All times are UTC - 5 hours [ DST ]


Forum rules


Please do not post questions about data recovery cases here (use this forum instead). This forum is for topics on finding new ways to recover data. Accessing firmware, writing programs, reading bits off the platter, recovering data from dust...



Post new topic Reply to topic  [ 36 posts ]  Go to page Previous  1, 2
Author Message
 Post subject: Re: Any way to decode encoded read long data?
PostPosted: April 24th, 2015, 16:46 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15463
Location: Australia
Leo wrote:
It is not "encoded", the drive just returns some "garbage" from its buffer without actual reading from disk sectors.

The ATA standard uses the term "encoded" to describe the SCT Long Sector Access data.

Quote:
This is the data normally sent or returned by a read or write command. This data may be encoded.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Any way to decode encoded read long data?
PostPosted: April 25th, 2015, 4:25 
Offline

Joined: January 29th, 2012, 1:43
Posts: 982
Location: United States
Leo wrote:
It is not "encoded", the drive just returns some "garbage" from its buffer without actual reading from disk sectors. As it was already said, most of modern drives do not support read long command, they just have a "plug" for compatibility with older software/hardware.
I used read long for data carving in the age of early ATA drives (less than 10GB), it worked and allowed to get some raw data that sometimes was of some use (for example to reconstruct FAT or DIR fragments etc.). But it was more than 15 years ago, and never worked with newer drives.


While that may be possible in some cases, I do not believe that is always true. The data is not random. Why would they include the command just for software/hardware compatibility? It is an obsolete command and it would be very easy to remove as opposed to keeping it just to return random data.

Let’s travel back in time to the old 5.25 Apple floppy disk, where the operating system read the actual bits on the disk and did all the work processing it. I am doing this from memory, so the numbers may not be totally accurate (and a Google search has failed me). The object is to get a point across. A 256 byte sector actually consisted of 342 bytes, 256 bytes followed by 86 bytes. Every byte was worth 6 bits. There were certain limitations on the bit pattern, likely due to the nature of reading a magnetic surface. In any given byte there were never more than 2 or 3 consecutive bits in a row. So a bit pattern of 11001100 would be allowed, but not 11110000. And there were also a few bit patterns that were used only for the sector header and trailer so the data could be found. There was a table that had a list of the patterns to convert a raw byte to a value from 0 - 63(0x3f). So every byte of the 86 byte block contained 2 bits for 3 bytes of the 256 byte block. You get the idea. While this would produce a very noticeable pattern, a sector of all 0’s would most definitely NOT look like all 0’s in a raw (long) read.

Now let’s say I have a drive that a SCT Read Long produces 512 data bytes plus 72 ecc bytes. A sector that is all 0’s will look like chaotic data in the long read. Changing certain bytes of data in the sector changes certain blocks of bytes in the data and ecc. So in this case the question is: what is the algorithm used to turn 584 bytes of raw data into 512 bytes of user data? I believe this will vary between different manufacturers and even different models. It also may not be feasible for anyone to figure out, depending on how complicated it is. It is not just a simple table. There is likely the ability to correct for a small number of corrupt bits.

Of course even if it could be figured out, there would still be the question of how much useful data you could actually get from a bad sector anyway. But if we can’t decode it, there is no way to know.

_________________
http://www.hddsuperclone.com
Home of HDDSuperClone


Top
 Profile  
 
 Post subject: Re: Any way to decode encoded read long data?
PostPosted: April 26th, 2015, 7:13 
Offline

Joined: January 29th, 2012, 1:43
Posts: 982
Location: United States
I think an even bigger question is: Is that how the data is actually stored on the drive, or is it being encrypted(encoded) by the manufacturer to protect proprietary information regarding the method of error correction and recovery? The standard stated that the first 512 bytes was supposed to be the user data, but that it may be encoded. So my best guess is that it is encrypted on purpose.

I can see why this was removed from the standard. By allowing the data to be encoded, the command was useless to anyone but the manufacturer, so it may as well be a vendor specific command. Either way, only reverse engineering the firmware would produce results.

_________________
http://www.hddsuperclone.com
Home of HDDSuperClone


Top
 Profile  
 
 Post subject: Re: Any way to decode encoded read long data?
PostPosted: April 27th, 2015, 22:54 
Offline

Joined: September 3rd, 2014, 6:36
Posts: 15
Location: Las Vegas, NV
Spildit wrote:
butchie3980 wrote:
Yeah I guess we've come full circle, eh? I'm trying to recover data. Previous scans have shown the drive was having corruption everywhere, which I don't believe. I don't have experience in determining the cause, so I'm afraid of making things worse if I try regenerating defect lists or modules. I figure the safest thing to try with my limited knowledge is to do long reads of the whold disk and try to carve out files from the image.


