Seagate Terminal Tutorial – Reading Disk Sectors Via Terminal

Or another title would be Experiments in reading sectors using the Seagate terminal connection

It may not be the optimal way to do it, but is a start
Will start by reading user partition sectors and data, and later potentially move on to examining the system partition

WARNING – proceed at your own risk

Copying the warning from
viewtopic.php?t=11040&start=
Tutorial: resolve 0 LBA,SEAGATE 7200.11 BIOS don't recognize

FINAL WARNING: Please do NOT try this if you have valuable data on your drive. Do not blame anyone if something goes wrong. You do it at your own risk. Remember that if something goes wrong, it is extremely unlikely that anyone will be able to help you remotely. One wrong command via terminal could easily result in a completely bricked HDD (I really do mean bricked = no one will be able to recover it, even Seagate).

Unfortunately the formatting of some of the data received from the Terminal will not line up properly in this posting, as cant find a way to set it to use a fixed size font
I might post some .txt files of the important bits

All numbers are in hex unless otherwise stated or unless obviously decimal

As this is a tutorial, please keep any comments constructive


In this example we will use a Seagate Barracuda 7200.12 500Gbyte drive

This particular 7200.12 drive does allow terminal access without read channel shorting

List of commands is available via
F3 C>Q

^L = control-L


1. INTRODUCTION

2. MONITORING USER SECTOR ACTIVITY ON SATA INTERFACE WHEN IN ONLINE MODE
an interested exercise in itself
and the effect of the internal cache or read disk reads and writes

3. READING USER SECTORS FROM TERMINAL
including buffers and numbering and size of buffer blocks

4. ADVANCED TOPICS
eg reallocated sectors
4K internal drives
reading and understanding system areas


Sections will follow as I get round to writing them
plus addendiums added occasionally

1. INTRODUCTION

The SATA interface provides read/write access to the user data storage area on the disk
This is done in terms of logical block addresses (LBA)
with each block being 512 bytes (decimal)

Same with 512e drives
Native 4K drives may get covered later

LBA number is 0 to whatever the max value is
eg for the reference 500GB drive it is 0 - 976773167 decimal
976773168 decimal blocks = 3A386030 hex


Internally, as accessed by the Seagate Terminal, the drive has many different and confusing layout numbering schemes
some of which reuse the ‘LBA’ terminology
eg Physical LBA, Logical LBA, Physical CHS, Logical CHS

We will concentrate on using Physical CHS

Cylinder, Head, Sector
All are 0 based

Sometimes the term Track, for a particular cylinder and head is used

Commands exist to control the cyling and head being read
controlling the sector to be read is slightly harder

Note – in these tests the effect of any bad sector re-mapping has not yet been taken into account

As the outer cylinders are longer, they have more sectors per track
(sometimes even diffreent heads on the same cylinder have different spt)
so the physical disk is organised in zones

The physical disk is also organised into internal partitions
in particuler the User Partition (where user data goes)
and the System Partition where internal system, data, tables etc etc goes

These two partitions are often (always) interleaved throughout the disk
such that the user partition is not contigious


F3 Z>^L
HDA SN: 6VMS60J2, RPM: 7201, Wedges: 120, Heads: 2, Lbas: 00003A386030, PreampType: 73 03
PCBA SN: 0000M1302QLS, Controller: YETIST_3_*/4_0(649B)(3-12-3-3), Channel: AGERE_COPPERHEAD_LITE, PowerAsic: MCKINLEY DESKTOP LITE Rev 15, BufferBytes: 1000000

2 heads
user data LBA’s 00003A386030


F3 2>x

User Partition
LBAs 000000000000-00003A38602F //this matches what we expect
PBAs 000000000000-00003ACE5288 //to be explained later
HdSkew 006E, CylSkew 002D
ZonesPerHd 11

Head 0, PhyCyls 000000-0392CA, LogCyls 000000-03857A

Physical Logical Sec Sym Sym Data
Zn Cylinders Cylinders Track Wedge Track Rate
00 000000-00035B 000000-00035B 09A0 10F2 001340A0 1590.000
01 00035C-00500B 00035C-00500B 0A44 121A 00149100 1698.750
02 00500C-00AA5F 00500C-00AA5F 09C9 1150 0013AEE0 1625.625
<cut>
10 0372EB-0392CA 0372EB-03857A 05A0 09C7 000B34C0 925.312

Head 1, PhyCyls 000000-039CC8, LogCyls 000000-038F31

Physical Logical Sec Sym Sym Data
Zn Cylinders Cylinders Track Wedge Track Rate
00 000000-000383 000000-000383 0968 1091 0012D260 1554.375
01 000384-0051CC 000384-0051CC 0A05 11BD 00142860 1665.000
<cut>
10 037C3F-039CC8 037C3F-038F31 0576 099E 000B0580 910.312


System Partition
LBAs 000000000000-0000000972CF //has oit own logical numbering
PBAs 000000000000-00000009811F
HdSkew 006E, CylSkew 0018
ZonesPerHd 02

Head 0, PhyCyls 0392CB-03941E, LogCyls 000000-000152

Physical Logical Sec Sym Sym Data
Zn Cylinders Cylinders Track Wedge Track Rate
00 0392CB-039374 000000-0000A9 0394 063D 00072AE0 592.500
01 039375-03941E 0000AA-000152 0394 063D 00072AE0 592.500

Head 1, PhyCyls 039CC9-039E1C, LogCyls 000000-000152

Physical Logical Sec Sym Sym Data
Zn Cylinders Cylinders Track Wedge Track Rate
00 039CC9-039D72 000000-0000A9 0394 063D 00072AE0 592.500
01 039D73-039E1C 0000AA-000152 0394 063D 00072AE0 592.500

If you concentrate on the Physical Cylinders, you can see the System Partition is after the User Partition, but this is not always the case, often they are interleaved


In this case the user data starts at Physical Cylinder 0
but this is not always the case

Thanks!

