Hi, i have a Hitachi media - I suspect that someone cleared the S.M.A.R.T and moved the G-list to the P-list in order to sell the media as a new one. Is there any way to prove that such actions were performed?

Compare PSHT of copy 0 against PSHT factory copy with hex editor.
If they are different, your suspect should be confirmed.

_________________
My firmware database:
https://mega.nz/folder/O01DkBRI#MxP2J6ZNqXDcrX40I8MoQQ

ok read this document
http://us.mrtlab.com/tech/hitachi/39_2.html
i hitachi exist 3 copy of p-list?
factory P-List (PSHT)
PDM1
PDM2
should I compare PSHT with PDM1 or PDM2?

Yes.
PDM1 and PDM2 are identical, so you can choose which one to compare against PSHT.

For comparing you can use HxD with command CTRL+K
https://mh-nexus.de/en/hxd/

_________________
My firmware database:
https://mega.nz/folder/O01DkBRI#MxP2J6ZNqXDcrX40I8MoQQ

To organize my knowledge,
PSHT - is an abbreviation of ?
further, moving G-List to P-List in software modifies PDM1 and PDM2, the PSHT module remains intact?

PDM1 and PDM2 are the factory copies (copy_NA), this never get modified/updated from drive fw... only manually you can change them but there isn't any reason to do that because they don't have any effect on drive behaving.
In real life, the only reason to modify factory copy is for "sabotage".

PSHT in copy 0 and copy 1 is the one that can get modified and is the one that gets loaded into RAM. If somebody sends command G to P list then PSHT changes if there were entries in G.
If you find that PSHT is different from PDM copies, then you could try to fix by overwriting PDM into PSHT.

I don't remember if mrt has any bugs with hitachi arm utility, if you decide to overwrite modules it may point to wrong adresses and make everything worse.
HOwever, if you find that PSHT is identical to PDM copies, you don't have to rewrite anything because the issue is not there... unless there was some sabotage from any company, but in that case you will not able to restore it.

_________________
My firmware database:
https://mega.nz/folder/O01DkBRI#MxP2J6ZNqXDcrX40I8MoQQ

PDM issue usually cause translator issues, in this case you will not be able to access to sectors since a certain LBA.
I don't think will cause slow reading.

I've ask how the drive behavies when you try to clone in differente zones, but you've never answered that.
https://forum.hddguru.com/viewtopic.php ... 00#p306600

this could help you to understand if you have just bad sectors on some portion of surface or if there are also weak heads.
MRT DE can help you better to figure how it behavies after doing head map.

_________________
My firmware database:
https://mega.nz/folder/O01DkBRI#MxP2J6ZNqXDcrX40I8MoQQ

This is a completely different case, unrelated to my other topic.
In this case, my only task is to determine whether anyone "programmatically refurbished (Clear smart and move G-list to P-list)" the disk before selling it.
I do not need to recover the data contained on this medium

Ok sorry, i thought it was the same case.

_________________
My firmware database:
https://mega.nz/folder/O01DkBRI#MxP2J6ZNqXDcrX40I8MoQQ

im read modules from drive
the checksum doesn't lie - the files are identical

PDM1 and PDM2 physically refers to the same address as PSHT copy0 and copy1, so this does not give you the answer.
I doubt you can easily access factory copy on these drives.BTW, i can't seem to notice where you mentioned your drive model.

pepe

_________________
Adatmentés - Data recovery

Pepe, do you mean that factory copies (PDM1 - PDM2) on ARM drives are not really factory copies?
If i understood, on ARMs drives, PDM points to PSHT same addresses, this means that always PDM = PSHT
If so, there is a way how to get real factory copy?

On IBM Hitachi drives (no ARM), PDM copies are always real factory copies?

_________________
My firmware database:
https://mega.nz/folder/O01DkBRI#MxP2J6ZNqXDcrX40I8MoQQ

3x Hitachi HUA722010CLA330
1x label HGST but the same familiy
Firmware: 3EA

Just check their addresses and you will see. PDM1 and PDM2 points to PSHT copy 0 and 1 on old drives too.
pepe

_________________
Adatmentés - Data recovery

thanks for sharing, how to use these please? i wouldlike to reset count hour on my hdd seagate 2.5"
Thanks

thanks for sharing, how to use these please? i wouldlike to reset count hour on my hdd seagate 2.5"
Thanks