Data recovery and disk repair questions and discussions related to old-fashioned SATA, SAS, SCSI, IDE, MFM hard drives - any type of storage device that has moving parts
November 7th, 2023, 17:07
Hi, i have a Hitachi media - I suspect that someone cleared the S.M.A.R.T and moved the G-list to the P-list in order to sell the media as a new one. Is there any way to prove that such actions were performed?
November 7th, 2023, 18:18
Compare PSHT of copy 0 against PSHT factory copy with hex editor.
If they are different, your suspect should be confirmed.
November 8th, 2023, 5:39
michael chiklis wrote:Compare PSHT of copy 0 against PSHT factory copy with hex editor.
If they are different, your suspect should be confirmed.
ok read this document
http://us.mrtlab.com/tech/hitachi/39_2.htmli hitachi exist 3 copy of p-list?
factory P-List (PSHT)
PDM1
PDM2
should I compare PSHT with PDM1 or PDM2?
November 8th, 2023, 7:57
Yes.
PDM1 and PDM2 are identical, so you can choose which one to compare against PSHT.
For comparing you can use HxD with command CTRL+K
https://mh-nexus.de/en/hxd/
November 8th, 2023, 8:34
To organize my knowledge,
PSHT - is an abbreviation of ?
further, moving G-List to P-List in software modifies PDM1 and PDM2, the PSHT module remains intact?
November 8th, 2023, 9:14
PDM1 and PDM2 are the factory copies (copy_NA), this never get modified/updated from drive fw... only manually you can change them but there isn't any reason to do that because they don't have any effect on drive behaving.
In real life, the only reason to modify factory copy is for "sabotage".
PSHT in copy 0 and copy 1 is the one that can get modified and is the one that gets loaded into RAM. If somebody sends command G to P list then PSHT changes if there were entries in G.
If you find that PSHT is different from PDM copies, then you could try to fix by overwriting PDM into PSHT.
I don't remember if mrt has any bugs with hitachi arm utility, if you decide to overwrite modules it may point to wrong adresses and make everything worse.
HOwever, if you find that PSHT is identical to PDM copies, you don't have to rewrite anything because the issue is not there... unless there was some sabotage from any company, but in that case you will not able to restore it.
November 8th, 2023, 9:40
PDM issue usually cause translator issues, in this case you will not be able to access to sectors since a certain LBA.
I don't think will cause slow reading.
I've ask how the drive behavies when you try to clone in differente zones, but you've never answered that.
https://forum.hddguru.com/viewtopic.php ... 00#p306600this could help you to understand if you have just bad sectors on some portion of surface or if there are also weak heads.
MRT DE can help you better to figure how it behavies after doing head map.
November 8th, 2023, 10:09
This is a completely different case, unrelated to my other topic.
In this case, my only task is to determine whether anyone "programmatically refurbished (Clear smart and move G-list to P-list)" the disk before selling it.
I do not need to recover the data contained on this medium
November 8th, 2023, 13:51
Ok sorry, i thought it was the same case.
November 9th, 2023, 9:31
im read modules from drive
the checksum doesn't lie - the files are identical
- Code:
pi0tr@DESKTOP:/mnt/c/Users/pi0tr/HGST$ sha256sum *
3b63629f99dd37ea2aa8b296c16923ab5f7ec5494f6521edf3242006b7aebaf9 PDM1.rpm
3b63629f99dd37ea2aa8b296c16923ab5f7ec5494f6521edf3242006b7aebaf9 PDM2.rpm
3b63629f99dd37ea2aa8b296c16923ab5f7ec5494f6521edf3242006b7aebaf9 PSHT.rpm
November 9th, 2023, 12:19
PDM1 and PDM2 physically refers to the same address as PSHT copy0 and copy1, so this does not give you the answer.
I doubt you can easily access factory copy on these drives.BTW, i can't seem to notice where you mentioned your drive model.
pepe
November 9th, 2023, 12:58
Pepe, do you mean that factory copies (PDM1 - PDM2) on ARM drives are not really factory copies?
If i understood, on ARMs drives, PDM points to PSHT same addresses, this means that always PDM = PSHT
If so, there is a way how to get real factory copy?
On IBM Hitachi drives (no ARM), PDM copies are always real factory copies?
November 9th, 2023, 15:12
pepe wrote:PDM1 and PDM2 physically refers to the same address as PSHT copy0 and copy1, so this does not give you the answer.
I doubt you can easily access factory copy on these drives.BTW, i can't seem to notice where you mentioned your drive model.
pepe
3x Hitachi HUA722010CLA330
1x label HGST but the same familiy
Firmware: 3EA
November 9th, 2023, 21:04
Just check their addresses and you will see. PDM1 and PDM2 points to PSHT copy 0 and 1 on old drives too.
pepe
January 6th, 2024, 12:38
michael chiklis wrote:Compare PSHT of copy 0 against PSHT factory copy with hex editor.
If they are different, your suspect should be confirmed.
thanks for sharing, how to use these please? i wouldlike to reset count hour on my hdd seagate 2.5"
Thanks
January 6th, 2024, 12:39
michael chiklis wrote:Compare PSHT of copy 0 against PSHT factory copy with hex editor.
If they are different, your suspect should be confirmed.
thanks for sharing, how to use these please? i wouldlike to reset count hour on my hdd seagate 2.5"
Thanks
Powered by phpBB © phpBB Group.