Looking forward to more posts ...

_________________
A backup a day keeps DR away.

2. MONITORING USER SECTOR ACTIVITY ON SATA INTERFACE WHEN IN ONLINE MODE

This is an interested exercise in itself
and also shows the effect of the internal cache or read disk reads and writes

If the disk is put in online mode ^R
then the user data can be accessed through the SATA interface and we can still run some Seagate Terminal command to monitor activity

eg ^X to view user activity

the top section shows the SAT/ATA activity and the lower sector the physical reads and writes

In the example below (immediately after power up) we read sector 4000 and 4001 and write 4001

Note in the physical reads it reads 4000 and actually reads a cylinder full
such that the later user read of 4001 is read from the cache

ATA 15 Cmds
Ts(ms) dT(ms) Op Cnt LBA
1218261 99999999 EC 0000 000000000000
1218262 1 25 0001 000000000000
1218262 0 25 0001 000000000000
1218266 4 EC 0000 000000000000
1218710 444 EC 0000 000000000000
1218711 1 EC 0000 000000000000
1219258 547 EC 0000 000000000000
1219266 8 EC 0000 000000000000
1219270 4 EC 0000 000000000000
1234474 15204 25 0001 000000000000
1245343 10869 25 0001 000000004000 //read 4000
1245352 9 25 0001 000000004001 //read 4001
1261360 16008 35 0001 000000004001 //write 4001
1261364 4 25 0001 000000004000 //re-reads 4000
1261379 15 25 0001 000000004001 //re-read 4001

RW 32 Cmds
Ts(ms) dT(ms) xT(ms) Type Option Mode St EC Info
1206593 99999999 0 04 002221 000000 1 00000080 SRV_MEM Type 6 Addr 040000E7 Cnt 0001

<cut - lots of system stuff>
1218256 4 4 02 005041 000000 1 00000080 XFR WR SYS LBA B 0000000075AA L 00000001 BO 000000 BES 0061A7E.0061AFD.0061A7E

1245343 27087 62 02 002221 000000 1 00000082 XFR RD USR LBA B 000000004000 L FFFFFFFF BO 000C64 VL 37D1.1000
1261390 16047 5 02 005021 000000 2 0000008F XFR WR USR LBA B 000000004001 L 00000001 BO 000C44 VL 47D1.0001

the last line shows 1 block was written at user LBA 4001

3. READING USER SECTORS FROM TERMINAL
including buffers and numbering and size of buffer blocks


This is where it gets interesting and the 'strange' internally LBS vs CHS modes get confusing

In our case the user data and user partition start at 0
and there is no bad sector remapping going on

The drive ram is split up onto a series of Buffer Blocks
The majority of these are probably related to the internal cache

we can see the Buffer blocks with ?
which we will show later
most of them can be ignored
except the bottom two
(which we only see after any terminal base reading etc activity has occurred)

The Block numbering etc is highly model dependant, so this buffer block numbers refer only to this drive

F3 T>?
Blks 00109B-00109B (000001), BufAddr 00213600-002137FF, DBA 06213600, BytesPerBlk 200 Cmd Input Buf
Blks 00109C-00109C (000001), BufAddr 00213800-002139FF, DBA 06213800, BytesPerBlk 200 Diag Batch File
Blks 00109D-00109D (000001), BufAddr 00213A00-00213BFF, DBA 06213A00, BytesPerBlk 200
<cut>
Blks 0012B4-00130D (00005A), BufAddr 00256800-00261BFF, DBA 06256800, BytesPerBlk 200
Blks 00223A-00297B (000742), BufAddr 00447400-00531507, DBA 06447400, BytesPerBlk 204 Default Diag Rd Buf
Blks 00298C-0030CD (000742), BufAddr 00531800-0061B907, DBA 06531800, BytesPerBlk 204 Default Diag Wrt Buf

The second one from the bottom, the Default Rd Buf is the one we will be concentrating on
Note its size is currently 204 bytes ie one sector plus 4 crc or id bytes

The /2 B command will display the contents of a buffer block
note - you use the Blk number not the BufAddr
Another percularity of the B command is it compares blocks, so to actually see the contents you have to compare it with itself

eg

F3 2>B223a,223a

Buffer Block 223A compared to Buffer Block 223A (204 Bytes/Block)
Addr 0 1 2 3 4 5 6 7 8 9 A B C D E F
00447400 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00447410 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00447420 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00447430 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00447440 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00447450 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00447460 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00447470 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00447480 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00447490 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
004474A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
004474B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
004474C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
004474D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
004474E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
004474F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00447500 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00447510 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00447520 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00447530 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00447540 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00447550 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00447560 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00447570 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00447580 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00447590 00 00 00 00 00 00 00 00 7E F6 00 00 98 23 68 D3
004475A0 DC 17 00 00 00 00 00 00 53 00 00 00 00 00 00 00
004475B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
004475C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
004475D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
004475E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
004475F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00447600 00 00 00 00

note its showing 204 bytes

Can display more than one block with Bxxx,xxx,n where n is number of blocks


Before starting to read blocks and putting them in the read buffer
we need to understand what I call the 'current position'

. (dot) shows you this

eg after power on

F3 2>.
Current R/W User LBA 000000000000 LLL CHS 000000.0.0000 PLP CHS 000000.0.0000
R/W Status 1 R/W Error 00000080 Ready

indicates the current position (at which any reads or writes will occur) is User LBA 0 = CHS 0.0.0

We can also set the current position with the s commands to set cylinder and head (sector is always 0)

so

F3 2>s0,0,22 sets CHS 0.0.0 the 22 is a special validation id


If we were to do a Read with the r or R command, we would expect it to read User LBA 0

however its not quite that simple

R offset from current position (usually zero or blank), number of sectors

F3 2>R0,1

But after that, . shows the current pointer has moved to LBA 9A1 = CHS 1.0.1
ie it has read a whole track (cylinder0 head 0 has 9a0 spt in the earlier table)

and in fact in the buffer has only read and stored the data from the first sector of the next track
ie the buffer contains sector 9a0 data only

