All times are UTC - 5 hours [ DST ]


Forum rules


Please do not post questions about data recovery cases here (use this forum instead). This forum is for topics on finding new ways to recover data. Accessing firmware, writing programs, reading bits off the platter, recovering data from dust...



Post new topic Reply to topic  [ 48 posts ]  Go to page Previous  1, 2, 3
Author Message
 Post subject: Re: Seagate Terminal Tutorial – Reading Disk Sectors Via Ter
PostPosted: January 21st, 2014, 20:47 
Offline

Joined: October 24th, 2005, 17:04
Posts: 242
? Sorry, but what you want to do? What is the goal in all texts ? :oops:


Top
 Profile  
 
 Post subject: Re: Seagate Terminal Tutorial – Reading Disk Sectors Via Ter
PostPosted: January 21st, 2014, 20:58 
Offline

Joined: May 16th, 2009, 9:32
Posts: 325
Location: UNited Kingdom
To learn how it all works and fits together and share an overview of what can be done via Terminal.
Original aim was to read user sectors on a damaged / not ready disk to confirm user data was still their and how accessable it was. Then to look at 4K physical sectors. Then to look at some of the SA / modules.

Or to quote The Hitchhikers Guide to the Galaxy
"Well, it’s partly the curiosity, partly a sense of adventure, but mostly I think it’s the fame and the money. "

but without the money

And giving back to the hddguru community so less experienced visitors have a guide to some of the things terminal can do and the concepts behind logical and physical addressing and defect lists and slips etc etc

That's why its under Research and development (and experimentation)

Experts probably know all this already
but there are some interesting insights such as SA sectors on 4K disks are actually only 512 byte sectors


Top
 Profile  
 
 Post subject: Re: Seagate Terminal Tutorial – Reading Disk Sectors Via Ter
PostPosted: January 21st, 2014, 21:28 
Offline

Joined: October 24th, 2005, 17:04
Posts: 242
clear.
but for repair, important analysis & the movement of the V200(1>N8)--> V4 or moving memory (unaligned offset) after an unsuccessful format.(then writing in the SA),...
p.s: By the way, the importance of NRG greatly exaggerated (a cumulative list). :wink:


Top
 Profile  
 
 Post subject: Re: Seagate Terminal Tutorial – Reading Disk Sectors Via Ter
PostPosted: January 22nd, 2014, 7:00 
Offline

Joined: May 16th, 2009, 9:32
Posts: 325
Location: UNited Kingdom
I was also hoping some other experts would add or contribute to this 'tutorial' especially to help explain things that are unclear or to correct any mistakes or assumptions I may have made.


Top
 Profile  
 
 Post subject: Re: Seagate Terminal Tutorial – Reading Disk Sectors Via Ter
PostPosted: January 22nd, 2014, 7:20 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3844
Location: Adelaide, Australia
No, the only one to do that was Spildit, but apparently he has now changed and "sold out" wants money for everything he says and wont help anyone for free.. I guess he is saving up for that Ferrari ;)

All jokes aside, I have found the posts very interesting and helpful, even though I read them 3 times and understand 10% :) I hope you are enjoying the research. I am doing similar with flash. I am:

1. writing a pattern
2. taking a dump
3 taking an image
4. resoldering the chip
5. writing a different pattern
6. taking a dump
7. taking another image
8. resoldering the chip
9 writing a set of data files
10. taking a dump
11. taking an image
12. trying recovery on the data dump with some tools and using all the previous data gathered for help.

it takes a lot of time for over 300 drives, and is probably doing a lot of unnecessary work but you do start to see things fall into place a little. and it is fun!


Top
 Profile  
 
 Post subject: Re: Seagate Terminal Tutorial – Reading Disk Sectors Via Ter
PostPosted: January 24th, 2014, 16:33 
Offline

Joined: May 16th, 2009, 9:32
Posts: 325
Location: UNited Kingdom
6.6 More examining of SA sectors and modules and their contents (cont)

eg of the F3 2000GB drive

To follow, but first a digression to pre-F3 drives where we know a bit more about the SA modules and their locations


Top
 Profile  
 
 Post subject: Re: Seagate Terminal Tutorial – Reading Disk Sectors Via Ter
PostPosted: January 24th, 2014, 16:34 
Offline

Joined: May 16th, 2009, 9:32
Posts: 325
Location: UNited Kingdom
6.7 SA and terminal on pre-F3 drives and other pre-F3 stuff

