2060-701474-004 WD PCB Circuit Board

HDD Printed circuit board (PCB) with board number 2060-701474-004 is usually used on these Western Digital hard disk drives: WD10EACS-00C7B0, DCM HBRCHV2ABB, Western Digital 1TB SATA 3.5 Hard Drive; WD1000FYPS-01ZKB0, DCM HARCHV2ABB, Western Digital 1TB SATA 3.5 Hard Drive; WD10EACS-00C7B0, DCM HARCHV2AAB, Western Digital 1TB SATA 3.5 Hard Drive; WD10EACS-00ZJB0, DCM HBRCHV2AAB, Western Digital 1TB…

Read More

2060-771824-003 WD PCB Circuit Board

HDD Printed circuit board (PCB) with board number 2060-771824-003 is usually used on these Western Digital hard disk drives: WD20EZRX-00DC0B0, DCM HARNNTJMGB, Western Digital 2TB SATA 3.5 Hard Drive; WD30EZRX-22DC0B0, DCM DARNHVJMH, Western Digital 3TB SATA 3.5 Hard Drive; WD15EZRX-00DC0B0, DCM HGRNKVJCG, Western Digital 1.5TB SATA 3.5 Hard Drive; WD20EURS-63SPKY0, DCM HGNNNTJMAB, Western Digital 2TB…

Read More

Windows Forensic Analysis DVD Toolkit, Second Edition

Windows Forensic Analysis DVD Toolkit, Second Edition Windows Forensic Analysis DVD Toolkit, Second Edition by Harlan Carvey.

Details:

  • Paperback: 512 pages
  • Publisher: Syngress; 2 edition (June 11, 2009)
  • Language: English
  • ISBN-10: 1597494224
  • ISBN-13: 978-1597494229
  • Product Dimensions: 9.2 x 7.5 x 1.1 inches
  • Shipping Weight: 2.0 pounds
  • Popular: 4.9 out of 5 starsDescription:

    Author Harlan Carvey has brought his best-selling book up-to-date to give you: the responder, examiner, or analyst the must-have tool kit for your job. Windows is the largest operating system on desktops and servers worldwide, which mean more intrusions, malware infections, and cybercrime happen on these systems. Windows Forensic Analysis DVD Toolkit, 2E covers both live and post-mortem response collection and analysis methodologies, addressing material that is applicable to law enforcement, the federal government, students, and consultants. The book is also accessible to system administrators, who are often the frontline when an incident occurs, but due to staffing and budget constraints do not have the necessary knowledge to respond effectively. The book’s companion DVD contains significant new and updated materials (movies, spreadsheet, code, etc.) not available any place else, because they are created and maintained by the author.

  • Best-Selling Windows Digital Forensic book completely updated in this 2nd Edition
  • Learn how to Analyze Data During Live and Post-Mortem Investigations
  • DVD Includes Custom Tools, Updated Code, Movies, and Spreadsheets!Reviews:

    “If your job requires investigating compromised Windows hosts, you must read Windows Forensic Analysis.”

    -Richard Bejtlich, Coauthor of Real Digital Forensics and Amazon.com Top 500 Book Reviewer

    The Registry Analysis chapter alone is worth the price of the book.”

    -Troy Larson, Senior Forensic Investigator of Microsoft’s IT Security Group

    “I also found that the entire book could have been written on just registry forensics. However, in order to create broad appeal, the registry section was probably shortened. You can tell Harlan has a lot more to tell.”

    -Rob Lee, Instructor and Fellow at the SANS Technology Institute, coauthor of Know Your Enemy: Learning About Security Threats, 2E

    Price:

    List Price: $69.95 Price: $47.08 You Save: $22.81

Read More

3 pieces of 3TBSAS hard drives cleared the CONFIG setting data recovery

Case:A company introduced by a company in a computer city to the customer, the customer host installed the LSI RAID card, which was built by 3 3TB SAS hard disks.Customers accidentally misunderstood the config setting under Windows7, causing array crash. Solution:Although this case is a single 3TB SAS interface, the mirror phase processing and reconstruction…

Read More

Firmware data (service information)

Firmware data is necessary for functioning of internal HDD circuits and as a rule it remains hidden from users.

Firmware data can be subdivided into the following types:
 

Servo information or servo fields;
 Low-level format;
 Resident firmware microcode (operational programs);
 Configuration tables and settings;
 Tables of defects.

 
Servo fields are necessary for operation of a servo system used by the driving assembly of magnetic heads in a HDD; they serve for heads’ positioning and keeping them precisely over a defined track. Servo fields are recorded during the manufacturing process to an already assembled HDA through special service openings in its case. The openings are subsequently closed with sticky labels that read: Warning! DO NOT OPEN. The recording is actually performed using drive’s own heads in a special high-precision instrument – servo writer.  Relocation of heads’ positioner is achieved through a motion of a special pusher of the servo writer using steady steps much smaller than the intervals between tracks.

