ST3250318AS HP11 - Console OK, Spin OK - HEEELP Please

[ercorreia]

Hi all

I have a ST3250318AS firmware:HP11 SN:9VY0JY7N DateCode:09523 Thailand.

After a power surge it does not boot anymore.
Measured Controller board - without shorts.
Dumped the SPI Flash. Measured coils resistance ~3.6ohm each.
Powering it:
- The sounds seems OK (motor speeding up, some reading noises).
- Plugged into USB-SATA adapter on windows (omg.. did i make it worse?) and it detected two partitions but can't retrieve partition names nor read data. On Linux read error messages, also detects partitions sdc1 and sdc2

Can someone please help me with this? Maybe some file on System Area? How to proceed?


Serial terminal access:
F3 1>
New Skews HP_PSG Pharaoh 0F with VTPI,RAP16,Yeti 3.0
Product FamilyId: 3F, MemberId: 06
HDA SN: 9VY0JY7N, RPM: 7201, Wedges: 120, Heads: 1, Lbas: 1D1C5970, PreampType: 59 01
PCBA SN: 00007951L7P0, Controller: YETIST_3_0(649A)(3-12-3-2), Channel: AGERE_COPPERHEAD_LITE, PowerAsic: MCKINLEY DESKTOP LITE Rev 94, BufferBytes: 800000
Package Version: PH0G2C.HPD1.DS022H.HP11 , Package P/N: 100573513, Package Builder ID: AT,
Package Build Date: 05/18/2009, Package Build Time: 17:02:44, Package CFW Version: PH0G.HPD1.00167620.AT00,
Package SFW1 Version: C23D, Package SFW2 Version: ----, Package SFW3 Version: ----, Package SFW4 Version: ----
Controller FW Rev: 05181702, CustomerRel: HP11, Changelist: 00167620, ProdType: PH0G.HPD1, Date: 05/18/2009, Time: 170244, UserId: 00236537
Servo FW Rev: C23D
RAP FW Implementation Key: 10, Format Rev: 0001, Contents Rev: A1 05 08 03
Features:
- Quadradic Equation AFH enabled
- VBAR with adjustable zone boundaries enabled
- Volume Based Sparing enabled
- IOEDC enabled
- IOECC enabled
- DERP Read Retries enabled
- LTTC-UDR2 compiled off

Attachments

console output

disc label

[northwind]

Please post terminal output directly after power on, not after you press CTRL+L.

[ercorreia]

Hi northwind!

Thanks for your reply.

Here is what you asked for. In the attached log there is also the Tlist, Plist and Glist.

Is there any other information/commands that might help? Can you see what the problem is and how to solve it to RECOVER data (don't care much about the HDD itself).

Best regards!

Code:

Rst 0x08M
(P) SATA Reset

Family    : YETIST_3_0(649A)(3-12-3-2)
Admin     : PH0G2C.HPD1.DS022H.HP11
Firmware  : HP11
Speed     : 7201 RPM
Head      : 1
Capacity  : 488397168 (250G)
S/N       : 9VY0JY7N


F3 T>
ASCII Diag mode
F3 T>/1
F3 1>N5
Att
Num  Flgs normlzd worst raw
1   002F   5C     5C   000000031B748C // read error rate
3   0023   62     61   00000000000000 // spin-up time
4   0032   64     64   000000000003DA // start/stop count
5   0033   25     25   00000000000A38 // rellocated sector count
7   002F   56     3C   0000001896CDE6 // seek error rate
9   0032   43     43   0000000000712D // power on hours
A   0033   64     64   00000000000000 // spin retry count
C   0032   64     64   000000000003DB // power cycle count
B8   0033   64     64   00000000000000 // End-to-End error / IOEDC
BB   0032    1      1   0000000000007E // Reported Uncorrected Errors
BC   0032   64     61   00000700070008 // Command timeout
BD   003A   60     60   00000000000004 // High Fly Writes
BE   0022   48     3A   0000001C1C001C // Temperature Difference or Airfow Temperature
C2   0022   1C     2A   00000F0000001C // Temperature
C3   003A   24     1D   000000031B748C // HW ECC Recovered
C4   0032   25     25   00000000000A38 // Rellocation Event Count
C5   0032   40     40   000000000005CD // Current Pending Sector Count
C6   0030   64     64   0000000000055A // (offline) Uncorrectable Sector Count
C7   003E   C8     C8   00000000000001 // UDMA CRC Error Count
0   0000    0      0   00000000000000 // why zero??
0   0000    0      0   00000000000000
0   0000    0      0   00000000000000
0   0000    0      0   00000000000000
0   0000    0      0   00000000000000
0   0000    0      0   00000000000000
0   0000    0      0   00000000000000
0   0000    0      0   00000000000000
0   0000    0      0   00000000000000
0   0000    0      0   00000000000000
0   0000    0      0   00000000000000
F3 1>

F3 T>/7
F3 7>X
Head 00 Resistance 00DC



Attachments

log_from_powerup.txt

(382.88 KiB) Downloaded 438 times

[ercorreia]

Hi all,

I managed to copy (terminal) some SA files, see ZIP

Hope it has all information needed for give me some guidance.. important data to be recovered.

