DATA RECOVERY UNION > Articles

Articles

Posted in

The basic knowledge about Hard Disk Drive

Firmware files that you can find on a site like this, contain a lot of files. First, there is the ‘loader’ file (*.LDR). This file is the ‘temporary’ firmware code, that’s being uploaded to the RAM (so, it’s not being written to disk). Then, there are a lot of ‘*.RPM’ files. These files represent the different modules, which can be written to the SA. The filenames consist of 8 numbers. The first 4 numbers specify the (hex) UBA and the second 4 numbers represent the hexadecimal module size in sectors (each sector normally contains 512 bytes, so for example, if a filename ends in 0002, then that module is 1024 bytes long). So, in short, after uploading the loader to RAM, the user can start replacing damaged modules by overwriting them with correct ones.BTW, please note that the term ‘firmware’ for the packages on this site is symantically not very well chosen, since these packages contain all needed modules to repair a HDD and not just the firmware (=code) module.
Anyway, if you’re looking for a specific firmware module, you can do 3 things:
1) rip the firmware modules from the SA of an identical HDD
2) get these modules from a friend (or for example, from the files section on this site)
3) use a firmware updater program from the vendor.

About this last option: firmware updates from vendors are pretty rare, since firmware code almost never needs to be replaced. However, Maxtor for example, had some problems with the firmware code on some Diamondmax HDD models. So, they issued a firmware update. This update consists of 2 files:

1) the executable file that issues the ATA ‘download microcode’ command to upload the firmware files to the HDD
2) The firmware code, consisting of the ‘main’ firmware code and ‘overlay’ code modules.

Firmware ‘overlay’ code are specific code functions. Why not just put all firmware code into one section ? Well, since the RAM in the drive is a limited resource, they’ve put some code into ‘overlay files’, so that this specific code can be swapped into RAM when that specific function is needed. When the fuction is not needed, it can be swapped out of ram and some other function can be swapped into it again.

The firmware update files from maxtor (I think the same goes for the other vendors) are not scrambled/encrypted/packed in anyway. In fact, you can find the exact same code in these files also in the ‘*.RPM’ files that PC3K produces for example.

Maxtor distributes their firmware file in a so called “.DMC” file. This DMC file is a package of 4 files, a ‘.Bxx’ file, a ‘.cxx’ file, a ‘.bbr’ file and a ‘.cbr’ file. Like I mentioned, this DMC container is not packed or scrambled in anyway. You can just cut the files out of it. The first 0x150 bytes of this file is the header. This header contains the four filenames, the offsets at which bytes in the package these files can be found, the length of the files and a checksum (not 100% sure about the checksum though). The ‘.bxx’ file is the biggest file and contains the overlay modules. You can find all code overlay modules by looking for ‘MO’ in the file. Right after this 2 byte string, you’ll find the hexadecimal overlay module ID. The ‘.bbr’ file contains the main firmware code. The last 2 files are very small, not sure what they contain, probably some checksums for the firmware and overlay modules.

Like said, the firmware code and overlay modules can also be found in the ‘*.RPM’ files of course, since this represents the firmware code on disk. So, you can look through these RPM files and scan for the ‘MO’ string to find any specific overlay module.

So, in short, if a vendor has released a firmware uploader tool (most vendors have), BUT haven’t released a firmware file for your specific drive type, you could create your firmware, if you have the dumped modules (for example, obtained from this site). You could rip the main code and overlay modules and paste them into an existing DMC package. However, since I don’t know the checksum calculation and the meaning of these .cxx and .cbr files (probably checksums), you’d have to do more research, but in theory, it would be possible to create your own firmware files and flash them with such standard Vendor program to disk, so you wouldn’t need to buy an expensive tool like PC3000 (at least not if your sole goal was to upload a new firmware).

Modern hard disks feature an area that contains information that the CPU on the HDD logic board uses to operate the drive. That area is called the “system area” SA. This area contains for example the drive ‘microcode’ (a.k.a. firmware), HDD Configuration Tables, Defect sector tables, SMART information, Security info (drive passwords etc), Disk ID info (serial nr etc) and more. These categories of information are called ‘modules’. So the SA contains a module for the firmware code, a module for the SMART info etc.The SA is stored on ‘negative cylinders’ of the HDD and therefore is not accessible by normal read commands. However, the area can be accessed with other ATA commands. An example of a (more or less) ‘standard’ ATA command that can access info on the SA is the ‘download microcode’ ATA command, which can be used to update information in the firmware code module. However, most of the commands that can be used to access the SA are vendor specific. Since vendors (obviously) don’t want users to mess around with the SA, these commands are generally not made public. However, these commands can be deduced by, for example, reverse engineering the firmware code itself.
This reverse engineering has been done and led to development of tools that can issue these (vendor specific) ATA commands and can read/write almost all sectors in the SA. One example of such tool is PC3000. A tool like this contains tables per HDD model, containing these vendor specific ATA commands and also tables with sector numbers on which the different modules are stored, also per HDD model. SA Sector numbers are counted in “UBA’s”. For example, one specific HDD might use UBA 4 to store the ‘DISK ID’ module, where another HDD model might use another sector for this module.
So in short, to create a tool that can read/write data in the SA, you need to:

