All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 20 posts ] 
Author Message
 Post subject: WD20NMVW special case on DFL
PostPosted: April 30th, 2018, 9:22 
Offline

Joined: September 17th, 2016, 16:06
Posts: 74
Location: India
Hi there every body, I have a WD20NMVW-11AV3S3 with serial number as WX11A8420D3Y.
The drive had gone slow. It detected normally(with the slowness), let me backup entire firmware and ROM.
Then I did a slow read fix followed by SMART reset over usb (which possibly can be the wrong step here).
Also mods 123,124,125,126,D002,D003 had checksum error which i corrected over usb itself.
Now after disconnecting the USB cable i reconnected it only to see the whole data is encrypted!
Earlier when it was first plugged in, it showed DATA and allowed me to backup the FW little slowly. However after the fix, the data is encrypted!

How can i reverse this and get the data decrypted.

The drive IDs and detects normally.
----
Repatching 02 32 and SMART modules with original backup doesnt decrypt data.

Also, would it be worth to try reallymine.

The HW USB/SATA chip is ASMEDIA 1501W.

--


Top
 Profile  
 
 Post subject: Re: WD20NMVW special case on DFL
PostPosted: April 30th, 2018, 17:40 
Offline

Joined: October 16th, 2013, 13:21
Posts: 717
Location: Brazil
If you really made a backup of the entire firmware, the easier first step will probably to restore this backup to the drive. If you can get the drive in the original situation, slow but reading, then you can rethink the strategy.


Top
 Profile  
 
 Post subject: Re: WD20NMVW special case on DFL
PostPosted: May 1st, 2018, 11:02 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9866
Location: Portugal
Hello there :

1 - First mistake - To work over USB. USB-ATA pass-trough might not work properly and this depends from drive to drive and it doesn't matter whatever firmware tool you use. It doesn't matter if you have the latest PC-3000 or something like a "simple" and "cheap" WDMarvel. If the USB bridge chip doesn't allow for the Vendor Specific Commands to pass to the ATA interface correctly you will be in big trouble. Always adapt to SATA, use compatible PCB or read modules by TTL.

2 - Second mistake, if the drive was "slow" but apart from that it was OK you shouldn't fix modules. You should just CLEAR RE-LO list and patch module 02 manually as you don't have a way to know what DFL does to module 02 unless you check that yourself.

- Maybe your drive did have the SED flag "on" and DFL cleared a portion of module 02 disabling SED or any other flag present there necessary for decryption ?

3 - Why did you correct modules 123,124,125,126,D002,D003 and what does this correction do ?

- Drive was working so you shouldn't have messed with those modules.
- We don't know how DFL correct the modules.
- We don't know if those modules were even bad.
- We don't know if those modules don't affect decryption.
- Most likely you don't have a proper copy of those as DFL shows them as bad ?

4 - Did you try to write ORIGINAL module 02 back to the drive and power it off/on ?

5 - Can you post original module 02 + patched module 02 (after DFL slow fix) ?

6 - Did you manage to make a full clone/image of the drive even if encrypted ?

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: WD20NMVW special case on DFL
PostPosted: May 3rd, 2018, 16:29 
Offline

Joined: September 17th, 2016, 16:06
Posts: 74
Location: India
Hi I was able to fix the drive. It was such a beautiful case study for me in terms of some key observations.
I had full SA backup...Plus the drive is healthy, so I knew I could always rewrite the SA and I did.
On doing so, the drive maintained its capacity and other detection parameters normally but on scanning the drive i got encrypted data only and that too OVER USB! So when i do hex view, the data is encrypted and that too over USB...so I believe the ASMEDIA chip practically did nothing or may be was instructed to do nothing..
Now every time I tried to rewrite 123 124 125 126 and D002 D003, it never wrote it by ID....i had to access the mod by aba, select all the hex values and 'replace selected' with the required module and finally push the write button and It wrote nicely.

Now some things
1)Rewriting SA yields normal capacity but encrypted data
2)did mods to track and wrote the tracks. All capacity ok..but the moment i try to scan the drive, the drive used to spin down and power cycle!!! WOW( Didnt have original track backups)

So finally, what i did was to write the stuff using the tracks and write 123,124,125,126 and D002 D003 by ABA by manually opening the mod,replacing the data values with the original counterparts and pushing the write button ( this is not conventional way to write MODS...If i use the utility to write, mods were unchanged.