What is the full model of the drive ?
Can you scan any sector at all ?
Maybe the translator is not initializing properly due to damaged head or other causes.
Does the drive produces strange sounds and clicking noises ?
Were you able to get access to the firmware modules using something like SeDiv DEMO or WDR or WDMarvel ?
The drive might as well have typical issues like the slow problem and cloning the drive in such state might not be a wise decision.
Again, if data is important you should stop messing with the drive, and i don't think the read long commands would be of help on your problem anyhow !


Thanks for steering me in the direction of weak heads. Sent it in for a head swap. I'll let you know how that goes.
While I wait for that to come back, I wanted to pursue the idea of long reads a little further. I've read in the TREX manual that there is a vendor specific long read for WD drives.
I'm confused on how to package a VSC command. How would I do that in MHDD? or with maximus's HDDScriptTool?

I have another 80GB WD drive lying around, so I wanted to see if using a VSC read long will return data that doesn't appear to be scrambled.


Top
 Profile  
 
 Post subject: Re: Any way to decode encoded read long data?
PostPosted: April 28th, 2015, 1:17 
Offline

Joined: September 29th, 2005, 4:10
Posts: 402
Location: Moscow
All it a waste of time.
Required accuracy of the information being read.
Long read does not guarantee the reliability.
Can help only in very rare cases.
When the information can be verified by other methods, for example by sense.


Top
 Profile  
 
 Post subject: Re: Any way to decode encoded read long data?
PostPosted: April 28th, 2015, 19:08 
Offline

Joined: January 29th, 2012, 1:43
Posts: 982
Location: United States
Tomset wrote:
All it a waste of time.
Required accuracy of the information being read.
Long read does not guarantee the reliability.
Can help only in very rare cases.
When the information can be verified by other methods, for example by sense.

I cannot argue with that logic, except to say that I am disappointed that I am unable to make any decision myself about the quality of such data when it is encoded in a way that cannot be used. Maybe I want to see if a picture would be better with zeros or long data filling the bad sector. Maybe there are bad sectors in the file table that long data could possibly provide useful data.

But since it is not currently possible to decode, I do agree that it is not worth much time or effort to attempt it. But it is still very disappointing that we cannot see for ourselves.

_________________
http://www.hddsuperclone.com
Home of HDDSuperClone


Top
 Profile  
 
 Post subject: Re: Any way to decode encoded read long data?
PostPosted: April 29th, 2015, 4:18 
Offline

Joined: September 29th, 2005, 4:10
Posts: 402
Location: Moscow
maximus,
Oh!
there is not any coding.
there is an algorithm for the Hamming code.
I advise you to read this article:
https://en.wikipedia.org/wiki/Hamming_code

And to imagine that a few bits can not be deducted.


Top
 Profile  
 
 Post subject: Re: Any way to decode encoded read long data?
PostPosted: April 29th, 2015, 17:11 
Offline

Joined: January 29th, 2012, 1:43
Posts: 982
Location: United States
Tomset wrote:
maximus,
Oh!
there is not any coding.
there is an algorithm for the Hamming code.
I advise you to read this article:
https://en.wikipedia.org/wiki/Hamming_code

And to imagine that a few bits can not be deducted.

THANK YOU! THAT is the answer I have been looking for! :D

I would not mind if anyone could provide more specific details on how different drives implement the hamming code algorithm.

_________________
http://www.hddsuperclone.com
Home of HDDSuperClone


Top
 Profile  
 
 Post subject: Re: Any way to decode encoded read long data?
PostPosted: April 30th, 2015, 3:22 
Offline

Joined: September 29th, 2005, 4:10
Posts: 402
Location: Moscow
Quote:
I would not mind if anyone could provide more specific details on how different drives implement the hamming code algorithm.

This makes no sense.
Read any information sufficient to restore or not.
And if it is not enough, nor a miracle, do not allow you to restore reliable information.

All hope.
Repeat reading many times as unstable-read place does not give so much information that it will be possible to restore the algorithm.


