH thread. The old boy twisted a right angle bracket off the radio case wall trying to get that screw off. :) He didn't get a warranty repair.
 

Dodgydave

Joined Jun 22, 2012
11,284
Is it possible to swap the whole pcb usb board for another one, are there any serial numbers on the pcb, or software serial ids, that the client could have done the damage on a different printer?
 

Thread Starter

Redux

Joined Feb 4, 2016
13
Lol. Thank you Kermit. those are all great temperproofing ideas and I will employ them when I fix the devices. Thank you for the input. I am curious as to what could have caused the issues as is. It seems like there was no evidence of tampering but for 2 items to come back and smoke immediately after being tested rigorously seems a bit odd. I am trying to think of an oil or something aqueous that would hang around for a bit and cook the circuits upon the introduction of electricity.
 

Thread Starter

Redux

Joined Feb 4, 2016
13
Is it possible to swap the whole pcb usb board for another one, are there any serial numbers on the pcb, or software serial ids, that the client could have done the damage on a different printer?
Dodgy Dave,
I am ordering a replacement board. Im going to fix it. I just want to try to prove this guy tampered with it to dupe us and the insurance company.
 

joeyd999

Joined Jun 6, 2011
5,234
I just want to try to prove this guy tampered with it to dupe us and the insurance company.
Careful! Blaming your customers without ironclad and demonstrable proof (i.e photos before/after, etc,) is bad business practice. The cost of sucking it up and eating the damage could be far less than a bad internet review -- or law suit (for defamation).

In the future, ideas like Kermit's will help. But some customers will get very noisy and cause you headaches.

I get returned product under warranty that was obviously damaged by the customer. I graciously repair them. The goodwill generated is priceless.
 

Thread Starter

Redux

Joined Feb 4, 2016
13
Careful! Blaming your customers without ironclad and demonstrable proof (i.e photos before/after, etc,) is bad business practice. The cost of sucking it up and eating the damage could be far less than a bad internet review -- or law suit (for defamation).

In the future, ideas like Kermit's will help. But some customers will get very noisy and cause you headaches.

I get returned product under warranty that was obviously damaged by the customer. I graciously repair them. The goodwill generated is priceless.
You are correct. Fortunately we do have photos and documentation of the process the entire way. I am conducting this inquiry under the request of the insurance company. Normally we would just repair or write off, but there are red flags with the client. So i was hoping for some input on what could have caused it.
 

Kermit2

Joined Feb 5, 2010
4,162
Make sure a proper solder was used. Older lead free solders could suffer a type of crystalline growth of the tin.
"Tin whiskers" they are called. Try Google on that term.
 

Thread Starter

Redux

Joined Feb 4, 2016
13
Make sure a proper solder was used. Older lead free solders could suffer a type of crystalline growth of the tin.
"Tin whiskers" they are called. Try Google on that term.
thank you kermit. Both items were produced in the last year and were in almost new condition. From the google search it would seem they are newer than items effected by tin whiskers.
 

Kermit2

Joined Feb 5, 2010
4,162
Understood, my reason for raising the issue is the unknown storage conditions of the equipment and the effects of water on the aging process of the solder. Both may have accelerated the formation of whiskers if that was the cause.
 

Roderick Young

Joined Feb 22, 2015
408
Part of my previous job was doing forensic analysis on burned electronic equipment. What you can do is carefully take the equipment apart, documenting each step, and take good pictures of the burn area. Does it look like there was any foreign object placed in there? Even a stray wisp of #30 wire would be a useful clue. What component burned? Are there any hard water stains left in there? It's very interesting that both units burned after being returned to you - they didn't burn at the customer's location.

I have seen condensation dissolve salts left on a PC board (a class issue at the place I was working), and that led to microscopic bridges of moderate impedance, enough to disturb sensitive circuits. I do not that such bridges only impacted very high impedance power supplies, like a battery-backed clock. Main power was never affected, and nothing ever visibly burned. I suspect that if there were any bridges across a power rail capable of multiple amperes, the bridge simply burned itself open on its own.

EDIT: Oh, I see you did post pictures. The burn on the switch looks like something overheated on the other side of the board. It's unlikely to be an inter-layer short on the board, because when those happen, the board usually burns all the way through and there is a hole. Unlikely place for there to be failure due to physical insult, like the box being dropped. Unless you can find a whisker of wire or a rocket igniter or something in there, I'd call that one non-malicious.
 