So the goal was set to restore 123 124 125 126 D002 D003 with absolutely original data and state..By state I mean it was READ OK, ERROR CHECKSUM.
Once I did that I got un encrypted data over USB....now if I assume the ASMEDIA chip did nothing, by that logic, i should get decrypted data over SATA too...I shall try that in a day and let you know.

the said mods were found in RAM of the drive too...so I believe they may have some information, pointers or keys or some logic to decrypt the data.


More you can analyze faaaar better. This is just a small case report and observations that I wanted to share.

rgds
--


Top
 Profile  
 
 Post subject: Re: WD20NMVW special case on DFL
PostPosted: May 3rd, 2018, 16:40 
Offline

Joined: September 17th, 2016, 16:06
Posts: 74
Location: India
rogfanther wrote:
If you really made a backup of the entire firmware, the easier first step will probably to restore this backup to the drive. If you can get the drive in the original situation, slow but reading, then you can rethink the strategy.



Hi yes, since i did a limited set of actions..I preferred only to restore the state of the modules by hook or crook which gave me the result....
on doing it, the drive gave data nicely! :)


Also Slow read fix was not the cause of failure...it was the other said modules..they should be included in the list of key modules required for data recover of such WD Models ?

It will be great if some one verifies this with another WD20NMVW GREEN


rgds
--


Last edited by sin on May 3rd, 2018, 16:46, edited 1 time in total.

Top
 Profile  
 
 Post subject: Re: WD20NMVW special case on DFL
PostPosted: May 3rd, 2018, 16:44 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9866
Location: Portugal
Maybe this is the result of BUGS on the DFL tool ?

:shock: :shock: :shock:

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: WD20NMVW special case on DFL
PostPosted: May 3rd, 2018, 16:51 
Offline

Joined: September 17th, 2016, 16:06
Posts: 74
Location: India
Spildit wrote:
Maybe this is the result of BUGS on the DFL tool ?

:shock: :shock: :shock:


Exactly my friend. Even I am thinking in the same direction.


rgds
--


Top
 Profile  
 
 Post subject: Re: WD20NMVW special case on DFL
PostPosted: May 3rd, 2018, 16:57 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9866
Location: Portugal
Can you try something ?

Get the latest DEMO version of WDMarvel (free) :

http://www.hddoracle.com/viewtopic.php?f=146&t=2435

Try to READ MODULES with it. You can work over USB as well, chose WinAPI USB. You need to install low level driver so if you can use older windows 32 bit version as it's easy to install kernel drivers on it (doesn't have to be signed).

If you read 123 124 125 126 D002 D003 does it show ERROR (CRC or whatever) in WDMarvel ?

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: WD20NMVW special case on DFL
PostPosted: May 3rd, 2018, 16:59 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9866
Location: Portugal
Does DFL have option to write by ABA / PBA / whatever or does it write only by ID ?

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: WD20NMVW special case on DFL
PostPosted: May 4th, 2018, 10:08 
Offline

Joined: September 17th, 2016, 16:06
Posts: 74
Location: India
Hi there. Sure. I am very very new to way Marvel configuration..Currently I have 64Bit windows 7. I can surely downgrade to 32BIT if that is required. Sorry, I have read 0 documentation of Marvell and high time I read it up and have it up an running. Also,DFL has option to write by ABA0 /ABA 1 or ID.


Much love to every one,

rgds
--


Top
 Profile  
 
 Post subject: Re: WD20NMVW special case on DFL
PostPosted: May 9th, 2018, 12:01 
Offline

Joined: September 17th, 2016, 16:06
Posts: 74
Location: India
Hi, Didnt get a chance to check on Marvell.. It is just too buggy on my computer. Now the HDD is not with me as I have extracted the DATA and closed the case.
However, I have a HUBLT2 with same mods as error checksum and read ok.
The track on which relo is present is bad
Relo can not be moved to any other track as 01 can not be written after the record change.
However, I can read the ABA sector and patch another relo and write ok provided i keep the reading length less!
I am creating a new post.
It is a LPCX black.

rgds
--


Top
 Profile  
 
 Post subject: Re: WD20NMVW special case on DFL
PostPosted: May 9th, 2018, 13:53 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9866
Location: Portugal
sin wrote:
(...)However, I have a HUBLT2 with same mods as error checksum and read ok.


By now i would consider to use other tools instead of DFL to see if the same errors do have error.

Maybe DFL doesn't know how to read some modules ?

I would consider to use WDMarvel instead of that DFL Chineseware. But this is just me ...