^X also shows that

3202832 8349 5 02 002221 000000 1 00000080 XFR RD USR LBA B 0000000009A0 L 00000001 BO 1000214 BES 0111D00.014C541.0111D00

ie has read 1 block/sector at 09A0

So we are reading sectors, just not quite the ones we expect



This took me a long time to understand
as did all the translation between internal logical and physical stuff

I have finally managed to force it to read a sector of interest
and see the 200 data bytes + 4 crc/id bytes

More in the next instalment





F3 2>.
Current R/W User LBA 0000000009A0 LLL CHS 000001.0.0000 PLP CHS 000001.0.0000
R/W Status 1 R/W Error 00000080 Ready

3A. READING USER SECTORS FROM TERMINAL (continued)

Previously the read command seemed to be working in some sort of ‘Cylinder Mode’
such that each read would somehow skip from track to track and read x sectors from the new track

eg

F3 2>.
Current R/W User LBA 000000000000 LLL CHS 000000.0.0000 PLP CHS 000000.0.0000
R/W Status 1 R/W Error 00000080 Ready

F3 2>R0,1

F3 2>.
Current R/W User LBA 0000000009A1 LLL CHS 000001.0.0001 PLP CHS 000001.0.0001
R/W Status 1 R/W Error 00000080 Ready

F3 2>R0,1

F3 2>.
Current R/W User LBA 000000001341 LLL CHS 000002.0.0001 PLP CHS 000002.0.0001
R/W Status 1 R/W Error 00000080 Ready

F3 2>H1 //switch to head 1
Hd 1

F3 2>
Current R/W User LBA 0000000328EA LLL CHS 000002.1.0000 PLP CHS 000002.1.0000
R/W Status 1 R/W Error 00000080 Ready



Later we will put it in a ‘Sector Mode’ to have better control of getting to the sectors of interest



Before then, lets look at the seek, read and translate/lookup/conversion routines, so we can find the location od any user sectors of interest

Level 2 'S': Rev 0011.0000, Overlay, Seek to Logical Cylinder and Head, S[Cyl],[Hd],[Offset],[OffsetUnitsOpt],[SkType],[Options]
Level 2 's': Rev 0011.0000, Overlay, Seek to Physical Cylinder and Head, s[Cyl],[Hd],[ValidKey],[Offset],[OffsetUnitsOpt],[SkType],[Options]

Level 2 'R': Rev 0011.0000, Overlay, Read CHS, R[Sec],[NumSecs],,[PhyOpt],[Opts]
Level 2 'r': Rev 0011.0000, Overlay, Read Long CHS or Read System CHS, r[LongSec],[LongSecsOrSysSec],[SysSecs],[LongPhySecOpt],[LongOpts],[SysOpts]

Level 2 'h': Rev 0013.0000, Overlay, Translate Physical Sector, h[Sec],[NumSecs]
Level 2 'l': Rev 0013.0000, Overlay, Translate Logical Sector, l[Sec],[NumSecs]

Level 2 'X': Rev 0013.0000, Overlay, Display Track Information, X[LogCyl],[Hd],[SysAreaOpt],[Opts],[RowsPerPage]
gives big list of info on LogicalCylinders
the top lines relate to the ‘current position’ 0.0.0 in this case
the info is for the current clylinder an head

Track Info:
Partition PhyCyl LogCyl NomCyl RadiusMils LogHd Zn FirstLba FirstPba LogSecs PhySecs WdgSkw SecPerFrm WdgPerFrm
User 00000000 00000000 00000000 +1.801312E+3 00 00 000000000000 000000000000 09A0 09A0 0000 004D 0009

Sector Info:
PhySec(LogSec) Wdg SFI
0000 ( 0000 ) 000 00000004
0001 ( 0001 ) 000 000001FA
…
099F ( 099F ) 11F 00133E75 //the last sector on this cyl and head

Doesn’t really tell us much we didn’t already know

Level 2 'x': Rev 0014.0000, Overlay, Display Zone Information, x[Partition],[Hd],[Zone],[Options]
//we used this earlier and showing info on Physical and logical Cylinder and sectors per track per head and per zone

Note for X and x the Physical and Logical Cylinder and Sectors match up at the start
but on later tracks thay start to diverge

So lets look at the two translate command h and l
both show the same info for ‘sector 0’ and physical sector 0 still lines up with logical sector 0

F3 2>h0
Track Info:
Partition PhyCyl LogCyl NomCyl RadiusMils LogHd Zn FirstLba FirstPba LogSecs PhySecs WdgSkw SecPerFrm WdgPerFrm
User 00000000 00000000 00000000 +1.801312E+3 00 00 000000000000 000000000000 09A0 09A0 0000 004D 0009

Sector Info:
LBA PBA LogSec PhySec Wdg SFI
000000000000 000000000000 0000 0000 0000 00000004

This only seems to work if you are already on the track of interest (currently track 0)

eg if enter a sector number greater than 9bf it cant handle it


So still need to find an easier way to convert an arbitary User LBA into the actual physical LBS/CHS it is using
other than manually working it out from the X zone list

(and later need to see if any bad sector remapping affects it)

If anyone knows the way to do it, please enlighten us

3B. READING USER SECTORS FROM TERMINAL (continued)

There seem to be various internal addressing modes

The A command shows the current mode and the available modes

All Levels 'A': Rev 0011.0000, Overlay, Set Test Space, A[OptsOrParmSelect],[ParmValue],[AddrType],[HdForCylLimit]

PLP mode seems to relatete the what I call Cylinder mode
LLL mode seems to relate to Sector mode
or maybe not