Top
 Profile  
 
 Post subject: Re: Any way to decode encoded read long data?
PostPosted: April 30th, 2015, 19:25 
Offline

Joined: January 29th, 2012, 1:43
Posts: 982
Location: United States
I need to know how to process the algorithm on a good sector first. That is what I am asking. It is not as strait forward as it would seem. For one example a 512 byte sector that is all 0's will show long data of 584 bytes, and almost no bytes at all are 0's. There are different ways the algorithm can be implemented. I am guessing that the lack of 0's means it is using odd parity, but that is not enough alone to figure it out.

_________________
http://www.hddsuperclone.com
Home of HDDSuperClone


Top
 Profile  
 
 Post subject: Re: Any way to decode encoded read long data?
PostPosted: April 30th, 2015, 20:07 
Offline

Joined: January 29th, 2012, 1:43
Posts: 982
Location: United States
A more specific example. Long sector is 512 + 56 bytes.

How does this
Code:
long sector:
0: fb e7 6f 99 ab 76 72 01 95 d8 a3 c1 c2 e8 21 57    ..o..vr.......!W
10: aa 41 2a 9f 78 f2 8d 96 9c 76 33 ed 05 5f 9d 60    .A*.x....v3.._.`
20: ce 0b 11 b3 2c 81 d7 9c 77 de 0a 75 5f b2 af 49    ....,...w..u_..I
30: b9 67 8b fb 9e f4 16 93 26 d2 69 ea a5 e6 0a 47    .g......&.i....G
40: 51 a2 fa 82 06 d3 70 d2 b5 cb 90 ab 08 a9 5a ee    Q.....p.......Z.
50: a4 e2 be d8 92 a3 46 be 19 19 aa 33 e9 b4 1c 83    ......F....3....
60: 9a 4a 39 9d 70 bc 9a d5 6b 78 e2 ba 69 d1 bd bc    .J9.p...kx..i...
70: 3a 2b 95 69 a3 f2 b6 eb 8c a6 fa 25 13 7f af e9    :+.i.......%....
80: 47 99 9a ba d6 2b 2c a2 3c 12 67 6c b3 ea 11 b6    G....+,.<.gl....
90: 23 b4 e6 ae 08 ec ad 41 4e eb 65 82 58 6e c7 e1    #......AN.e.Xn..
a0: b2 38 02 b7 12 bd ed e1 44 5f 9c 8d 29 7b 11 9c    .8......D_..){..
b0: e3 06 65 ea 4f 09 15 56 d5 56 57 91 a5 d2 9c b2    ..e.O..V.VW.....
c0: dd 0a 20 ba 27 ce 9b 2f 46 12 6d e5 2b ac 14 21    .. .'../F.m.+..!
d0: 1b 6c 76 ca 89 15 d1 78 9c a2 88 67 a5 d9 fe 36    .lv....x...g...6
e0: 60 84 3e 4a f8 16 79 c9 cd 78 6e 51 4b 19 e4 50    `.>J..y..xnQK..P
f0: 4e 9a ea c7 63 61 fd d2 0a 51 49 f8 7a 67 57 ab    N...ca...QI.zgW.
100: b0 21 da e7 7f bf de b8 d4 51 35 01 05 e6 56 ff    .!.......Q5...V.
110: 2e da 96 8c 60 6a 44 ac bc 97 4d 3a 2a 85 54 d1    ....`jD...M:*.T.
120: 79 2e ab 9f e2 54 9b 92 f4 c1 68 db ac ed 45 0b    y....T....h...E.
130: e2 93 36 e5 96 a7 6e 69 dd 69 9b 56 39 be bb 29    ..6...ni.i.V9..)
140: 4f 58 ce 39 1f a3 79 4a 68 28 8c f7 21 4a d9 8a    OX.9..yJh(..!J..
150: 81 32 8a 63 8a ff 2a 6b d5 92 9a ee 76 20 7f 07    .2.c..*k....v ..
160: 56 38 dd 8a 68 61 65 a0 a4 8c 91 c6 69 70 ac ad    V8..hae.....ip..
170: 2a 26 b3 6d 6d 47 1b 49 7f 06 96 6f 56 29 89 44    *&.mmG.I...oV).D
180: 64 84 d7 19 17 d5 57 ba 76 d5 d2 b3 7d 5a b8 56    d.....W.v...}Z.V
190: 82 f0 d1 b8 a5 a2 ea b5 f9 9e bb 5d 62 e5 5a 5f    ...........]b.Z_
1a0: cb 95 e7 14 9b 68 c5 2a 1d ab 37 5d 2b df 82 26    .....h.*..7]+..&
1b0: 76 26 57 aa 5d c6 aa e7 50 70 59 0a a2 69 e2 1e    v&W.]...PpY..i..
1c0: 26 6c b2 07 f6 c6 23 9b 29 29 ba 9a 95 96 51 c8    &l....#.))....Q.
1d0: ef 66 a0 b6 db 54 a5 71 41 49 24 94 ec fd b6 9a    .f...T.qAI$.....
1e0: 7f 79 4e d9 6b 92 0d a5 78 55 49 11 29 88 94 85    .yN.k...xUI.)...
1f0: c3 9a 77 5b 9d 89 9d e4 d2 9d 5f 3a 7a 20 95 e8    ..w[......_:z ..
ecc data:
200: 49 29 59 69 e5 24 fb 7f cd e3 b5 94 5e 93 d6 09    I)Yi.$......^...
210: 2f c9 70 9f 01 e3 0b 75 18 b3 e8 38 01 9e 3b 7a    /.p....u...8..;z
220: 50 28 21 cc 05 68 40 25 b2 33 c9 a7 1e 1f 14 cc    P(!..h@%.3......
230: 4d 40 30 6e ef 94 03 ff