Tests on a Barracuda 7200.7 120GB

234375000 decimal LBA's at sata/ata interface = 0x0DF84758

Not F3 just T>

;
Age=50 Type=22 MxCyl=16358 MxHd=2 MxSct=44C BSz=0000 TCode=0000

3 heads (0-2)
cyls 00018-16358 //see later

2>x
Zone 00: 00018 - 00BE8 1100 (044C) 683.439
Zone 01: 00BE9 - 027FE 1056 (0420) 666.63
Zone 02: 027FF - 04707 1026 (0402) 646.275
Zone 03: 04708 - 06CA3 990 (03DE) 622.431
Zone 04: 06CA4 - 08B66 953 (03B9) 602.353
Zone 05: 08B67 - 0A479 916 (0394) 580.392
Zone 06: 0A47A - 0C405 880 (0370) 545.882
Zone 07: 0C406 - 0D99A 836 (0344) 527.59
Zone 08: 0D99B - 0ECD9 806 (0326) 506.144
Zone 09: 0ECDA - 10337 770 (0302) 480.724
Zone 0A: 10338 - 11397 733 (02DD) 461.672
Zone 0B: 11398 - 12854 691 (02B3) 437.423
Zone 0C: 12855 - 13F38 660 (0294) 410.353
Zone 0D: 13F39 - 14AE7 623 (026F) 396.401
Zone 0E: 14AE8 - 155D6 605 (025D) 383.316
Zone 0F: 155D7 - 16358 572 (023C) 363.922
Sys= 0F68E-0F70D 0280 SPTK on sys trks
Total LBAs = 0DFD03F6

All 3 heads use the same zone info and spt varies from 44c-23c
On other drives may see zone info per head

User area starts at cyl 0x18

cylinders 0 to 17 are probably just used as a lead in ?
there do seem to be cylinders beyond 16358 as well //see later

Sys= 0F68E-0F70D 0280 SPTK on sys trks
system area is in the middle of the drive (in zone 9?) and only uses 280 spt
On other drives this may be labeled as “Reserve:”

Total LBAs = 0DFD03F6 broadly as expected (user LBA’s or all LBA’s? Should be just the user LBA’s)

On other drives, eg 160GB 7200.2 it is listed as “KBAs 12BBCC28”


Read and Write buffer are

RD:0200:10
WR:0210:10


6.7.1 Pre-F3 Reading user sectors (supplement to section 5.3 about pre-F3 drives)

2>A0
2>s18,0
2>. //in my experience you cant fully trust everything the ‘current position’ shows here until after a read
2>R0,1 or r,1 or r0,1
2>.
Pgm=00 Trk=00018(00018).0(0).001(000) Zn=0 Err=00 ErCt=0000 Hlth=0008 CHlth=0000 Ready LBA=00000001
confirms current position has incremented as expected

2>B200,200
shows the read buffer contents and is user LBA 0

Logical reads at level A
Need to do S hi,lo then R,1

Level A can decode LBA’s
eg
A>C0
LBA 00000000 = LPL 00018.0.0000 (logical cyl 18 which is also physical cyl 18)
A>D0
LBA 00000000 = PCHS 00000018.0.0000

A> d18,0,0
LBA 00000000 = PCHS 00000018.0.0000

Some confusion about the end of the drive

A>C dfd,03f5 //find the last LBA
LBA 0DFD03F5 = LPL 1634B.1.00C8
A>D dfd,03f5
LBA 0DFD03F5 = PCHS 000163DA.1.0126

but that’s beyond the expected cylinder 16358 ?

Cylinders (and LBA’s) go on beyond here, but maybe arent used ?

The last cylinder which seems to be accessable is 163E7 physical (coincidence? that this is 16358 logical)
Pgm=00 Trk=16358(163E7).0(0).001(107) Zn=F Err=00 ErCt=1A25 Hlth=0008 CHlth=0000 Ready LBA=0DFD41BE

Anyway, strange but not too important (decoding user sectors after the SA area is ‘tricky’/confusing)

The difference between logical and physical is due to slips and due to the SA cylinders in the middle of the drive

//understanding slips and defect lists - to follow (maybe)
V1 = User slip list, which is also the P List on these drives ?


