WD Zeus Family Strange Behavior

[data-medics]

I'm having strange issues with this one. Maybe someone with more experience with this family can help.

I'm working on a Zeus family, 8 head, rampless nightmare. The drive comes ready but just shows "Zeus" as Model and "XYZ" serial and shows no capacity. It can however read modules/tracks just fine from both head 0 and 1 (reads them fast actually, not typical of head damage). It can even read the MBR at sector 0 in sector edit.

I first tried hot starting it by disabling all heads in RAM except 0 or 1, but same result. I even tried disabling all heads in ROM except 0 and then 1 - same result.

Then I attempted to smart hot swap (before I realized this family won't go to sleep). After writing all tracks to the donor and using patient PCB, I attempted to start it up but even the donor ID's the same way - no capacity or ID. I've done module checking in the module table, all pass except a couple log files (which are listed as un-important and I tried replacing from donor)

I'm pretty sure this rules out the heads as the issue, since the donor does the same thing.

Any Ideas?

[data-medics]

Update, I'm thinking this drive was sabotaged.

I checked module 2 and found that it doesn't even contain the drives serial number, model, etc.

I replaced it with module 2 from a donor, and now the drive shows capacity, has sector access, reads/writes data just fine, but it's all blank except for the very last sector (EFI Information) as far as I can tell.

My guess would be someone or some virus did a number on this one. Anyone ever heard of a virus that can tweak module 2 of a hard drive??? Only reason I ask is that the guy swears he didn't take it anywhere but here.

[northwind]

Everybody lies

[labtech]

Everybody lies

It all always surprises me how effective is in telling the customer: "Tell us exactly what has happened with the drive since failure OR the data is unrecoverable OR if you want us to keep on dinging for something that is likely to yield were little, if anything at all, then is an upfront non-refundable fee of $xxx(x) applies! WHy? Because our tests definitely indicate failure(s) on the drive that are likely unable to take place naturally."

Then we start getting somewhere quickly toward the right direction, as they typically don't like the words "unrecoverable" and "$".

Sorry, but the BS is above my neck line. More like forehead, if not higher.

@data-medics
Unless it is BS, my educated guess is that somebody may have mixed drives up and they provided you the wrong drive. Lots of computer shops do this where they have crap all over the place and give back the customer a different drive and not the original failed one.

[lcoughey]

@data-medics
Unless it is BS, my educated guess is that somebody may have mixed drives up and they provided you the wrong drive. Lots of computer shops do this where they have crap all over the place and give back the customer a different drive and not the original failed one.

I agree...it is several times a year that we are supplied with the wrong drive...and, for some reason, the client feels that they no longer need to pay us for our services because we didn't recover the data that they were looking for, even though it is 100% not our fault that they supplied the wrong drive.

[data-medics]

Still seems strange to me that module 2 looks like it was intentionally tampered with to make the drive inoperable. I'm wondering if he already sent it somewhere for recovery and didn't pay them.

[labtech]

Still seems strange to me that module 2 looks like it was intentionally tampered with to make the drive inoperable. I'm wondering if he already sent it somewhere for recovery and didn't pay them.

Not a first either - hate to say, but it is true

[fzabkar]

What did module 2 look like? Are you aware that there is sometimes a backup copy in module 802F?

FWIW, people often use HDDHackr to modify their drives. HDDHackr makes changes to modules 02 and 0D. Specifically, HDDHackr changes the firmware version in 0D and the model number, serial number and capacity in 02. This doesn't explain the null data, though.

[Doomer]

What did module 2 look like? Are you aware that there is sometimes a backup copy in module 802F?

Are you aware that Zeus does not have module 802F?

[fzabkar]

What did module 2 look like? Are you aware that there is sometimes a backup copy in module 802F?

Are you aware that Zeus does not have module 802F?

Did you not see that I said "sometimes"?

[Doomer]

Did you not see that I said "sometimes"?

Zeus does not have 802F, not "sometimes" not ever.

[fzabkar]

Did you not see that I said "sometimes"?

Zeus does not have 802F, not "sometimes" not ever.

That's not what I was implying at all. You're just being pedantic.

[data-medics]

Here's the original Module 02 before I replaced it. Doesn't look like any I've ever seen for Zeus, but it almost perfectly mimics a drive with bad heads.

[data-medics]

I'm imaging it regardless, and I'm finding that there is data starting around the 400,000,000 sector mark and ending around 600,000,0000 sector mark. Might just be useless crap, but it's worth investigating.

The whole thing seems strange to me. The drive is from a My Book external too, not sure why/how it could have been modified over USB...

[fzabkar]

I see now that the drive is an older model with 2-byte module IDs. HDDHackr only works with ROYLs. Sorry for wasting your time.

[fzabkar]

I see now that the drive is an older model with 2-byte module IDs. HDDHackr only works with ROYLs. Sorry for wasting your time.

Er, 1-byte.

[fixhdd]

WD HDD needs to determine the FW fault or physical faults, you this is obviously physical fault.

[data-medics]

WD HDD needs to determine the FW fault or physical faults, you this is obviously physical fault.

The drive works flawlessly now that I replaced module 2 (shown above). Imaged every last sector. I can't see how a hardware malfunction could remove the model/serial # and capacity from module 2. Just seems like sabotage to me.

Plus the first half of the drive appears to have been zero filled, another indication of intentional tampering.