Thanks!!!

Attachments

F3.zip

Files from SA

(14.8 KiB) Downloaded 373 times

[Lardman]

If the data is important you'd do better giving it to a DR pro before it's too late. If you want to DIY it I'd be cloning/imagining that as soon as possible if I were you, use something like hddsuperclone to be as gentle as you can.

Worry about the logical recovery from the copy when you have it on known good hardware.

[ercorreia]

Hi,

1) BIOS ROM seems to be OK. Is there any further check I can do in it (bitflips and other problems)?

2) This HDD has only one head. Using terminal I was able to read attached SA files. They seem OK (there are strings, patterns, and so on...doesn't look like garbage). Does it mean that the head is at least "good enough"? Are the adaptives files supposed to be the "same" as in the ROM (as per F3 Rom explorer CAP+RAP+SAP)?

3) Please point me on how can I try to read user data using terminal?

I made a simple firmware in a USB Microcontroller to dump the RX and TX communication + timming between the HDD terminal and PC while using some tools (F3 Seagate Tools / ST-1.3) to sniff and understand the Seagate F3 commands [also referring to "ST-10 Diag Commands.pdf"]. I'm studying SLIP now.

My wild guess is that the solution is not difficult for a seasoned DR, but I'm a newbie.

I tried gddrescue (gently) but could not retrieve not even one bit from the user area (start=0 from the block device /dev/sdc 30MiB in 512 block size without Linux cache) which is very odd to me since the HDD always detect the partitions and from what I remember the MBR is @ CHS 0,0,1 [LBA 0].

Please some guidance.. I can't afford to pay a professional now. If I could I would have paid already.

Attachments

F3 ROM explorer

ROM_dell_backup.zip

Flash

(429.03 KiB) Downloaded 426 times

F3.zip

Files

(14.8 KiB) Downloaded 452 times

[Lardman]

1. Flips and rot would produce checksum errors.
2. Reading the SA confirms the SA can be read and the head is not dead.
3. You're misunderstanding your problem.

If you can see partitions on the drive you're reading the UA. If you keep blindly stabbing at the SA you are likely to brick the drive.

As suggested previously, try cloning the drive with HHDsuperclone, it is more user friendly and forgiving than ddrescue, give it a chance to run and then post the log file. There is also a head test option which will spot check areas in different zones of the drive, I'd suggest trying that first.

If your data is important it won't do any more damage leaving the drive unplugged until you can afford professional DR, keep trying to recover the drive yourself could.

[maximus]

If the drive always lists the partitions but then no data can be read, it possibly is locking up with a fault after attempting to read a certain area. Try to clone with HDDSuperClone and see what happens, and post the results. And also post the hddsuperclone progress log file, preferably as an attachment. There is a possibility the pro version could help, but I would need to see the results of the attempt to know. Also the drive needs to be connected directly via SATA (no USB adapter if you are using one).

Edit: You also need to make sure the OS is not trying to mount it. I don't know what Linux OS you tried when attempting ddrescue, but you need to make sure automount of disks is disabled, as that could be causing the fault lockup.

[ercorreia]

Sorry for the delay. No success using Linux to recover.

Using Native SATA port:
1) BIOS always detects HDD correctly (name & size) after power on.

2) Linux Kernel correctly scans ATA bus, detects disk name/partitions [its correctly reading LBA 0!)/disk size.
It says "multi 16" (I think its 16*512 = 8K block transfers. DOES THIS OLD DRIVE supports it?). This is another PC (not the HDD original PC).

3) During Kernel booting libata issues a BMDMA error (ATA_BMDMA in ATA spec) and from there some more errors until sda is disabled.

4) After the system boots /dev/sda is not accessible anymore. If I try to read from it, just zero bytes, in hddsuperclone it is not listed or listed with 0 size.

5) I tried to issue Linux commands for "device delete", "scsi autodetect" and "sata hotplug" without success. Drive seems to be "dead" until power cycle. Maybe if I try a soft reset with terminal? Maybe its BUSY or maybe really "crashed" (firmware crash).

--> Tried to disable libata on ata1 during boot with kernel command line parameters. No success either.

--> Tried later with an USB converter and same results (plugged event on kernel log time=659.88).

--> Tried different sata/power cables, three different PCs, cleaned motor/sensors/connector contacts

From userspace I tried hdparm -I (ATA command IDENTIFY 0xEC sent using IOCTL to the kernelspace in HDIO_DRIVE_CMD).

Finally I wrote my own C program to send this "ask for identity" ATA command using ioctl without success.



I took note of the LBA48 addresses giving read errors and using TERMINAL I could read them!. I will document this later, but i wrote a python script that I provide an arbitrary LBA and it returns 512byte data from it.

Using this script I read the MBR, hand-decoded the two NTFS partitions and I was able to read their boot sector and from there the address of the $MFT table.

As a last resort I will write a very simple NTFS read-only implementation that uses this "serial read method" to see if I can list the files. Or maybe using network block device kit so I can use kernel ntfs driver and filter out write operations.