Last edited:

Thread Starter

Redux

Joined Feb 4, 2016
13
Part of my previous job was doing forensic analysis on burned electronic equipment. What you can do is carefully take the equipment apart, documenting each step, and take good pictures of the burn area. Does it look like there was any foreign object placed in there? Even a stray wisp of #30 wire would be a useful clue. What component burned? Are there any hard water stains left in there? Post the picture here if you're allowed to. It's very interesting that both units burned after being returned to you - they didn't burn at the customer's location.
Thank you Roderick. I posted some photos in the inital post and in a reply underneath. I am not yet allowed to remove components from boards but i am allowed to remove the boards from the devices. In the photos of the switch you can see a thermal event between a nic array and some ic they cmmunicate with. On the 3d printer board it was an ic that comes right afterthe usb controller. I did not observe any foreign objects.
 

Alec_t

Joined Sep 17, 2013
14,280
Could overvoltage be a factor, e.g. if the units have jumpers/switches for selecting between 110V and 230V mains they could have been wrongly set?
 

Roderick Young

Joined Feb 22, 2015
408
On the printer, I can't see too well, but the size of the pins on what seems to be the burned component suggest that it was a power transistor, maybe in a DPAK package, or a power IC, in something similar? That's the sort of thing I expect to burn when its load gets shorted, of if it's an inductive load, when the protection diode on the coil or motor comes loose. If it's part of a switching power supply, then there will be no such protection on the inductor, but there will usually be a snubber circuit, and if that came loose, a MOSFET would eventually burn from voltage spikes causing breakdown between drain and gate. In that case, the MOSFET would usually read as one big, low-ohm blob, with all pins shorted.

If it burned at the customer's site, I might say they zapped it with high current, but since it worked at your site for a few minutes, then burned, I think foul play would be unlikely. It would have to be a truly talented individual to set up something that will work for a while, then burn on your site. Not impossible, but why would someone with such saavy waste their time on small potatoes like insurance fraud?
 

Thread Starter

Redux

Joined Feb 4, 2016
13
On the printer, I can't see too well, but the size of the pins on what seems to be the burned component suggest that it was a power transistor, maybe in a DPAK package, or a power IC, in something similar? That's the sort of thing I expect to burn when its load gets shorted, of if it's an inductive load, when the protection diode on the coil or motor comes loose. If it's part of a switching power supply, then there will be no such protection on the inductor, but there will usually be a snubber circuit, and if that came loose, a MOSFET would eventually burn from voltage spikes causing breakdown between drain and gate. In that case, the MOSFET would usually read as one big, low-ohm blob, with all pins shorted.

If it burned at the customer's site, I might say they zapped it with high current, but since it worked at your site for a few minutes, then burned, I think foul play would be unlikely. It would have to be a truly talented individual to set up something that will work for a while, then burn on your site. Not impossible, but why would someone with such saavy waste their time on small potatoes like insurance fraud?
Im pretty sure its an ic behind the usb port on the printer. As for why he would do this, im pretty sure there is something mentally wrong with the individual, this is not the first odd thing to happen with the client during this claim.
The printer worked using an sd card to print and it worked for about 2hrs. It did not fail until i plugged in the usb to the pc. Some how 500mA killed the circuit.
 

tcmtech

Joined Nov 4, 2013
2,867
As someone who has also worked in the electronics repair service industry over the years I am quite familiar with what people will do for warranty work.

The common theme I found was those who want and claim it the most are those who are too cheap, lazy and dumb to find a better way to get new gear which ultimately makes finding deliberate sabotage or tampering fairly easy for anyone who is familiar with the equipment.
Typically the most common things I saw were based on the revers compatibility of updated circuit boards and the like where a new version of a circuit board will work in an older model machine but the older model machines circuit board wont work in the newer model machines. Certain customers would find out how much to was to replace a bad board on their old machine then say they don't want to spend the money on the repair so they would buy the newest version of the same model which just by coincidence would come back in a month to two for warranty work with the older models circuit boards in it.
I would let my boss know and we would take a few pictures and document the machines build dates Vs the build dates and production codes on the boards and whatnot then put in all new stuff and tell the customer they can have their new machine back for the cost to the new boards plus labor of which we always made substantially higher than what the repair of their old model was. :D

Unfortunately given what you have shown us and where the faults occurred and how I have very little reason to believe it was deliberate customer damage. The where and how of the damage looks like what I would see as common IC and socket failure that lead to component overloads and circuit board burning.
From what I see nothing looks like tampering, Intelligently done or otherwise. Anyone who was smart enough to tamper with it at that level would have the knowledge of how to disable a board like that without leaving any physical damage in place. :(

Static shock to one of the main processor IC's resulting in major board malfunction is easy to do with nothing more that shuffled feet and a well placed unfolded paper clip plus would be impossible to trace. Cheap dumb people never use that method and what they do use always leaves obvious physical modification damage behind.
 
Top