We get this sort of question a lot given that we do just data recovery and people know we'll have our hands in their data.
I usually just let them know that it is likely that we will have some minimal exposure to their data while working.
But, then I reassure them that:
1. We deal with far too much data on a weekly basis to be bothered with looking through people's personal stuff. If we tried to look through all the data we recovered we'd never get anything done.
2. We're not that interested in your personal data. To our techs, your HDD is just case number 10978 and we have no idea who it's even for while we are working. It's not like we know you personally or have any vested interest in your dark secrets or skeletons in the closet.
3. We very often deal with highly sensitive data from police, hospitals, banks, proprietary research, etc. and have never had a data or confidentiality breach to date.
4. Our policy prohibits needless browsing of customer data (it's right in our confidentiality agreement) beyond what is necessary to perform the work.
5. If there is something illegal on there, we'd rather not find it because that drags us into in a legal dilemma and usually results in us never getting paid.
Then, I follow up with the question: "There isn't something illegal on here is there?", to which they say "no". Then I say "Then you have nothing to worry about do you".
Notice how I flipped the tables on them. Now if they decide to pull back based on concerns of protecting their data, they think that we'll think they're covering up something illegal. So they usually drop it after that.