On power up it is in User LLL mode

F3 2>A
Current Addr Mode
User LLL CHS Mode, Seq In
Hd 0 Cyls 000000 - 03857A
Hd 1 Cyls 000000 - 038F31

All Addr Modes
User LBA Mode
LBAs 000000000000 - 00003A38602F
System LBA Mode
LBAs 000000000000 - 0000000972CF
User LLL CHS and User LLP CHW Modes
Hd 0 Cyls 000000 - 03857A
Hd 1 Cyls 000000 - 038F31
System LLL CHS and System LLP CHW Modes
Hd 0 Cyls 000000 - 000152
Hd 1 Cyls 000000 - 000152
PLP CHS and PLP CHW Modes
Hd 0 Cyls 000000 - 03941E
Hd 1 Cyls 000000 - 039E1C

Buffer Sector Offset 00000000

After using the s (seek) command, it has gone into the strange PLP / cylinder mode
F3 2>s0,0,22

F3 2>A
Current Addr Mode
PLP CHS Mode, Seq In
Hd 0 Cyls 000000 - 03941E
Hd 1 Cyls 000000 - 039E1C

<cut>

The A command with the right parameter(s) can probably switch modes, but I’m still working that out

Probably want User LBA mode ?


Did eventually get it into a ‘sector mode’

The A command showed it was in PLP CHS Mode but later showed User LLL ??
but it was reading the sectors requested in the way expected

eg

F3 2>.
Current R/W User LBA 000000000000 LLL CHS 000000.0.0000 PLP CHS 000000.0.0000
R/W Status 1 R/W Error 00000080 Ready

F3 2>R0,1 //reads sector 0 into the rd buffer and move current ptr on

F3 2>.
Current R/W User LBA 000000000001 LLL CHS 000000.0.0001 PLP CHS 000000.0.0001
R/W Status 1 R/W Error 00000080 Ready

F3 2>R20,3 //reads 3 sectors at sector 20 into rd buffer sector 20 in buff 223a, 21 into 223b, 22 into 223c

F3 2>.
Current R/W User LBA 000000000023 LLL CHS 000000.0.0023 PLP CHS 000000.0.0023
R/W Status 1 R/W Error 00000080 Ready

In this mode the first parameter to the R command is the sector number (absolute, not relative to current position)


Still trying to fully understand this
especially for later when want to read some System Partition sectors

3C. MORE READING OF SECTORS

Now that we can access user sectors, lets look at the difference between R and r
(I'm still in 'cylinder mode here' so it actually reads sector 09a0

Level 2 'R': Rev 0011.0000, Overlay, Read CHS, R[Sec],[NumSecs],,[PhyOpt],[Opts]
Level 2 'r': Rev 0011.0000, Overlay, Read Long CHS or Read System CHS, r[LongSec],[LongSecsOrSysSec],[SysSecs],[LongPhySecOpt],[LongOpts],[SysOpts]


F3 2>R0,1
F3 2>B223a,223a

Buffer Block 223A compared to Buffer Block 223A (204 Bytes/Block)
Addr 0 1 2 3 4 5 6 7 8 9 A B C D E F
00447400 A0 09 00 00 00 00 00 00 53 00 00 00 00 00 00 00
00447410 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00447420 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
<cut>
004475F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00447600 BA 2D 00 00

R reads 0x204 bytes into the buffer
The first 0x200 bytes are the expected user data, the final 4 bytes are some sort of ID ?
(I've filled my user data area with a known data pattern)

Whereas r reads 0x248 bytes
none of which seems to make sense

Buffer Block 223A compared to Buffer Block 223A (248 Bytes/Block)
Addr 0 1 2 3 4 5 6 7 8 9 A B C D E F
00447400 8E C3 CC 74 13 90 CE 3F 0C 1B 3D 5A A5 36 6B 15
00447410 1A 95 30 D6 76 C8 66 A5 2D 96 71 17 59 DE 01 B2
00447420 6F 38 52 C8 B1 4E CF 18 8D 53 F4 79 E2 61 EE AB
00447430 E7 66 B8 FD 25 15 CB 97 F0 DA 9A 8A 73 6E F0 B3
<cut>
004475E0 DC 5B 90 4F 79 B2 4E B1 61 B9 7B 41 F7 41 5D EB
004475F0 A4 8B 2F 8D A6 F5 1C A6 D3 80 A8 7B E1 71 F1 FD
00447600 54 10 DC D7 FB 7B EA A4 8F FC FF 3F 6B 14 05 01
00447610 9C 2D A7 E6 F8 98 76 72 AC B7 30 1E 87 9A ED F4
00447620 46 67 0A 76 74 5E FF F4 26 A9 40 32 A2 A9 34 64
00447630 B4 2F 0F E5 9A 86 4B CB DB 78 8E 3F 95 16 8B BE
00447640 84 50 5A 29 62 2E 44 DA

r is a read long, so presumably there are ecc/crc's etc encoded in there

There might be a way to display/decode this better, but not found it yet

3D. Thoughts on Cylinders

F3 2>x shows us the zone layout and sectors per track
lets just look at the user partition for now as that is the majority of the disk

User Partition
LBAs 000000000000-00003A38602F //this matches what we expect
PBAs 000000000000-00003ACE5288 //to be explained later
HdSkew 006E, CylSkew 002D
ZonesPerHd 11

Head 0, PhyCyls 000000-0392CA, LogCyls 000000-03857A

Physical Logical Sec Sym Sym Data
Zn Cylinders Cylinders Track Wedge Track Rate
00 000000-00035B 000000-00035B 09A0 10F2 001340A0 1590.000
01 00035C-00500B 00035C-00500B 0A44 121A 00149100 1698.750
02 00500C-00AA5F 00500C-00AA5F 09C9 1150 0013AEE0 1625.625
<cut>
10 0372EB-0392CA 0372EB-03857A 05A0 09C7 000B34C0 925.312


