65536 hidden sectors in WD USB drives after SATA conversion

[fzabkar]

The attached screenshot is from this MRT video which explains how to access a WD USB drive in SATA mode:

https://www.youtube.com/embed/kZK9ltcHWcs

The capacity reported via SATA (not USB) is 3906963632 sectors. This is 65536 sectors less than the IDEMA standard capacity, 3907029168. I have seen this behaviour in other threads. In those threads an examination of module 0x02 reveals that all 5 capacity parameters reflect the full IDEMA capacity, not the actual reported capacity. This same reported capacity is visible in the drive's Identify Device info sector when accessed via Linux, so it is not some artifact of PC3K or MRT.

The capacity reported via the native USB interface is even less by a few thousand sectors.

In another thread the difference was 65535 sectors rather than 65536.

What is going on? Where is this capacity value coming from?

Attachments

[Lukas]

I'm not entirely sure because I've only had this problem once and I haven't analyzed it that deeply, but maybe encryption and a boot partition for the WDunlocker application will be a clue?..

[fzabkar]

I'm not entirely sure because I've only had this problem once and I haven't analyzed it that deeply, but maybe encryption and a boot partition for the WDunlocker application will be a clue?..

Normally it is the USB bridge firmware that hides the "SmartWare" area from the OS, but when the bridge is removed, the full UA is exposed. However, in this case there are still some hidden sectors even after the drive is accessed directly via SATA and the bridge is eliminated. I'm wondering whether the drive knows that the end of the UA is reserved for an encryption key, and perhaps this restricted access is a recently introduced security feature. The bridge firmware would know how to access this area, possibly via a new VSC.

[pepe]

so i try to reply here.
Since i do not think i have any of these enclosures at hand, i cannot really test my suspects.
they are:
- the disk is SED, working transparent when not locked
- it has the smartware executable on the user partition, so user can start it and lock the drive with pwd
- SED uses ATA pwd to lock, it can be disabled but then data is crypted
- SED key is not stored in key blob at end of user area but in SA files (not 25 and 38) that's clear from the thread you linked: https://forum.hddguru.com/viewtopic.php?f=11&t=38894
- i share your suspect that if the drive is locked, the bridge presents a VCD partition which it sources from the drive in some way.

do we have an image of such VCD partition?

[fzabkar]

See this thread:

https://groups.google.com/g/datarecoverycertification/c/0XC2mZEB38M

The OP in that thread tried to access that hidden area via SATA in many ways, including with an unlocked PCB in Linux, but was unable to see it.

Allow me to repeat what I wrote elsewhere:

I hope this explains it better, although I don't know if it has any relevance to the present case.

https://forum.hddguru.com/viewtopic.php?f=11&t=38894

7814037168 -- full IDEMA capacity stored in all 5 capacity parameters in SA module 0x02
7813971633 -- IDEMA - 65535, capacity reported via SATA in Identify Device
7813969920 -- IDEMA - 67248, capacity reported by USB bridge, also in key sector in SA module 0x25

[fzabkar]

I found a reference to the truncated capacity (3906963632) in SA module 0x8003:

Code:

00000500  30 2C 32 35 35 2C 34 2C 57 44 32 30 53 44 52 57  0,255,4,WD20SDRW  <--- model = WD20SDRW-11VUUS0
00000510  2D 31 31 56 55 55 53 30 2C 30 30 30 2C 57 44 32  -11VUUS0,000,WD2
00000520  30 53 44 52 57 2D 31 31 56 55 55 53 30 2C 32 35  0SDRW-11VUUS0,25
00000530  35 2C 32 35 35 2C 31 2C 2C 2C 2C 2C 2C 2C 2C 2C  5,255,1,,,,,,,,,
00000540  2C 2C 43 52 41 36 39 33 58 2C 31 35 2C 31 2C 2C  ,,CRA693X,15,1,,
00000550  36 2C 36 2C 52 54 2D 30 32 31 31 38 30 20 30 37  6,6,RT-021180 07  <--- manufacture date 07/31/2019 10:19:14 AM ?
00000560  2F 33 31 2F 32 30 31 39 20 31 30 3A 31 39 3A 31  /31/2019 10:19:1
00000570  34 20 41 4D 2C 33 39 30 36 39 36 33 36 33 32 2C  4 AM,3906963632,  <--- IDEMA capacity - 65536 sectors = 3906963632
00000580  52 45 50 52 4F 43 45 53 53 2C 34 2C 2C 30 2C 2C  REPROCESS,4,,0,,
00000590  2C 30 2C 30 2C 30 2C 30 2C 30 2C 30 2C 39 2C 2C  ,0,0,0,0,0,0,9,,
000005A0  2C 2C 30 2C 58 43 59 4D 30 32 38 30 31 58 35 30  ,,0,XCYM02801X50  <--- QR-code on PCB = XCYM02 801X
000005B0  30 30 35 30 34 30 30 2C 39 39 2C 39 39 2C 39 39  0050400,99,99,99
000005C0  2C 2C 37 33 42 43 46 41 31 33 59 34 31 43 35 2C  ,,73BCFA13Y41C5,  <--- PCB part number = 73BCFA13Y41C5 ?
000005D0  2C 2C 2C 30 2C 2C 2C 2C 2C 2C 2C 2C 2C 2C 2C 2C  ,,,0,,,,,,,,,,,,
000005E0  2C 2C 2C 2C 2C 2C 2C 2C 2C 2C 2C 2C 43 48 41 52  ,,,,,,,,,,,,CHAR  <--- family = Charger
000005F0  47 45 52 2E 34 2E 30 31 32 2C 32 2C 2C 2C 36 3B  GER.4.012,2,,,6;
00000600  32 31 2C 30 2C 30 0A 00 00 00 00 00 00 00 00 00  21,0,0..........

[fzabkar]

I think this number might be the preamp or headstack serial number.

73BCFA13Y41C5, <--- PCB part number = 73BCFA13Y41C5 ?

https://archive.goughlui.com/wp-content/uploads/2021/02/2021020709488459.jpg

[msmdatarecovery]

Thanks for the info sir. @fzabkar