A) know (and understand) the (vendor-) specific ATA commands that can be used to access this area and
B) know on which UBA sector the specific modules are stored.

If a drive has damaged data in the SA, for example in the firmware code module, it might become unusable. To repair these disks, the HDD can be switched to a so called ‘safe mode’, by setting specific jumpers on the drive. If the drive is operating in safe mode, it bypasses its own firmware. Instead, it wants the user to upload firmware to its ram. If the user uploads a correct ‘temporary’ firmware to RAM, it starts executing that firmware. If this uploaded RAM code (the ‘loader’) starts operating, the user can then start to issue ATA commands to the drive to modify the damaged modules.

Of course, you could also create your own flasher program, instead of using the one supplied by the vendor. However, since vendors use specific versions of the ‘download microcode’ ATA command, you’d have to do research into this.

Furthermore, you could create a program that does EVERYTHING that a tool like PC3000 does. However, like pointed out, you’ll need very detailed information on the vendor specific ATA commands and the structure of the SA for that specific drive type and since this info is not made public by anyone, this means a LOT of work. “But hey, the PC3000 tool features a special hardware PCI card!” Yes, but as you’ll understand by now, you can think of that card as nothing more than a copy protection. They could have perfectly created the tool without it, but I guess they would have sold quite some copies less. So you really can’t blame them for it, in fact, I think it’s quite a smart move to stop piracy.

So, in short, if you want to mess around with the SA, you have 2 options: invest a lot of time and energy into learning or simply empty your pockets and buy a tool like PC3000.

Posted in

What a hard drive looks like?

 To many people, a hard disk is a “black box” of sorts—-it is thought of as just a small device that “somehow” stores data. There is nothing wrong with this approach of course as long as all you care about is that it stores data. It is hard to really to understand the factors that affect performance, reliability and interfacing without knowing how the drive works internally.

If you use your hard disk as more than just a place to “keep stuff”, then you want to know more about your hard disk. For those people who earn their butter and bread by retrieving data from a defect hard drive, it is necessary to know how the hard drives works know more the ticks of store data.

Fortunately, most hard disks are basically the same on the inside. While the technology evolves, many of the basics are unchanged from the first PC hard disks in the early 1980s. Lets have a look at the following pictures of a modern SCSI hard disk, with major components annotated from Western Digital Corporation):

(Original image � Western Digital Corporation)

We look at the various key components, discuss how the hard disk is put together, and explore the various important technologies and how they work together to let you read and write data to the hard disk. My goal is to help you really understand the design decisions and tradeoffs made by hard disk engineers, and the ways that new technologies are being employed to increase capacity and improve performance.

When the first HDD looked like? What was the capacity of it?
5MB Hard Disk in 1956
It’s a hard disk in 1956…. the Volume and Size of 5MB memory storage in 1956. In September 1956 IBM launched the 305 RAMAC, the first computer with a hard disk drive (HDD). The HDD weighed over a ton and stored 5MB of data. Let us start appreciating your 4 GB jump drive!

5MB Hard Disk in 1956 – Its a hard disk in 1956…. The Volume and Size of 5MB memory storage in 1956. In September 1956 IBM launched the 305 RAMAC, the first computer with a hard disk drive (HDD). The HDD weighed over a ton and stored 5MB of data.

Posted in

Information on data recovery

The three most common problems seen today are: 1. The drive makes a repetitive clicking sound when power is applied (this may not always be audible to you). 2. The drive is completely dead, not spinning at all. 3. The computer bios sees the drive, but there is no boot and a boot from a floppy will not gain access or you get an error message that says ‘Invalid media type reading drive X’. Of course there are other issues such as flooding (never turn a wet drive on!), fire and other natural and unnatural disasters all of which require a top-notch data recovery company to work with.