Head 1, PhyCyls 000000-039CC8, LogCyls 000000-038F31

Physical Logical Sec Sym Sym Data
Zn Cylinders Cylinders Track Wedge Track Rate
00 000000-000383 000000-000383 0968 1091 0012D260 1554.375
01 000384-0051CC 000384-0051CC 0A05 11BD 00142860 1665.000
<cut>
10 037C3F-039CC8 037C3F-038F31 0576 099E 000B0580 910.312


There are 3A386030 LBA's
There are approx. 39CC8 cylinders with an average spt of 0700
There are 2 heads

That number of cylinders seems a bit high to me, for reasons discussed later, so lets see if it is right

3A386030 LBA's
approx. 0700 spt so approx. 0D00 spc
3A386030 / 0D00 = 47A7D which very broadly matches the number of cylinders (39CC8)
so does work out ok

Since the size of the platters in the 3.5" disk give a radial sweep area of very approx. 1.2 inches
this gives a track width of 5 millionths of an inch !!!!
I was expecting it to be significantly bigger than that (eg 500 millionths = half a thou)


Examination of the zone areas also starts to show why the logical numbers start to diverge from the physical numbers
although only seems to happens on the last user zone on this drive

The system partition physical/logical mapping is more obvious and understandable

On other disks where the System Partition is in the middle of the disk
then the User Partition Logical Cylinders etc 'skip' over the cylinders used by the System Partition

(example later when looking at a 512e drive)

3E. WRITING SECTORS

REPEAT OF WARNING – Proceed at your own risk, commands are case sensitive and may vary between drives.
One wrong command via terminal could easily result in a completely bricked HDD


Still sorting out how to specify the exact track and sector number of interest, and we will come back to that later, but lets assume you can find a sector of interest (either in sector mode or track mode)


There are separate read and write buffers
For this drive they are

Blks 00223A-00297B (000742), BufAddr 00447400-00531507, DBA 06447400, BytesPerBlk 204 Default Diag Rd Buf
Blks 00298C-0030CD (000742), BufAddr 00531800-0061B907, DBA 06531800, BytesPerBlk 204 Default Diag Wrt Buf


Rx,1 reads the sector into the read buffer (where x is sector number if in sector mode)

Wx,1 writes the sector from the write buffer
only the 200 hex data bytes are written, and fresh set of final 4 byte crc/id bytes is written

So to edit a sector, we would
Put in sector mode //tbc
s0,0,22 or whatever to seek to the right place
Rx,1 read into read buffer (and increment current read position)
C 223A,298C,1 copy the read buffer to the write buffer
edit the write buffer (see later)
s0,0,22 etc to reseek to the correct place //not usually necessary -- current write position is usually the *last* read position
Wx,1 write from the write buffer (and increment current write position?)


Editing the write buffer

Looks like we need to specify its BufAddr, not the Blk number

Level 1 'U': Rev 0011.0001, Flash, Edit Buffer Memory Byte, U[AddrHi],[AddrLo],[MemValue],[NumBytes]

/1
U 53,1810,55 //set byte at offset 10 in write buffer to 55
/2

3F. 4K PHYSICAL SECTORS

Modern large ‘Advanced Format’ drives use 4K physical sectors

Normally (always?) they expose them to the SATA interface as 512 byte emulated sectors (512e)

There are some adapters/interfaces eg certain external USB that will expose them as 4K sectors
(either real or more likely faked via 4k -> 512 -> 512e -> 4K physical)
see viewtopic.php?f=1&t=26959
viewtopic.php?f=13&t=15827

The Seagate terminal commands access the internal 4K physical sectors directly

Hence the total number of sectors is ‘lower’
and the buffers are bigger

The following examples are from a Seagate ST2000DL001

512e sata interface shows 3918750216 sectors/LBAs (0xE9936208) (of 512 bytes)

Seagate terminal shows 0x1D326C41 Lba’s of 4K

Banshee Bogart, RAP17, add 6k SAP csys 4K QNC
Product FamilyId: 4F, MemberId: 02
HDA SN: 5YD55B84, RPM: 5939, Wedges: 1F8, Heads: 6, OrigHeads: 6, Lbas: 00001D326C41, PreampType: A8 05


User Partition

LBAs 00000000-1D326C40
PBAs 00000000-1D5AB7E4
HdSkew 006E, CylSkew 0032
ZonesPerHd 11

Head 0, PhyCyls 000000-0441AA, LogCyls 000000-0435F2

Physical Logical Sec Sym Sym Data
Zn Cylinders Cylinders Track Wedge Track Rate
00 000000-003925 000000-003925 018F 09BF 00138C90 1612.031
01 003926-007CA5 003926-007CA5 0188 0992 00133200 1582.968
02 007CA6-00C8CA 007CA6-00C8CA 017E 0959 0012C3C0 1547.343
03 00C8CB-01179A 00C8CB-01179A 0172 090D 00122E20 1499.062
04 01179B-0167FE 01179B-0167FE 0165 08BE 00119688 1449.843
05 0167FF-01ABB6 0167FF-01ABB6 0155 085A 0010CFB0 1386.562
06 01ABB7-01F46A 01ABB7-01F46A 0149 080F 00103C08 1338.750
07 01F46B-023DDA 01F46B-023DDA 013A 07B2 000F86E8 1280.625
08 023DDB-028242 023DDB-028242 012B 0755 000ECDD8 1220.625
<system partition is in the gap here>
09 028483-02CC06 028243-02C9C6 011D 06FE 000E2488 1166.250
0A 02CC07-030D52 02C9C7-030B12 010E 06A0 000D6B78 1106.718
0B 030D53-03479F 030B13-03455F 0102 0656 000CD9C8 1059.843
0C 0347A0-0382E0 034560-0380A0 00F1 05ED 000C0B10 993.750
0D 0382E1-03B460 0380A1-03B220 00E7 05AE 000B8F08 953.437
0E 03B461-03E4D0 03B221-03E290 00DD 0570 000B14F8 914.062
0F 03E4D1-0418A2 03E291-041662 00CD 050D 000A5210 851.718
10 0418A3-0441AA 041663-0435F2 00C2 04CB 0009CE28 809.062

other heads similar

System Partition

LBAs 00000000-002C7173
PBAs 00000000-003527FF
HdSkew 006E, CylSkew 0018
ZonesPerHd 02

