Switch to full style
In-depth technology research: finding new ways to recover data, accessing firmware, writing programs, reading bits off the platter, recovering data from dust.

Forum rules

Please do not post questions about data recovery cases here (use this forum instead). This forum is for topics on finding new ways to recover data. Accessing firmware, writing programs, reading bits off the platter, recovering data from dust...
Post a reply

Modify CHS on a Seagate 7200.12

January 6th, 2018, 21:23

Hey All,

I'm working to recover some data on a drive that I think has been infected. When mounting the drive in linux, it appears the geometry has been modified to 'lock' me out of some of the partitions on the drive. Currently the CHS is set to 1013 44 62, but should be 30401 255 63 by default.

I have access to the serial line and normal linux tools, but have not yet found a way to change the Geometry sizes. The serial terminal correctly shows 1d1c5970 LBA's (== 250gb).

Any ideas?

Thanks

Re: Modify CHS on a Seagate 7200.12

January 6th, 2018, 21:39

Is there an HPA defined ? Mhdd or hdat2 could clear that.

Re: Modify CHS on a Seagate 7200.12

January 6th, 2018, 22:02

heres the output:
root@testsys:/# hdparm -N /dev/sdb

/dev/sdb:
SG_IO: bad/missing sense data, sb[]: 70 00 05 00 00 00 00 0a 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
SG_IO: bad/missing sense data, sb[]: 70 00 05 00 00 00 00 0a 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
max sectors = 2764800/1(65538?), HPA setting seems invalid (buggy kernel device driver?)
root@testsys:/# hdparm --dco-identify /dev/sdb

/dev/sdb:
SG_IO: bad/missing sense data, sb[]: 70 00 05 00 00 00 00 0a 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
DCO Checksum FAILED!
DCO Revision: 0x0001
The following features can be selectively disabled via DCO:
Transfer modes:
udma0 udma1 udma2 udma3 udma4 udma5 udma6(?)
Real max sectors: 4980813
ATA command/feature sets:
SMART self_test security
SATA command/feature sets:
(?): NZ_buffer_offsets interface_power_management
root@testsys:/#

Re: Modify CHS on a Seagate 7200.12

January 6th, 2018, 22:05

Here's what im seeing...but i cant access the rest of my partitions for some reason.

Disk /dev/sdb: 1.3 GiB, 1415577600 bytes, 2764800 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Device Boot Start End Sectors Size Id Type
/dev/sdb1 2 2740224 2740223 1.3G c W95 FAT32 (LBA)
/dev/sdb2 4096000 38911999 34816000 16.6G c W95 FAT32 (LBA)
/dev/sdb3 40960000 79871999 38912000 18.6G c W95 FAT32 (LBA)
/dev/sdb4 81920000 485375999 403456000 192.4G c W95 FAT32 (LBA)
root@testsys:/# testdisk /dev/sdb
Disk /dev/sdb - 1415 MB / 1350 MiB - CHS 1013 44 62, sector size=512

Re: Modify CHS on a Seagate 7200.12

January 6th, 2018, 22:17

Try R-Studio for Linux demo.
Are you sure the drive is not actually failing? Checked SMART?

Re: Modify CHS on a Seagate 7200.12

January 6th, 2018, 22:20

yeah the drive is active, available with all smart commands working...smart is where I confirmed LBA as 1d1c5970.

if you have some smart commands i could try, im all ears....

Re: Modify CHS on a Seagate 7200.12

January 6th, 2018, 22:30

I meant SMART attributes possibly indicating the drive is degraded/failed. In Linux, can use Smartmon tools or R-Studio Demo has a SMART feature

Re: Modify CHS on a Seagate 7200.12

January 6th, 2018, 23:33

For any modern LBA drive, the CHS is (roughly) calculated by the OS, or the program that being used. You can't change it. So that would indicate that there is a limited LBA access problem, perhaps related to HPA, but most likely the drive has other issues.

Re: Modify CHS on a Seagate 7200.12

January 6th, 2018, 23:57

so what in the firmware/else tells the OS how big the LBA is?

Re: Modify CHS on a Seagate 7200.12

January 7th, 2018, 0:35

The OS gets its information strait from the identify device command results from the drive itself.

Re: Modify CHS on a Seagate 7200.12

January 7th, 2018, 11:36

Since the OP is currently using Linux, here are a few commands to get some information.
The following command will get the basic information, we are looking for the LBAsects= number, which is the reported user addressable sectors:
Code:
hdparm -i /dev/sdb

This will show if there is a Host Protected Area to rule that out:
Code:
hdparm -N /dev/sdb

This will supply the SMART information, the important data is the attribute table, and most important are the raw values of Reallocated_Sector_Ct and Current_Pending_Sector:
Code:
smartctl --all /dev/sdb

Re: Modify CHS on a Seagate 7200.12

January 7th, 2018, 12:06

Spildit wrote:Let's not forget that if the drive have a partial access problem then it will report the full LBA size but when accessing LBAs starting at one point up untill the end of the LBA space the drive will ABORT the read commands or will error and no data will be retrieved.

Yes, but from what was posted above it seems to be identifying with a limited capacity:
Disk /dev/sdb: 1.3 GiB, 1415577600 bytes, 2764800 sectors

Re: Modify CHS on a Seagate 7200.12

January 7th, 2018, 12:32

I completely missed the fact that he did the HPA command already (and even DCO), and it gave funky data. The SMART data still needs to be seen though to see if the drive is going bad.

Re: Modify CHS on a Seagate 7200.12

January 7th, 2018, 12:38

According to the DCO results, the drive is reporting a max size of about 2.5GB
Real max sectors: 4980813

Re: Modify CHS on a Seagate 7200.12

January 7th, 2018, 13:02

Since there has already been terminal access, I think the next two questions should be:
What terminal commands have been performed on the drive?
How important is the data? Is it worth paying for professional recovery?
Post a reply