6.7.2 Pre-F3 SA sectors and modules

Sys= 0F68E-0F70D //physical cylinders
80 cylinders * 3 heads * 0280 SPTK on sys trks = approx 120MB, but not all used

This 7200.7 drive is an ALPINE 8.05

T>y doesn’t work to list modules (but might on some drive)

We know the module info for an ALPINE 8.x from
http://malthus.zapto.org/viewtopic.php?f=6&t=161
and from STCom data file etc
but still don’t yet fully understand it

APP=15 0 180 80 // offset SA 0x15 0x69 0x180 sectors in length buffer 80
CERT0=29 0 244 //cert code
TABLE=29 244 11 //cert table offset trk 244
ATA=2A 0 61 //0x200 sectors in length
VEN=2C 0 12 //Stuff


STCom tool (described later) can pull off the firmware and extracts it as
196,608 APP.BIN
296,960 CERT.BIN
8,704 TABLE.BIN
49,664 ATA.BIN
9,216 Vendor.BIN
512 ID.BIN
24 SN.TXT

To be examined and compared to raw sector in the SA area
and to the numbers in the module list above
(to follow)


To read from a system track the format is r,x,y
where x is the sector to read and y is the length
(physical sector = logical sector on system tracks).

Lets look at something we know

The http://malthus.zapto.org/viewtopic.php?f=113&t=122 article has an 7200.7 unlock zoc script
this works (sometimes need to run it several times)
and locates the correct SA module sector(s)

reads smart data and sees the track it was on ? 0f6ba
then reads info in sectors 5 and 6
1>N5
.
2>s0F6BA,00,22
2>r,05,1
looks at something ?
2>r,06,1
1>B0200,0200

2>. shows
Pgm=00 Trk=0F6BA(0F6BA).1(1).007(006) Zn=0 Err=00 ErCt=0000 Hlth=0008 CHlth=0000 Ready LBA=0xxx (cant trust)
confirms logical cyl = physical cyl in the system area

And these sectors indeed contain ‘Seagate’ and some password related data structures

There are other posts that mention ‘ATStuff’ is in sector 4, presumably of this track
so lets take a look
2>s0F6BA,00,22
2>r,04,1
2>B200,200
040000 5A0CFF3F 37C81000 00000000 3F000000 00000000 20202020 20202020 20202020
040020 20202020 20202020 00000040 04002E30 31322020 20205453 31333032 32304136
040040 20532020 20202020 20202020 20202020 20202020 20202020 20202020 20201080
040060 0000002F 00000002 00020700 00000000 00000000 00001000 5847F80D 00000700
040080 03007800 7800F000 78000000 00000000 00000000 00000000 02000000 00000000


Lets show that in byte format and ascii
00000030 35 30 20 20 20 20 54 53-31 33 30 32 32 30 41 36 *50 TS130220A6*
00000040 20 53 20 20 20 20 20 20-20 20 20 20 20 20 20 20 * S *

So this SA sector is the same as ID.BIN above
and is where the Passport information comes from
(note that pairs or bytes are ‘twisted’ in the raw data eg model number is ST3120026AS)

More info on ATStuff and firmware
viewtopic.php?f=1&t=23567
viewtopic.php?f=1&t=27713
viewtopic.php?t=12951

Why does important SA things start at this 0F6BA cylinder rather than 0F68E ?

Firmware parts are located on fixed offset relative to the base track. 0xF6BA minus base (F68E) = 0x2C
which matches “VEN=2C 0 12 //Stuff”

Lets read other SA areas using the above s and r, commands and the cylinder offsets
eg 2A for ATA
//to be continued



6.7.3 Pre-F3 self scan

Pre F3 drives have a self-scan capability which could be considered as a low level re-init/’format’ capability
This can be run at certain init states or Age’s from the level 2 N command
However if run it at a low Age, it will wipe out the SA contents !

The age of a seagate drive represent the step in which the drive is in the selfscan process.
It begins at 2 and end at 4F or 50.
50 is the state where the drive responds to ata commands.

See
http://malthus.zapto.org/viewtopic.php?f=2&t=299

viewtopic.php?f=1&t=27476
viewtopic.php?f=1&t=27679


Experiments with a 160GB Momentus 7200.2 messed up this way and now stuck at F> to follow

see end of viewtopic.php?f=1&t=27679
and other ATStuff articles above
for some info on F> commands


Experiments with STCom tool to access to SA and saving/restoring firmware and modules
see http://malthus.zapto.org/viewtopic.php?f=143&t=781


Top
 Profile  
 
 Post subject: Re: Seagate Terminal Tutorial – Reading Disk Sectors Via Ter
PostPosted: August 29th, 2015, 11:27 
Offline

Joined: May 16th, 2009, 9:32
Posts: 325
Location: UNited Kingdom
Updating the Malthus links to the new site

STCOM experiments
http://www.hddoracle.com/viewtopic.php?f=143&t=781


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 48 posts ]  Go to page Previous  1, 2, 3

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 18 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group