Head 0, PhyCyls 028243-028482, LogCyls 000000-000210

Physical Logical Sec Sym Sym Data
Zn Cylinders Cylinders Track Wedge Track Rate
00 028243-028362 000000-00011F 03F0 0376 00071148 583.125
01 028363-028482 000120-000210 03F0 0376 00071148 583.125

other heads similar


Note that the System Partition is interleaved with the User Partition and is approx in the middle of the disk



Buffer sizes

Doing ‘R’ reads the buffer size is 0x1044

Blks 002AA5-002BF8 (000154), BufAddr 00554A00-006AE44F, DBA 40554A00, BytesPerBlk 1044 Default Diag Rd Buf
Blks 003579-0036CC (000154), BufAddr 006AF200-00808C4F, DBA 406AF200, BytesPerBlk 1044 Default Diag Wrt Buf

The format of this 4K+0x44 byte buffer is
512 data
8 crc/id ?
512 data
8 crc/id
…
final 4 crc/id

ie NOT 4096 data + crc/id [decimal]


Doing ‘r’ reads, the buffer (in some long read format?) is 0x1220 bytes

Blks 002AA5-002BD5 (000131), BufAddr 00554A00-006AE21F, DBA 40554A00, BytesPerBlk 1220 Default Diag Rd Buf

Correction to
3F. 4K PHYSICAL SECTORS

512e sata interface shows 3907029168 sectors/LBAs (0xE8E088B0) (of 512 bytes)

3G. READ AND WRITE IN LBA MODE

The previous seek / read / write examples used CHS mode from level 2
Also sometimes called pseudo CHS
(as it is the CHS mode above any remapping of the absolute raw CHS -- see later sections about remapping etc)

It is also sometimes called Niwot mode (especially on pre F3 models)

The ^x display that shows interface LBA and drive CHS activity also uses Niwot CHS mode


LBA mode

Level A allows Reading and Writing in LBA mode
(sometimes referred to as 'Niwot R/W LBA cmds (fullslip)’)

Again this is 'above' any low level remapping

On older model, if the LBA is above FFFF then need to enter as upper 16 bits, lower 16 bits
but that’s not needed on F3 drives

. (dot) - current position

S seek (but not really needed)
R
W
F translate LBA to pseudo CHS (plus there are some other conversion commands)



The following examples are from the 2000TB drive

F3 A>S ca0740

F3 A>.
Current R/W User LBA 000000CA0740 LLL CHS 0015E9.0.010E PLP CHS 0015E9.0.010E
R/W Status 1 R/W Error 00000080 Ready

F3 A>R,1

F3 A>. //has incremented due to the last read
Current R/W User LBA 000000CA0741 LLL CHS 0015E9.0.010F PLP CHS 0015E9.0.010F
R/W Status 1 R/W Error 00000080 Ready

or could do
F3 A>R ca0740,1


F3 A>F ca0740
Track Info:
Partition PhyCyl LogCyl NomCyl RadiusMils LogHd Zn FirstLba FirstPba LogSecs PhySecs WdgSkw SecPerFrm WdgPerFrm
User 000015E9 000015E9 00001710 +1.739875E+3 00 00 00CA0632 00CA137C 018F 018F 00E7 0013 0018
Sector Info:
LBA PBA LogSec PhySec Wdg SFI Split Burst
00CA0740 00CA148A 010E 010E 0044 0002A3C8 0920:02F7 0045
//cylinder 15e9, head 0, sector 10e
// level 2 s15e9,0,22 l10e would show similar info
//why is the PBA higher than the LBA … see later in advanced section

4.0 ADVANCED TOPICS

4.1 Bad / Reallocated / Remapped sectors Part 1

All disks have a non trivial amount of bad sectors
and these also increase during the life of the drive

A summary of some of these is reported by SMART
http://www.hdsentinel.com/help/en/56_attrib.html

or terminal command
1>N5

eg see viewtopic.php?f=1&t=26068&start=20

But how exactly they relate to the various lists is TBI but see
http://malthus.zapto.org/viewtopic.php?f=6&t=89


The bad sectors that are found and *skipped* at manufacture time are in the p-list

The bad sectors that grow over time, and are *remapped*, are in the g-list

http://www.dataclinic.co.uk/hard-drive-defects-table/
http://www.ukdatarecovery.com/articles/ ... pping.html

remapped sectors will slow down the sequential performance of the drive



The ‘translator’ is the part of the disk that makes use of the various lists and translates

Does the translator activity occur below any sector reading in terminal mode
//tbi
//usually below except in some raw CHS mode ?