Get turned into this:
Code:
normal read:
0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
1a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
1b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
1c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
1d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
1e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
1f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................


Attachments:
sector.zip [3.92 KiB]
Downloaded 667 times

_________________
http://www.hddsuperclone.com
Home of HDDSuperClone
Top
 Profile  
 
 Post subject: Re: Any way to decode encoded read long data?
PostPosted: April 30th, 2015, 20:24 
Offline

Joined: January 29th, 2012, 1:43
Posts: 982
Location: United States
Quote:
Read any information sufficient to restore or not.
And if it is not enough, nor a miracle, do not allow you to restore reliable information.

All hope.
Repeat reading many times as unstable-read place does not give so much information that it will be possible to restore the algorithm.

The hamming code is supposed to be able to correct for small errors. If you are saying that when the errors go over that limit that the data becomes virtually unrecoverable due to the complexity of the algorithm, I would understand. But I wish to see it for myself. I want to know how it works.

_________________
http://www.hddsuperclone.com
Home of HDDSuperClone


Top
 Profile  
 
 Post subject: Re: Any way to decode encoded read long data?
PostPosted: May 1st, 2015, 11:01 
Offline

Joined: September 3rd, 2014, 6:36
Posts: 15
Location: Las Vegas, NV
maximus wrote:
Quote:
Read any information sufficient to restore or not.
And if it is not enough, nor a miracle, do not allow you to restore reliable information.

All hope.
Repeat reading many times as unstable-read place does not give so much information that it will be possible to restore the algorithm.

The hamming code is supposed to be able to correct for small errors. If you are saying that when the errors go over that limit that the data becomes virtually unrecoverable due to the complexity of the algorithm, I would understand. But I wish to see it for myself. I want to know how it works.



Yeah I'd like to understand how that works, too.


Top
 Profile  
 
 Post subject: Re: Any way to decode encoded read long data?
PostPosted: May 1st, 2015, 11:29 
Offline

Joined: September 29th, 2005, 4:10
Posts: 402
Location: Moscow
The exact same article about Hamming code
in Russian shows the whole process in pictures:
https://ru.wikipedia.org/wiki/%D0%9A%D0 ... 0%B3%D0%B0


Top
 Profile  
 
 Post subject: Re: Any way to decode encoded read long data?
PostPosted: May 2nd, 2015, 20:57 
Offline

Joined: January 29th, 2012, 1:43
Posts: 982
Location: United States
I am not having trouble understanding the hamming code. But I cannot see how the hamming code is used on a drive. The long data from a drive should make basic patterns if only hamming code, but it does not. It seems to be implemented in a special way. I wish to know how. And I do know it will be different for different manufacturers (WD and Seagate have very different long results).

_________________
http://www.hddsuperclone.com
Home of HDDSuperClone


Top
 Profile  
 
 Post subject: Re: Any way to decode encoded read long data?
PostPosted: May 3rd, 2015, 10:35 
Offline

Joined: September 29th, 2005, 4:10
Posts: 402
Location: Moscow
maximus,
Hamming code implemented in hardware in decoder CPU.
Hardly us when will be available custom made processor description.
But understanding how the algorithm work, is already clear that the lack of information for the recovery.
Nor any knowledge of the algorithm does not help us to recover the original information.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 36 posts ]  Go to page Previous  1, 2

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 12 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group