If your drive is making a clicking sound, 9 times out of ten this means that the heads are bad and cannot read the information needed to get the drive to a ‘ready’ state. This can be due to two factors: physical head crash whereas the heads scrape some of the media off the surface of the platters thus destroying the heads in the process or the heads just go bad. The result is the same, the drive clicks. In this type of situation, you can expect an expensive data recovery because of what is needed to extract the data. The drive will have to be opened in a clean room environment, the heads will need to be replaced which requires an identical drive be purchased just for parts, and a skilled engineer will have to perform the difficult and meticulous task of aligning these new heads so they read the data properly. If indeed the media has been scored, there are many cases where there is nothing that can be done about it because so much of the recording material has been scraped off. Keep in mind that drives now sold are spinning at an incredible 7200 to 10,000 rpm, and that with this kind of speed disaster can be swift when it happens.

There seems to be a large number of electrical issues with drives these days, weather it be natural as in lightning strikes or man-made as in power outages and poorly manufactured power supplies. There are also known issues in many models of Maxtor, Western Digital and Quantum drives where a certain chip will simply burn up and cause the drive to stop spinning. About two years ago or more, Western Digital had a 500,000 drive recall as the result of a defective chip used in making many different models of drives. Over the last year or more, Quantum drives of many models had a similar issue, except this time, the numbers of affected drives was much higher. This was the driving force behind the acquisition of Quantum’s hard drive lines by Maxtor! Maxtor is still reeling from the huge numbers of returned drives on a daily basis. One of the big problems is that manufacturers do not put a fuse on the drives’ electronics anymore. You might say, “This would be an easy fix, I’ll just get another drive of the same model and swap the boards myself”. In an ideal world this would be the case but another factor most people do not know is that for each model drive made by a manufacturer, there can be over a dozen different revisions of the electronics even though the model is identical! This fact can make a simple problem very complex. Don’t look to the manufacturers for help with this either, they will not.

If the drive is seen by the BIOS of the computer, and you cannot access it by booting from a floppy in the case of a WIn9X or ME drive this means that for some reason the areas that define the partitions of the drive or the boot parameters have been corrupted. This can be caused by a virus, a computer or software bug, using a third party partitioning software, running Fdisk or a number of other reasons. This type of situation can be an easy fix for a professional or it can be a more difficult one depending on the extent of any additional damage to the file system or data structures. Usually, this type of problem is an easier one to deal with, because the drive at least still works. In the case of an operating system other than Win9X like NT, corruption the NT data structure can be a very complex mathematical problem and can be an expensive recovery as well due to the time it takes to solve. Operating systems like Unix and Novell as well as Spanned sets or Raid drives can definitely be an expensive recovery due to the complexity of these configurations.

It is important that you never run utilities such as scandisk, Norton disk doctor or any other such utility on a drive you suspect has a hardware failure. This can make recovery of your data difficult or even not impossible in some cases. These software tools work best on simpler types of problems and have no way of dealing with hardware issues. If your data is important, and you have doubts on what to do, call a professional. Also beware of technicians running these tools without your knowledge, as the results can be just as deadly.

When a data recovery company receives your drive, if it is possible and the drive is operational, a copy of your data is made sector by sector onto another drive (make image of your DATA) so that your data is not harmed in any way. This prevents mistakes, and allows the engineer to run utilities and make changes to a copy of your drive only and not the original.

Hard drives these days are worse than ever. You may find this a surprising statement, but it is true. Due to slimmer margins, and high competition, manufacturers are making drives as inexpensively as possible and more failures are the result. As of this moment, Fujitsu has top marks for reliability in desktop hard drives followed by IBM. In notebook drives, IBM and Toshiba have top billing. An important point to note is that Hitachi makes the absolute worst notebook drives in the industry with the highest catastrophic failure rate followed by Fujitsu. Dell has just decided to go exclusively with Hitachi now in their new notebooks, so beware!

Here is my old standby: Make believe that tomorrow when you turn your computer on that it is not going to work, and what is it that you want today that you will have to do without tomorrow! Back it up!

Posted in

Seagate Malfunctions (Barracuda IV, V and 7200.7)

A very common flaw is disruption of protective diode along the +12V circuit and resulting outage of the computer power supply unit. In that case the external look of that component does not allow identification of the damage, because its case remains unaffected. An attempt to connect a drive so damaged to an operable power supply for diagnostics will most likely result in breakdown of the latter. Therefore if such a drive is brought for repair then first of all you should probe the 0 and +12 V circuit with a regular tester to check for a short circuit.

The protective diode originally designed using the “transil” technology at SGS Thomson is intended for protection of electronic circuitry from short power supply peaks not greater than 10 – 20 microseconds. But in that case their common failures demonstrate that HDD designers did not expect to encounter so poor quality of power supply units. Thus drive operation can be resumed after simple removal of that damaged element from its circuits but we cannot guarantee flawless HDD operation without that component.

