Drive full with two patterns

[maddin]

Hello,

I am imaging an drive and i see a ton of sectors full with
0x77 (w) or with
0x78 0x56 0x34 0x20 (xV4.) repeated all over the sector.

I am just curious what that could be? My only theory is that this pattern come from a shredder or some tool like that... Is that possible?

[Dananjaya]

what is the Drive model?

[DR-Kiev]

It is absolutely OK . Some of raid/hba controllers put that pattern .

[maddin]

what is the Drive model?

It's a Seagate 7200.11 drive with 250GB (ST3250310NS) with Firmware SN04.

I was just a bit unsure because that drive don't give me access to alsmost any firmware parts:

Code:

Identifying device...
Device identification error!

Getting detailed firmware version...
Failed to get firmware version!

Physical sector size : .............................Failed to get

physical sector size of service area : .............Failed to get

Number of physical heads : .........................Failed to get
Get System module information ...
     ID     length     Description
=========================

Failed to get system module information!

Getting DT information...

ROM:
   ID     Offset address     Length
============================

   00     06020100     33792   
   01     06020000     256   
   04     04001000     4096   
          0602BE00     4096
             total     8192
   05     0006C000     81920   
   08     10070000     948   
   0A     060A731C     1024   
   12     100D4000     104   
   13     060B1F6C     544   
   14     060B218C     64   
   15     00000000     524288   

Getting service area size.......
Service area size: : ................................Fail

Getting list  of sys files.......
Serial port error!
Unable to get relevant data from DT List!

It also reported 0 byte capacity and don't give me access to the terminal.

Only way I got the imaging working was by manually setting sector-count, blocksize, ... in MRT.

Fianlly it took 19h to image that 250GB and that patterns was all over the place what make me a bit unsure. Now after the image is complete i see how much empty space is on that drive (ca. 67%) and that there was really some data which is fine. While imaging I saw most time just that pattern and that made me nervous.

[magnetepazzo]

it is possible that in those areas there are deleted data that you can obviously read, often when the disks have a lot of time and therefore customers have copied everything you come across in this situation. I hope I have understood your situation well, you have scanned 100% of the surface seeing data here and there on the whole surface but when you opened the disk you found a quantity not consistent with the lhex you saw, right?

[maddin]

it is possible that in those areas there are deleted data that you can obviously read, often when the disks have a lot of time and therefore customers have copied everything you come across in this situation. I hope I have understood your situation well, you have scanned 100% of the surface seeing data here and there on the whole surface but when you opened the disk you found a quantity not consistent with the lhex you saw, right?

I got some data back - but huge portion of the empty space has that pattern. I was just curiour what that is and where it came from because i never saw that pattern.

Further I am not sure if that patterns have something to do with the firmware-problem. I also never saw a drive which cant access most od the firmware and don't report a serial or any capacity.

[magnetepazzo]

Of course you can't read firmware data in those areas that are intended for user data, most likely it is empty space after deletion

[maddin]

Of course you can't read firmware data in those areas that are intended for user data, most likely it is empty space after deletion

I am new to firmware-issues but I know that I have to read it from special areas. In that case I could not get the terminal working and MRT was not able to read the firmware via terminal and not via the SATA-cable. Even the orig. Seagate-Software could not communicate with that drive...

I was just curious if that pattern can be caused by some issue with the firmware but now i know it's most likely some from a RAID-controller or from soke kind of secure deletion.

[DR-Kiev]

Of course you can't read firmware data in those areas that are intended for user data, most likely it is empty space after deletion

I was just curious if that pattern can be caused by some issue with the firmware but now i know it's most likely some from a RAID-controller or from soke kind of secure deletion.

No, that pattern in user area has nothing to do with FW

[Arch Stanton]

okay NVM

[fzabkar]

It also reported 0 byte capacity and don't give me access to the terminal.

Only way I got the imaging working was by manually setting sector-count, blocksize, ... in MRT.

I don't understand this. Surely the zero capacity issue is a symptom of a firmware problem, in which case there would be no access to the user area until the problem is corrected. If so, then the retrieved data must be garbage, or am I misunderstanding something? :?

[maddin]

I don't understand this. Surely the zero capacity issue is a symptom of a firmware problem, in which case there would be no access to the user area until the problem is corrected. If so, then the retrieved data must be garbage, or am I misunderstanding something?

Nope, after setting the amount of sectors and the sector size i could image it and got all data back except 33 sectors which could not read.

After setting sector-size and count I opened the Hex-Editor and looked for sector one. After that looked promissing i checked if I can read the drive with the File Explorer. As that tool was able to read the filesystem and showed me all folders and files i started imaging. The Data-extractor worked but with a lot of restarts and timeouts - took me ca. 19h and multiple passes to image the 233GB. All user-data works as far as I saw. Practically that case would be solved but anyway I would be interested how to solve the firmware-issue as well...

The firmware-issue is still not fixed and i can't access the terminal or get any serial-number or other informations. I was able to backup the ROM but when I tryed to do a virtual start in MRT I got Error 80000001!

[maddin]

After setting sector-size and count I opened the Hex-Editor and looked for sector one. After that looked promissing i checked if I can read the drive with the File Explorer. As that tool was able to read the filesystem and showed me all folders and files i started imaging.

... not sure if that's always the case but it saved my butt.