 Firmware (microcode) of the control microprocessor is a collection of programs required for operation of HDD components. Here belong the programs used for initial diagnostics, control of spindle motor rotation, data exchange with disk controller, buffer RAM, etc. In most HDD models firmware microcode is stored within internal microcontroller ROM; some models employ external Flash ROM. In some HDD models a part of firmware programs is recorded to magnetic disk in a special firmware zone while ROM contains the programs used for initialization, and positioning together with primary loader reading the firmware data from magnetic disk to RAM. Since actual firmware modules are first loaded to RAM before execution they have been called resident modules.

 Manufacturers of hard drives record some firmware portions on disk surface not only for purposes of ROM space saving, but also to enable its easy replacement if the manufacturing process or drive operation reveal any errors in a microcode. Internet pages of most manufacturers contain links to utilities used for such updates. Overwriting disk firmware is much easier than unsoldering of hard-programmed microcontrollers. We can remember how Western Digital had to recall a large number of its drives back to factory several years ago…

 Low-level format. Track beginning is identified by an index pulse. Each track is subdivided into data sectors and servo fields. Format of each sector consists of an ID field, data field, synchronization zones and spaces. The beginning of each sector contains a synchronization zone used for phasing and synchronization of data strobe. ID field contains an address marker, physical sector address, flag byte and CRC bytes.

 Format without identifiers has become popular recently. When manufacturers employ such method of data placement along a track ID fields are not used at all (thus increasing available drive capacity). Instead they use a system of servo fields directing to physical sectors on a track. At that reading/writing of all sectors on a track is performed simultaneously (in one disk revolution) to/from RAM containing an image of the read/written track. Thus for reading just one sector a drive copies a whole track to RAM and reading of all subsequent sectors (if necessary) is performed from drive RAM instead of disk surface. Identical operations are performed during recording. During sector recording a drive reads a track, modifies it in RAM and writes the whole track back to disk.

 Configuration tables and settings of hard drives contain information about logical and physical structure of disk space. Those tables enable PCBs, which are identical for the whole drive family, to self-adjust for a certain drive model. As a matter of fact, during design of a certain model like, for example, a 80 Gb drive based on two disks it allows to produce automatically a “half-size” model with 40 Gb capacity based on one disk and “quarter-size” model with 20 Gb capacity based on one side only. Thus a manufacturer can offer a greater number of models with varied capacity for the market without considerable R&D expenses. Besides, junior models can use disks, which for some reasons are unsuitable for full-size models. E.g. “half-size” models can successfully use magnetic disks with defects on one of their surfaces, etc.

 Tables of defects. Modern technology of magnetic disks production does not allow their defect-free manufacture. Heterogeneity of media material, polishing defects, admixtures during magnetic layer application, etc. result in appearance of areas, where data recording or reading end in errors.

 Earlier drives with ST506/412 interface displayed the table of defective tracks as a label on HDA case and any drive had some reserved space, e.g. HDD ST225 (20 Mb) had actual capacity of 21,5 Mb, i.e. 1,5 Mb extra were allocated for defective sectors and tracks. Modern HDDs also have extra capacity, but it is hidden from users and only drive microcontroller can access it. A portion of that extra space is allocated to HDD firmware, configuration tables, S.M.A.R.T. counters, factory information about a HDD, tables of defects, etc. The remaining part is held in reserve for substitution of defective sectors with the reserved ones.

 Tables of defects are filled by the manufacturer during internal factory testing. Numbers of all discovered BAD sectors are added into a table. Such procedure is called updating (relocation) of defects (UPDATE DEFECT). After that if a defective sector is addressed during work with a HDD, the drive itself will redirect the request to a reserved sector. Therefore all modern drives newly arriving from the manufacturing factories have no defective sectors.

 Most HDD models have two tables of defects: Primary or P-List and Grown or G-List. Primary table is filled at the factory during internal testing – SELFSCAN (intelligent burn-in). Grown list is not filled at the factory; it is designed for addition of defects which appear during drive operation. To enable that functionality, the list of user commands practically in all HDDs contains the “assign” command replacing a defective sector with a reserved one. The command is used by numerous test utilities including those recommended by the manufacturers for operations over drives with BAD sectors. Western Digital drives have a Data Lifeguard system, which performs automatic substitution of defective sectors while a drive is idle. In order to perform the procedure, a drive self-tests its surfaces and transfers user data to a reserved sector marking at that defective sector as BAD; the mechanism of defect relocation is identical to the “assign” command. Manufacturers of Fujitsu, Quantum, Maxtor, and IBM drives implemented a mechanism of automatic defect relocation during the recording process. Thus if data is recorded to a defective sector, a drive itself will redirect such request to the reserved zone marking at that the defective sector as BAD and adding its number to G-List. Among specialized utilities used for relocation of BAD sectors we can note FUJFMT.EXE for Fujitsu drive, WDDIAG.EXE for Western Digital drives, ShDiag.exe offered by Samsung, etc.

Read More