Posted in

Hard Drive Head Replacement Video

How to do your own head replacements and create your own tool for about 50 cents. Sure there are head comb kits but this is a simple method that will work on most types of drives WITHOUT touching the heads themselves. It is a much easier method than hundreds of others I have tried. This is the best.
Video:
httpv://www.youtube.com/watch?v=uIPZtJyrVPw

•1
Posted in

SSD Flash Hard Drives Data Recovery Video

How Solid State Flash Hard Drives work and how to rebuild them for data recovery. This presentation was at Shmoocon 2008 given by Forensic Expert Scott Moulton from My Hard Drive Died, and Forensic Strategy Services.
Part 1:httpv://www.youtube.com/watch?v=l4hbdZFWGog
Part 2:httpv://www.youtube.com/watch?v=mglEnIPnzjo
Part 3:httpv://www.youtube.com/watch?v=3psy_d-pyNg
Part 4:httpv://www.youtube.com/watch?v=pKeZvhDd5c4
Part 5:httpv://www.youtube.com/watch?v=9XMBdDypSO4
Part 6:httpv://www.youtube.com/watch?v=LY36SWbfQg0

Posted in

Advanced Hard Drive Data Recovery Video

New different material! This is a new video on advanced data recovery by Scott A. Moulton. This is from August 2007 at Defcon 15 on how to do your own hard drive recovery.
Part 1: httpv://www.youtube.com/watch?v=vCapEFNZAJ0
Part 2: httpv://www.youtube.com/watch?v=w2FGKD4u8TU
Part 3: httpv://www.youtube.com/watch?v=jAUtv6kOCGE
Part 4: httpv://www.youtube.com/watch?v=5xdboKrOllE
Part 5: httpv://www.youtube.com/watch?v=MydSI4Jv2EI

Posted in

Hard Drive Recovery Video

Hard Drive Recovery presented at Toorcon by Scott Moulton of Forensic Strategy
Services, LLC. Very detailed info on rebuilding hard drives and recovery of your own data.
Part 1:httpv://www.youtube.com/watch?v=Kx-D1nJcv0k
Part 2:httpv://www.youtube.com/watch?v=Tg0Uli2_rwI
Part 3:httpv://www.youtube.com/watch?v=Cayzw1iThjM
Part 4:httpv://www.youtube.com/watch?v=1_sNdPoQdcM
Part 5:httpv://www.youtube.com/watch?v=eOvZZakhihM
Part 6:httpv://www.youtube.com/watch?v=CH6pKDsggZc
part 7:httpv://www.youtube.com/watch?v=TNhajraPuWY

Posted in

IBM malfunctions

Manufacturer: IBM, drive families: DJNA, DPTA, DTLA, AVER, AVVA
Malfunction signs: A drive spins up the spindle motor, recalibrates itself, reports on readiness, BIOS identifies it correctly but at a reading attempt the drive produces “scratching” sounds and reveals numerous BAD sectors on its surfaces.

That malfunction is connected with a mismatch between the cyclical redundancy check code in the data fields and the information recorded in the sector service field. Such a situation appears when recording to a sector is unfinished. That may result from lack of contact at the connector between the PCB and HDA. That connector consists of needle-like pins touching tinned pads on the PCB (please see figure 11). With time soft solder becomes perforated and contact quality deteriorates.

Figure 11. Pin contacts of magnetic heads’ assembly connector in IBM drives (view from behind the PCB)

In order to repair that malfunction you should remove the control board, clean the old solder off the contact pads and cover them again using silver-based solder, then carefully wash the soldered location. Install the board back to HDA. Then you will have to clear the whole disk surface overwriting it with any code using freely available software (please see part 4); that will accomplish recording of correct CRC codes.

Posted in

Fujitsu malfunctions

Fujitsu, M1638TAU drive family
Malfunction signs: The spindle motor does not start
The connection scheme of VCM (Voice Coil Motor) & SPM (Spindle Motor) controller is practically identical for the following drive families: M1614TAU, M1638TAU, MPA30xxAT, MPB30xxAT and MPC30xxAT.

