All times are UTC - 5 hours [ DST ]


Forum rules


Please do not post questions about data recovery cases here (use this forum instead). This forum is for topics on finding new ways to recover data. Accessing firmware, writing programs, reading bits off the platter, recovering data from dust...



Post new topic Reply to topic  [ 19 posts ] 
Author Message
 Post subject: Modify CHS on a Seagate 7200.12
PostPosted: January 6th, 2018, 21:23 
Offline

Joined: January 6th, 2018, 21:18
Posts: 5
Location: Maryland
Hey All,

I'm working to recover some data on a drive that I think has been infected. When mounting the drive in linux, it appears the geometry has been modified to 'lock' me out of some of the partitions on the drive. Currently the CHS is set to 1013 44 62, but should be 30401 255 63 by default.

I have access to the serial line and normal linux tools, but have not yet found a way to change the Geometry sizes. The serial terminal correctly shows 1d1c5970 LBA's (== 250gb).

Any ideas?

Thanks


Top
 Profile  
 
 Post subject: Re: Modify CHS on a Seagate 7200.12
PostPosted: January 6th, 2018, 21:39 
Offline

Joined: October 16th, 2013, 13:21
Posts: 578
Location: Brazil
Is there an HPA defined ? Mhdd or hdat2 could clear that.


Top
 Profile  
 
 Post subject: Re: Modify CHS on a Seagate 7200.12
PostPosted: January 6th, 2018, 22:02 
Offline

Joined: January 6th, 2018, 21:18
Posts: 5
Location: Maryland
heres the output:
root@testsys:/# hdparm -N /dev/sdb

/dev/sdb:
SG_IO: bad/missing sense data, sb[]: 70 00 05 00 00 00 00 0a 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
SG_IO: bad/missing sense data, sb[]: 70 00 05 00 00 00 00 0a 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
max sectors = 2764800/1(65538?), HPA setting seems invalid (buggy kernel device driver?)
root@testsys:/# hdparm --dco-identify /dev/sdb

/dev/sdb:
SG_IO: bad/missing sense data, sb[]: 70 00 05 00 00 00 00 0a 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
DCO Checksum FAILED!
DCO Revision: 0x0001
The following features can be selectively disabled via DCO:
Transfer modes:
udma0 udma1 udma2 udma3 udma4 udma5 udma6(?)
Real max sectors: 4980813
ATA command/feature sets:
SMART self_test security
SATA command/feature sets:
(?): NZ_buffer_offsets interface_power_management
root@testsys:/#


Top
 Profile  
 
 Post subject: Re: Modify CHS on a Seagate 7200.12
PostPosted: January 6th, 2018, 22:05 
Offline

Joined: January 6th, 2018, 21:18
Posts: 5
Location: Maryland
Here's what im seeing...but i cant access the rest of my partitions for some reason.

Disk /dev/sdb: 1.3 GiB, 1415577600 bytes, 2764800 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Device Boot Start End Sectors Size Id Type
/dev/sdb1 2 2740224 2740223 1.3G c W95 FAT32 (LBA)
/dev/sdb2 4096000 38911999 34816000 16.6G c W95 FAT32 (LBA)
/dev/sdb3 40960000 79871999 38912000 18.6G c W95 FAT32 (LBA)
/dev/sdb4 81920000 485375999 403456000 192.4G c W95 FAT32 (LBA)
root@testsys:/# testdisk /dev/sdb
Disk /dev/sdb - 1415 MB / 1350 MiB - CHS 1013 44 62, sector size=512


Top
 Profile  
 
 Post subject: Re: Modify CHS on a Seagate 7200.12
PostPosted: January 6th, 2018, 22:17 
Offline

Joined: August 18th, 2010, 17:35
Posts: 3193
Location: Massachusetts, USA
Try R-Studio for Linux demo.
Are you sure the drive is not actually failing? Checked SMART?

_________________
Hard Drive and RAID Data Recovery Specialist in Massachusetts


Top
 Profile  
 
 Post subject: Re: Modify CHS on a Seagate 7200.12
PostPosted: January 6th, 2018, 22:20 
Offline

Joined: January 6th, 2018, 21:18
Posts: 5
Location: Maryland
yeah the drive is active, available with all smart commands working...smart is where I confirmed LBA as 1d1c5970.

if you have some smart commands i could try, im all ears....


Top
 Profile  
 
 Post subject: Re: Modify CHS on a Seagate 7200.12
PostPosted: January 6th, 2018, 22:30 
Offline

Joined: August 18th, 2010, 17:35
Posts: 3193
Location: Massachusetts, USA
I meant SMART attributes possibly indicating the drive is degraded/failed. In Linux, can use Smartmon tools or R-Studio Demo has a SMART feature

_________________
Hard Drive and RAID Data Recovery Specialist in Massachusetts


Top
 Profile  
 
 Post subject: Re: Modify CHS on a Seagate 7200.12
PostPosted: January 6th, 2018, 23:33 
Offline

Joined: January 29th, 2012, 1:43
Posts: 373
Location: United States
For any modern LBA drive, the CHS is (roughly) calculated by the OS, or the program that being used. You can't change it. So that would indicate that there is a limited LBA access problem, perhaps related to HPA, but most likely the drive has other issues.