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: WD20NMVW special case on DFL
PostPosted: May 9th, 2018, 17:29 
Offline

Joined: September 17th, 2016, 16:06
Posts: 74
Location: India
Sure, that will be done in a few days time. Straight away the most reliable tool in the market is what we are aiming for.

Did a nice trick, the relo track was not able to open up fully, however it could be read with lesser length.

I changed the length of the module 32 in RAM to 10 units and simply tried to scan the data...It gave access to the user area.

Simply removed the DFL cable and attached it to DDI. Imaging good now.

I dont know, all modern drives have those said modules as readable but no CRC.

DDI is just doing great job.


Rgds
--


Top
 Profile  
 
 Post subject: Re: WD20NMVW special case on DFL
PostPosted: May 10th, 2018, 14:50 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9866
Location: Portugal
The problem is with DFL !!! :? :? :?

Just try WDMarvel. It will do a GREAT JOB. Even people with PC-3000 can still make good use of WDMarvel !!! It's a very nice tool and very cheap for WD drives,

Good luck.

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: WD20NMVW special case on DFL
PostPosted: May 10th, 2018, 15:50 
Offline

Joined: September 17th, 2016, 16:06
Posts: 74
Location: India
Undeniably. Marvell is highly acclaimed.

I have purchased it thrice already for 30 days. Sadly I do not think so the author will agree to accept remaining amount and give me a life time version.

Let me think over and buy. There is one friend in Rajasthan,India who is extremely happy with it. So it is already there on my list.
Hope marvell has better knowledgebase than DFL.


Thanks

rgds
--


Top
 Profile  
 
 Post subject: Re: WD20NMVW special case on DFL
PostPosted: May 10th, 2018, 16:31 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9866
Location: Portugal
Just try the free DEMO and check if it can read your modules on that drive without CRC error !!!! If it can something is VERY WRONG with your DFL tool ...

You shouldn't be doing that manipulation in RAM as well to bypass the re-lo problem.

Your DFL most likely doesn't know how to properly read the module directory on modern drives and you are risking to cause huge irreversible damage to those drives if you continue to use it like you are doing.

Check with WDMarvel DEMO or SEDIV DEMO !!! If those can properly read the modules then next step is compare the modules with the ones DFL did read ...

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: WD20NMVW special case on DFL
PostPosted: May 11th, 2018, 8:50 
Offline

Joined: September 17th, 2016, 16:06
Posts: 74
Location: India
This is marvell and dfl side by side over USB. DFL reads every module as you can see.. ??Marvell??


Attachments:
Marvell.png
Marvell.png [ 199.88 KiB | Viewed 7751 times ]
Top
 Profile  
 
 Post subject: Re: WD20NMVW special case on DFL
PostPosted: May 11th, 2018, 8:53 
Offline

Joined: September 17th, 2016, 16:06
Posts: 74
Location: India
Spildit wrote:
Just try the free DEMO and check if it can read your modules on that drive without CRC error !!!! If it can something is VERY WRONG with your DFL tool ...

You shouldn't be doing that manipulation in RAM as well to bypass the re-lo problem.

Your DFL most likely doesn't know how to properly read the module directory on modern drives and you are risking to cause huge irreversible damage to those drives if you continue to use it like you are doing.

Check with WDMarvel DEMO or SEDIV DEMO !!! If those can properly read the modules then next step is compare the modules with the ones DFL did read ...



Can you please explain what could be other alternatives. Moving the module on other track is not possible as DFL and marvell (registered) both fail to write the entry table changes in 01 suggesting write failure.

I believe any change done in the RAM SHOULD be temporary. Right?


Top
 Profile  
 
 Post subject: Re: WD20NMVW special case on DFL
PostPosted: May 12th, 2018, 9:47 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9866
Location: Portugal
Interesting !!!

DFL is reading the drive by USB while WDMarvel can't do that on your drive.

Maybe the problems you are reporting are simply because of that !!!

Start by trying to "adapt" the PCB to SATA or use compatible SATA PCB instead ...

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: WD20NMVW special case on DFL
PostPosted: May 12th, 2018, 9:50 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9866
Location: Portugal
sin wrote:
Can you please explain what could be other alternatives. Moving the module on other track is not possible as DFL and marvell (registered) both fail to write the entry table changes in 01 suggesting write failure.

I believe any change done in the RAM SHOULD be temporary. Right?



Start by trying to use a SATA PCB ? Can you gain access to modules ? If not are you working with SED drives ? Can you disable SED flag on 02 by booting the drive intro kernel, loading overlav and dir to RAM, etc ... ? When you disable SED flag can you gain access to modules ?

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 20 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 2 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group