Logical addressing probably goes through the translator

‘Pseudo’ Physical addressing goes through the translator

Above the translator is probably relates to 'fullslip' (especially in the p-list skipped/slipped sense)

‘Raw’ Physical addressing is below the translator


To be continued, but really need another expert to comment on this topic

4.2 Defect lists


7200.12 drives have a normal p-list and g-list
and also have a nonresident g-list

should be an alt-list that goes with the g-list ?
info from another article
“G-list and alt are NOT the same thing. The alt list is used to remap bad sectors to the new ones, in other words it remaps the LBA to the new PBA and CHS, the G-list hold the location of the BAD sector in PBA and CHS format.“

The level T V commands show the various lists

V1 User-Slip table
V2 System-Slip table
V4 Reassigned sector table
V8 servo-flaw list
V10 P-LIST
V20 Primary-servo flaw list
V40 NRG (NON-Resident G-LIST)
V80 Resident G-LIST
V100 Primary DST(drive self test) LIST

4.3 p-list

The bad sectors that are found and *skipped* at manufacture time are in the p-list

Since it is created at manufacture time, it can skip/slip sectors on the track till the end of the track
ie doent need to leave any reserved sectors at the end of the track
But the actual number of *good* sectors per track (and per head) may varying within the zone

p-list example on the 2000GB drive

F3 T>V10
P List
phy phy log length
head cyl cyl in symb SFI flags
4 1EC 1EC 363 F6ECE 80 scr fill
4 1ED 1ED 363 F6ECD 80 scr fill
4 1EE 1EE 363 F6ECC 88 scr fill
… (massive list)

Shows list in cylinder order
only cylinders with skipped defects are listed

Will look at the first entry – Hd 4 cyl 01ec
doesn’t explicit say what sectors are bad and skipped
just implies there are one or more


For info, zone 0 for heads 4 shows 0180 sectors per track

Head 4, PhyCyls 000000-0464D2, LogCyls 000000-0458DE

Physical Logical Sec Sym Sym Data
Zn Cylinders Cylinders Track Wedge Track Rate
00 000000-003AA6 000000-003AA6 0180 0963 0012D578 1552.968


Let look at problem cylinder 01ec for hd4

/2
s1ec,4,22

F3 2>.
Current R/W User LBA 00000012A62D LLL CHS 0001EC.4.0000 PLP CHS 0001EC.4.0000
R/W Status 1 R/W Error 00000080 Ready

X shows a sector list for the current cyl and head
0-17f (as 0180 spt)
and should show the bad sector/sectors

F3 2>X

Track Info:
Partition PhyCyl LogCyl NomCyl RadiusMils LogHd Zn FirstLba FirstPba LogSecs PhySecs WdgSkw SecPerFrm WdgPerFrm
User 000001EC 000001EC 000001F8 +1.758312E+3 04 00 0012A62D 0012A631 017F 0180 010C 0010 0015

Sector Info:
PhySec(LogSec) Wdg SFI PhySec(LogSec) Wdg SFI PhySec(LogSec) Wdg SFI PhySec(LogSec) Wdg SFI Split
0000 ( 0000 ) 10C 000A03D6 0060 ( 0060 ) 18A 000EB934 00C0 ( 00BF ) 010 0000991A 0120 ( 011F ) 08E 00054E78 094C:02CB
0001 ( 0001 ) 10D 000A104D 0061 ( 0061 ) 18B 000EC5AB 00C1 ( 00C0 ) 011 0000A591 0121 ( 0120 ) 08F 00055AEF 0664:05B3
0002 ( 0002 ) 10E 000A1CC6 0062 ( 0062 ) 18C 000ED224 00C2 ( 00C1 ) 012 0000B20A 0122 ( 0121 ) 090 00056768 037C:089B
0003 ( 0003 ) 10F 000A293F 0063 ( 0063 ) 18D 000EDE9D 00C3 ( 00C2 ) 013 0000BE83 0123 ( 0122 ) 091 000573E1 0094:1(094C):0237
..
last entry is
017F ( 017E ) 10A 0009F71A 02E4:0933


displays in 4 columns
the last entry shows a ‘slippage’ between PhySec and LogSec
but only by one sector
backtracking to where the discrepancy occurs shows

006D ( 006D ) 19B 000F5C6B
006E ( FFFF ) 19C 000F68E4
006F ( 006E ) 19D 000F755D

ie sector 6E is bad and skipped



Later on in the p-list
the phy cyl and log cyl start to diverge
eg

P List
phy phy log length
head cyl cyl in symb SFI flags
4 27F7B 27F7B 3F1 BD77D 80 scr fill
1 28055 27E15 392 410FA 80 scr fill

Can’t explain this yet
and is different to the User Logical Cylinders ‘gap’ due to the interleaved system area


SLIPS

p-list type defects skip or ‘slip’ over the bad sectors

There are slip lists for LBA’s in the user and system area

F3 T>V1

User Slip Defect List
log log log phys phys
LBA span cumm cyl hd sctr zn cyl sctr SFI PBA
0 0 0 0 0 0 0 0 0 A 0
48DD8 3 3 2 4 CF 0 2 D2 DA995 48DDB
48F2E 1 4 3 4 A8 0 3 A9 D8511 48F32
12A69B 1 5 1EC 4 6E 0 1EC 6F F755D 12A6A0
12A7F4 1 6 1ED 4 48 0 1ED 49 F7685 12A7FA
12A94D 1 7 1EE 4 22 0 1EE 23 F77AD 12A954
… (massive list)

Notice the 4th entry down
for Hd 4 cyl 1ec

span 1 = 1 sector and shows it was sector 6E
which matches the first p-list entry

What are these entries above it
that aren’t in the p-list

They turn out to be the 7200.12 non-resident g-list
although they are *skipped* sectors, more like a non-resident p-list

(to be continued)

4.4 Non resident g-list (7200.12)

non resident glist example but looks more like plist with *skipped* sectors rather than a glist with remapped sectors ?