Top
 Profile  
 
 Post subject: Re: Modify CHS on a Seagate 7200.12
PostPosted: January 6th, 2018, 23:57 
Offline

Joined: January 6th, 2018, 21:18
Posts: 5
Location: Maryland
so what in the firmware/else tells the OS how big the LBA is?


Top
 Profile  
 
 Post subject: Re: Modify CHS on a Seagate 7200.12
PostPosted: January 7th, 2018, 0:35 
Offline

Joined: January 29th, 2012, 1:43
Posts: 373
Location: United States
The OS gets its information strait from the identify device command results from the drive itself.


Top
 Profile  
 
 Post subject: Re: Modify CHS on a Seagate 7200.12
PostPosted: January 7th, 2018, 10:24 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9063
Location: Portugal
This is a 7200.12 drive, did you use any "m" command on it by terminal ? DO NOT DO THIS. If by any chance you did use some sort of commands to regenerate translator / format drive / clear defect lists by terminal (or ATA) you might be "locked" out from some LBA point till the end of the LBA range by partial access problem.

Just get MHDD and scan the drive. Can you scan the totality of the LBA space from start to end ? Do you get errors from one point up untill the end ?

What about S.M.A.R.T. ? Can yu post a S.M.A.R.T. screen capture / photo of MHDD "smart att" command ?

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Modify CHS on a Seagate 7200.12
PostPosted: January 7th, 2018, 11:36 
Offline

Joined: January 29th, 2012, 1:43
Posts: 373
Location: United States
Since the OP is currently using Linux, here are a few commands to get some information.
The following command will get the basic information, we are looking for the LBAsects= number, which is the reported user addressable sectors:
Code:
hdparm -i /dev/sdb

This will show if there is a Host Protected Area to rule that out:
Code:
hdparm -N /dev/sdb

This will supply the SMART information, the important data is the attribute table, and most important are the raw values of Reallocated_Sector_Ct and Current_Pending_Sector:
Code:
smartctl --all /dev/sdb


Top
 Profile  
 
 Post subject: Re: Modify CHS on a Seagate 7200.12
PostPosted: January 7th, 2018, 11:55 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9063
Location: Portugal
Let's not forget that if the drive have a partial access problem then it will report the full LBA size but when accessing LBAs starting at one point up untill the end of the LBA space the drive will ABORT the read commands or will error and no data will be retrieved.

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Modify CHS on a Seagate 7200.12
PostPosted: January 7th, 2018, 12:06 
Offline

Joined: January 29th, 2012, 1:43
Posts: 373
Location: United States
Spildit wrote:
Let's not forget that if the drive have a partial access problem then it will report the full LBA size but when accessing LBAs starting at one point up untill the end of the LBA space the drive will ABORT the read commands or will error and no data will be retrieved.

Yes, but from what was posted above it seems to be identifying with a limited capacity:
Quote:
Disk /dev/sdb: 1.3 GiB, 1415577600 bytes, 2764800 sectors


Top
 Profile  
 
 Post subject: Re: Modify CHS on a Seagate 7200.12
PostPosted: January 7th, 2018, 12:19 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9063
Location: Portugal
Ok, Sound reasonable.

At any rate MHDD should be able to confirm the totality of available LBA space and if that space can be scanned after all.

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Modify CHS on a Seagate 7200.12
PostPosted: January 7th, 2018, 12:32 
Offline

Joined: January 29th, 2012, 1:43
Posts: 373
Location: United States
I completely missed the fact that he did the HPA command already (and even DCO), and it gave funky data. The SMART data still needs to be seen though to see if the drive is going bad.


Top
 Profile  
 
 Post subject: Re: Modify CHS on a Seagate 7200.12
PostPosted: January 7th, 2018, 12:38 
Offline

Joined: January 29th, 2012, 1:43
Posts: 373
Location: United States
According to the DCO results, the drive is reporting a max size of about 2.5GB
Quote:
Real max sectors: 4980813


Top
 Profile  
 
 Post subject: Re: Modify CHS on a Seagate 7200.12
PostPosted: January 7th, 2018, 13:02 
Offline

Joined: January 29th, 2012, 1:43
Posts: 373
Location: United States
Since there has already been terminal access, I think the next two questions should be:
What terminal commands have been performed on the drive?
How important is the data? Is it worth paying for professional recovery?


Top
 Profile  
 
 Post subject: Re: Modify CHS on a Seagate 7200.12
PostPosted: January 7th, 2018, 13:17 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9063
Location: Portugal
If the drive have head(s) / pre-amp damage and if the drive is not properly accessing the firmware then maybe it's getting the capacity out from the PCB code instead, reporting incorrect size. This is very typical on F3 drive arch with bad heads or that can't load firmware.

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 19 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 1 guest


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group