What are the possible causes?
- Maybe a bad RAM chip on the HDD PCI? And when processing ATA commands things go crazy?
- The BIOS of the original DELL PC lost its CMOS. It has a default "RAID" mode for SATA and I'm not sure if it was enabled while the disc was working. I have to dig deeper on this, but can this be the case?
- I am not sure if this HDD is from that transition era of 512byte -> 4Kbytes sectors and there was a severe data loss due to incompatibility after CMOS was lost
- Any other ideias?

I took a look at DEEP SPAR and I saw it has a very clever function that resets the drive after a failed read much earlier than the drive timeout itself so "bad" sectors are "discarded" in the first pass very quickly and without torturing the drive. But I'm not ENTIRELY sure that the BOARD is good.

I think I will buy a replacement PCB, swap "BIOS" SPI Flash and give it a try. I will also search for an older PC that I can configure in BIOS to use just PIO modes or slower DMA.

Any more guidances? Desperation here...


[ 14.888038] ata1.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x0
[ 14.888050] ata1.00: BMDMA stat 0x24
[ 14.888056] ata1.00: failed command: READ DMA EXT
[ 14.888064] ata1.00: cmd 25/00:80:80:28:03/00:01:00:00:00/e0 tag 0 dma 196608 in
res 51/40:00:d3:29:03/40:00:00:00:00/00 Emask 0x9 (media error)
[ 14.888074] ata1.00: status: { DRDY ERR }
[ 14.888079] ata1.00: error: { UNC }
[ 15.008149] ata1.00: configured for UDMA/100
[ 15.008170] sd 0:0:0:0: [sda] tag#0 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_SENSE
[ 15.008172] sd 0:0:0:0: [sda] tag#0 Sense Key : Medium Error [current]
[ 15.008174] sd 0:0:0:0: [sda] tag#0 Add. Sense: Unrecovered read error - auto reallocate failed
[ 15.008177] sd 0:0:0:0: [sda] tag#0 CDB: Read(10) 28 00 00 03 28 80 00 01 80 00
[ 15.008179] blk_update_request: I/O error, dev sda, sector 207315 op 0x0:(READ) flags 0x80700 phys_seg 2 prio class 0
[ 15.008222] ata1: EH complete
[ 17.624045] ata1.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x0
[ 17.624055] ata1.00: BMDMA stat 0x24
[ 17.624060] ata1.00: failed command: READ DMA EXT
[ 17.624068] ata1.00: cmd 25/00:00:00:0a:00/00:02:00:00:00/e0 tag 0 dma 262144 in
res 71/04:04:9d:00:32/04:00:00:00:00/e0 Emask 0x1 (device error)
[ 17.624078] ata1.00: status: { DRDY DF ERR }
[ 17.624083] ata1.00: error: { ABRT }
[ 17.684072] ata1.00: both IDENTIFYs aborted, assuming NODEV
[ 17.684073] ata1.00: revalidation failed (errno=-2)
[ 17.684086] ata1: hard resetting link
[ 17.684087] ata1: nv: skipping hardreset on occupied port
[ 18.156050] ata1: SATA link up 3.0 Gbps (SStatus 123 SControl 300)
[ 18.182188] ata1.00: both IDENTIFYs aborted, assuming NODEV
[ 18.182190] ata1.00: revalidation failed (errno=-2)
[ 23.240031] ata1: hard resetting link
[ 23.240033] ata1: nv: skipping hardreset on occupied port
[ 23.712049] ata1: SATA link up 3.0 Gbps (SStatus 123 SControl 300)
[ 23.776070] ata1.00: both IDENTIFYs aborted, assuming NODEV
[ 23.776072] ata1.00: revalidation failed (errno=-2)
[ 23.776080] ata1.00: disabled

Attachments

hdparm-usb.txt

hdparm -I (which issues an ioctl -> kernel -> identity ATA command)

(755 Bytes) Downloaded 315 times

dmesg_usb.txt

Kernel log with usb-sata converter

(59.94 KiB) Downloaded 366 times

dmesg_native_sata.txt

Kernel log with native sata

(64.36 KiB) Downloaded 388 times

[maximus]

Is the data important enough to pay for professional recovery? You need to stop what you are doing until you can answer that question. Also, this does not appear to be any issue with the pcb.

There is a possibility that the pro version of hddsuperclone could help, but this is a serious failing drive condition. What you report is that the drive will initially read at least sector 0, and then go offline. Without a pro hardware tool (or the pro version of hddsuperclone) you will not get anywhere with this drive using normal software. If you want to see if you can access it with the free version of hddsuperclone, you would need to set your bios to IDE mode, and try the Direct PIO mode. You would also need to hide/disable the drive. This is not a simple recovery. I am not in any way telling you that hddsuperclone can help, you need to figure that out on your own.

[fzabkar]

You can use my ZOC script to modify several firmware parameters that may stabilise your drive:

http://www.hddoracle.com/viewtopic.php?f=113&t=1867

Alternatively, you could type the commands directly into terminal. Be aware that the commands are Case Sensitive.