F3 T>V40
Nonresident GList D entries returned
Total entries available: D
PBA Len Flags Phy Cyl Hd PhySctr SFI
48DD8 3 20 2 4 CF D83E9
48F31 1 20 3 4 A8 D7898
15D734 2 20 2B7 4 16D D7488
..
(its a short list)


Lets look before and after the PBA? 48DD8 area

F3 A>F 48dd7

Track Info:
Partition PhyCyl LogCyl NomCyl RadiusMils LogHd Zn FirstLba FirstPba LogSecs PhySecs WdgSkw SecPerFrm WdgPerFrm
User 00000002 00000002 00000002 +1.760000E+3 04 00 00048D09 00048D09 017D 0180 005A 0010 0015

Sector Info:
LBA PBA LogSec PhySec Wdg SFI Split Burst
00048DD7 00048DD7 00CE 00CE 0168 000D7770 05CC:064B 0169

F3 A>F 48dd8

Track Info:
Partition PhyCyl LogCyl NomCyl RadiusMils LogHd Zn FirstLba FirstPba LogSecs PhySecs WdgSkw SecPerFrm WdgPerFrm
User 00000002 00000002 00000002 +1.760000E+3 04 00 00048D09 00048D09 017D 0180 005A 0010 0015

Sector Info:
LBA PBA LogSec PhySec Wdg SFI Split Burst
00048DD8 00048DDB 00CF 00D2 016D 000DA995 037C:089B 016E

This shows that the 48DD8 LBA has skipped 3 sectors (CF, D0, D1) to sector D2
which agrees with the length 3 in the V40 list


Other notes about non resident G list

viewtopic.php?f=1&t=26367
“V40 - the nonresident G List will be displayed. This PBA based list
combines the previous nonresident G List with the resident G List at the time of the
last format.”

4.5 Resident g-list and sector remapping

The bad sectors that grow over time, and are *remapped*, are in the g-list

remapped sectors will slow down the sequential performance of the drive
which is possibly why 7200.12 has added the non-resident g list (that seem to skip)

There should be an alt list as well or a remap list according to this article

“G-list and alt are NOT the same thing. The alt list is used to remap bad sectors to the new ones, in other words it remaps the LBA to the new PBA and CHS, the G-list hold the location of the BAD sector in PBA and CHS format.“


F3 T>V80
Resident GList 1C entries returned
Total entries available: 1C
PBA Len Flags Phy Cyl Hd PhySctr SFI
3000 1 2 1E 0 13E F1D5E
1D32CA1B 2 4 437CE 0 7A A5D1
1D3C265F 1 4 45D02 4 B6 2070F
1D3C2709 1 4 45D03 4 A3 203B8
1D3C27B3 2 4 45D04 4 90 200A7
1D3C285E 1 4 45D05 4 7E 20A53
1D3C2908 1 4 45D06 4 6B 2070F
1D4C98D7 1 4 40FEA 1 1E 5A6DC
1D4C9989 2 4 40FEB 1 A 5A23C
1D4C9B02 1 4 40FEC 1 BD 5AA98
1D4C9BB4 1 4 40FED 1 A9 5A5F8
1D4C9C66 2 4 40FEE 1 95 5A158
1D4D2414 1 4 43E35 0 91 2501C
1D4D24C2 2 4 43E34 0 7D 24723
1D4D2571 1 4 43E33 0 6A 24AA3
1D4D2620 1 4 43E32 0 57 24E5C
1D4D26CF 1 4 43E31 0 44 25223
1D4D277D 2 4 43E30 0 30 248E3
1D53B47D 47FE 4 43FD6 0 0 7AF53
1D5401C9 A9C 4 43F70 0 0 8DA27
1D5564C5 16A5 4 40A8D 2 0 489D5
1D55B272 2 4 40AF7 2 3F 324A0
1D55B31B 1 4 40AF8 2 2D 32C1B
1D55B3C3 1 4 40AF9 2 1A 32693
1D55B46C 1 4 40AFA 2 8 32DDC
1D55B5CF 2 4 40AFB 2 B0 325A5
1D57AACC 965 4 3C8BD 5 0 1E8E3
1D57BAB2 2369 4 3C8D3 5 0 39D87

short list at the moment

Wheres the alt list ?
maybe this one ...

F3 T>V4

Reassigned Sectors List
Entries: 0001, Alts: 0001, Removed: 0000, Pending: 0000

Idx LBA PBA LLLCHS of LBA PLPCHS of PBA SFI Hours Msecs Status BBM Mask
0000 000000003000 00001D32A83B ------.-.---- 0437FB.0.00B4 08D35D ----- ------ 00010000 00000000

empty ?



More on this if/when I understand it

REQUEST

We really need another *real* expert to explain how this bad sector / skip / slip / remap stuff works

4.5 Resident g-list and sector remapping (continued)

The V4 Reassigned Sectors List example above is not empty
Has one entry for LBA 3000
which matches the first entry in the V80 Resident GList

PBA 3000
Phy Cyl Hd PhySctr = 1E 0 13E

It is remapped to PBA 1D32A83B

F3 A>C 3000
//C translates a PBA, and shows it is LBA 3000

F3 A>F 3000
confirms LBA 3000 is now actually PBA 1D32A83B , and says where this new PBA is

What does the bad sector show
F3 2>s 1e,0,22
F3 2>X
For the sector 13e area it shows

013D ( 013D ) 184 000F10E4
013E ( FFFF ) 185 000F1D5E
013F ( 013F ) 186 000F29D8

ie know 13e is bad
but no slip in this cyl/hd after there
but the reast of the system knows the LBA remapping

Does the ‘overall’ V1 user slip list have an entry for this?
no
as it is not a slip




Not sure what the other Resident GList entries mean

Lets look at the second entry

PBA 1D32CA1B 437CE, 0 , 7A

first thing we note is it and the later entries are all in the same high PBA area as the one remapped sector examined above
which is probably a remap alt spare area ?

F3 A>C 1D32CA1B
confirms the PhyCyl etc that we already know
and shows

Sector Info:
LBA PBA LogSec PhySec Wdg SFI Split Burst
1D328E21 1D32CA1B FFFF 007A 0021 0000A5D1 0348:1(04B4):041B 0022

Strangely F doesn’t know about that LBA ?

And in fact it is beyond the user addressable LBA range

LBAs 00000000-1D326C40
PBAs 00000000-1D5AB7E4

So this area must be a ‘spare’ remap area
and only one entry (PBA 1D32A83B) is used so far