VCM&SPM controller regulates 3-phase motor; it is programmed by the MB9004 processor produced by Fujitsu. There are three modes of spindle motor control: start mode, acceleration mode and stable rotation mode. In the start mode at power-up Power Monitor (MP3771) sends a “reset” signal to the microprocessor (MB9004) and the VCM & SPM controller. Microprocessor uses a serial channel to program internal registers of VCM & SPM controller for a start and charges the pump capacitor of the controller using the “Charge pump” signal. Charge volume determines the current which will flow to the spindle motor. As soon as the start-up capacitor is charged sufficiently the microprocessor programs SPM controller for a start mode, then ~ 1,3А current flows to the spindle motor. Controller generates phase switching signals. The spindle motor at that begins rotation generating self-induced EMF. The controller detects EMF and notifies the microprocessor about that; the latter uses the signal for rotation control. In the acceleration mode the microprocessor speeds up phase switching and measures spindle motor rotational speed until it reaches 5400 RPM. When the speed is reached the controller switches to stable rotation. In that mode microprocessor calculates the time required for one spindle motor revolution on the basis of the phase signal and adjusts the rotational speed charging or discharging the pump capacitor. Adjustment control (charge/discharge) is performed every 1/6 spindle revolution.

The complexity of diagnostics is determined by the fact that SPM controller monitors EMF generated during spindle rotation and at an attempt of spindle spin-up it makes just 2 – 3 phase switches which are difficult to track using oscilloscope. If the spindle does not begin rotation (for whatever reason) the controller, as a rule, either switches off or retries its attempt after some time. Thus, if you use a regular oscilloscope, you can see only presence of pulses falling within a certain range, which is insufficient for complete diagnostics. In an ideal case we would recommend using 3-channel oscilloscope with memory function operating in the automatic recorder mode. Probably such device is not really commonplace. Therefore it is possible just to check the presence of pulses for motor phases.

VCM & SPM controller is a quite reliable microchip and it rarely goes out of order. More frequently a spindle motor does not start because of other malfunctions. Still, if the chip fails such failure is usually caused by overheating with clearly visible traces on chip case. During repair of the start circuit you should check the Stop Spindle signal from the MB3771 chip. The signal forces parking of magnetic heads and stops the spindle motor with keys Q8 and Q9. Active level of that signal in the parking mode is “1”, in the operational drive mode it is “0”. If a spindle motor begins to spin up you can check the operation of output keys of HA13525A chip controlling phase signal with oscilloscope. To do so select 10 ms/div sweep with 2V/div amplification (it is advisable to use the 1:10 multiplier). A phase may be diverted by a disrupted Q8 or Q9 key. HA13525A and HA13525B chips are compatible from top downward, i.e. in models belonging to the M1638TAU and MPA drive families both of those chips can be used. In MPB and MPC drive families only HA13525B is allowed.

Manufacturer: Fujitsu, drive families: MPB, MPC
Malfunction signs: A drive begins to detect a higher own capacity than the actual rated value, the so-called “megalomania”.

That malfunction is quite frequent in the above-mentioned drive families; it is caused by corruption of firmware in Flash ROM chip on the control board of the drive. Those drive families employ Flash ROM chips using 64К structure based on 16-bit words, programming voltage is 5 or 12 V, package type is PLCC44.

Elimination of that malfunction requires just reprogramming of Flash chip by recording a known good firmware of the corresponding version. Version number in Fujitsu drives is indicated in the lower right corner of the label over HDA below bar code and it looks like: xyy-zzzz, where x –means the month when the drive was manufactured in hexadecimal notation, yy – means version prefix and zzzz – means the actual firmware version, e.g.: С02-2009. For version compatibility in MPB and MPC drive families just the actual version match is sufficient, the prefix and month of manufacture are not important.

Manufacturer: Fujitsu, MPG3xxxAT/AH drive family
Malfunction signs: Quite unexpectedly for user and user data a drive is no longer identified in PC BIOS.

We should note that this very drive model has broken all records of failures, which happen in most cases after a year of operation, just after completion of the warranty period. The main cause of the malfunction was in the Cirrus Logic CL-SH8671-450E chip. It can hardly be replaced with a working chip because those microcircuits were produced for a special Fujitsu order and the manufacture of that drive family was discontinued long ago. However, there is a method of “revival” and “revitalizing” a malfunctioning chip which allows extending HDD life a little. However, if you ignore drive “hangings” and do not take due steps (at least backup valuable data) the table of S.M.A.R.T. logs in firmware zone will be gradually overfilled and the drive will additionally corrupt its modules in firmware zone, which cannot be restored without specialized software.

One of the versions explaining the cause of problems with those chips is the use of a new polymer compound during production of chip case. The compound decomposes under the influence of increased temperature in humid conditions producing phosphoric acid. But it is just a version; we may never learn whether it is so or not. However, one thing is known for sure: if you unsolder that chip, remove old solder from its pins and contact pads on the board, flush the location for the chip and then solder it back the drive will begin to work properly.