MultiDrive – free backup, clone & wipe disk utility from Atola Technology

Main » Forums home » Conventional hard drives

All times are UTC - 5 hours [ DST ]



Post new topic Reply to topic  Page 1 of 1
  [ 13 posts ] 
  Previous topic | Next topic 
Author Message
maddin
 Post subject: Drive full with two patterns
PostPosted: October 4th, 2019, 17:11 
Offline

Joined: July 27th, 2019, 17:40
Posts: 113
Location: Vienna
Hello,

I am imaging an drive and i see a ton of sectors full with
0x77 (w) or with
0x78 0x56 0x34 0x20 (xV4.) repeated all over the sector.

I am just curious what that could be? My only theory is that this pattern come from a shredder or some tool like that... Is that possible?
Top
 Profile  
 
Dananjaya
 Post subject: Re: Drive full with two patterns
PostPosted: October 5th, 2019, 0:47 
Offline

Joined: February 2nd, 2019, 1:21
Posts: 192
Location: Sri Lanka
what is the Drive model?
Top
 Profile  
 
DR-Kiev
 Post subject: Re: Drive full with two patterns
PostPosted: October 5th, 2019, 4:56 
Offline

Joined: March 7th, 2009, 12:43
Posts: 1091
Location: Angel Data Recovery
It is absolutely OK . Some of raid/hba controllers put that pattern .

_________________
Angel Data Recovery
Top
 Profile  
 
maddin
 Post subject: Re: Drive full with two patterns
PostPosted: October 5th, 2019, 5:12 
Offline

Joined: July 27th, 2019, 17:40
Posts: 113
Location: Vienna
Dananjaya wrote:
what is the Drive model?


It's a Seagate 7200.11 drive with 250GB (ST3250310NS) with Firmware SN04.

I was just a bit unsure because that drive don't give me access to alsmost any firmware parts:

Code:
Identifying device...
Device identification error!

Getting detailed firmware version...
Failed to get firmware version!

Physical sector size : .............................Failed to get

physical sector size of service area : .............Failed to get

Number of physical heads : .........................Failed to get
Get System module information ...
     ID     length     Description
=========================

Failed to get system module information!

Getting DT information...

ROM:
   ID     Offset address     Length
============================

   00     06020100     33792   
   01     06020000     256   
   04     04001000     4096   
          0602BE00     4096
             total     8192
   05     0006C000     81920   
   08     10070000     948   
   0A     060A731C     1024   
   12     100D4000     104   
   13     060B1F6C     544   
   14     060B218C     64   
   15     00000000     524288   

Getting service area size.......
Service area size: : ................................Fail

Getting list  of sys files.......
Serial port error!
Unable to get relevant data from DT List!


It also reported 0 byte capacity and don't give me access to the terminal.

Only way I got the imaging working was by manually setting sector-count, blocksize, ... in MRT.

Fianlly it took 19h to image that 250GB and that patterns was all over the place what make me a bit unsure. Now after the image is complete i see how much empty space is on that drive (ca. 67%) and that there was really some data which is fine. While imaging I saw most time just that pattern and that made me nervous.
Top
 Profile  
 
magnetepazzo
 Post subject: Re: Drive full with two patterns
PostPosted: October 6th, 2019, 1:19 
Offline

Joined: September 14th, 2018, 13:41
Posts: 299
Location: italy
it is possible that in those areas there are deleted data that you can obviously read, often when the disks have a lot of time and therefore customers have copied everything you come across in this situation. I hope I have understood your situation well, you have scanned 100% of the surface seeing data here and there on the whole surface but when you opened the disk you found a quantity not consistent with the lhex you saw, right?
Top
 Profile  
 
maddin
 Post subject: Re: Drive full with two patterns
PostPosted: October 6th, 2019, 4:51 
Offline

Joined: July 27th, 2019, 17:40
Posts: 113
Location: Vienna
magnetepazzo wrote:
it is possible that in those areas there are deleted data that you can obviously read, often when the disks have a lot of time and therefore customers have copied everything you come across in this situation. I hope I have understood your situation well, you have scanned 100% of the surface seeing data here and there on the whole surface but when you opened the disk you found a quantity not consistent with the lhex you saw, right?


I got some data back - but huge portion of the empty space has that pattern. I was just curiour what that is and where it came from because i never saw that pattern.

Further I am not sure if that patterns have something to do with the firmware-problem. I also never saw a drive which cant access most od the firmware and don't report a serial or any capacity.
Top
 Profile  
 
magnetepazzo
 Post subject: Re: Drive full with two patterns
PostPosted: October 6th, 2019, 7:07 
Offline

Joined: September 14th, 2018, 13:41
Posts: 299
Location: italy
Of course you can't read firmware data in those areas that are intended for user data, most likely it is empty space after deletion
Top
 Profile  
 
maddin
 Post subject: Re: Drive full with two patterns
PostPosted: October 6th, 2019, 8:13 
Offline

Joined: July 27th, 2019, 17:40
Posts: 113
Location: Vienna
magnetepazzo wrote:
Of course you can't read firmware data in those areas that are intended for user data, most likely it is empty space after deletion


I am new to firmware-issues but I know that I have to read it from special areas. In that case I could not get the terminal working and MRT was not able to read the firmware via terminal and not via the SATA-cable. Even the orig. Seagate-Software could not communicate with that drive...

I was just curious if that pattern can be caused by some issue with the firmware but now i know it's most likely some from a RAID-controller or from soke kind of secure deletion.
Top
 Profile  
 
DR-Kiev
 Post subject: Re: Drive full with two patterns
PostPosted: October 7th, 2019, 4:46 
Offline

Joined: March 7th, 2009, 12:43
Posts: 1091
Location: Angel Data Recovery
maddin wrote:
magnetepazzo wrote:
Of course you can't read firmware data in those areas that are intended for user data, most likely it is empty space after deletion



I was just curious if that pattern can be caused by some issue with the firmware but now i know it's most likely some from a RAID-controller or from soke kind of secure deletion.

No, that pattern in user area has nothing to do with FW

_________________
Angel Data Recovery
Top
 Profile  
 
Arch Stanton
 Post subject: Re: Drive full with two patterns
PostPosted: October 7th, 2019, 14:57 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 1150
Location: Nederland
okay NVM

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service
Top
 Profile  
 
fzabkar
 Post subject: Re: Drive full with two patterns
PostPosted: October 7th, 2019, 15:58 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 16963
Location: Australia
maddin wrote:
It also reported 0 byte capacity and don't give me access to the terminal.

Only way I got the imaging working was by manually setting sector-count, blocksize, ... in MRT.

I don't understand this. Surely the zero capacity issue is a symptom of a firmware problem, in which case there would be no access to the user area until the problem is corrected. If so, then the retrieved data must be garbage, or am I misunderstanding something? :?

_________________
A backup a day keeps DR away.
Top
 Profile  
 
maddin
 Post subject: Re: Drive full with two patterns
PostPosted: October 7th, 2019, 18:39 
Offline

Joined: July 27th, 2019, 17:40
Posts: 113
Location: Vienna
fzabkar wrote:
I don't understand this. Surely the zero capacity issue is a symptom of a firmware problem, in which case there would be no access to the user area until the problem is corrected. If so, then the retrieved data must be garbage, or am I misunderstanding something? :?


Nope, after setting the amount of sectors and the sector size i could image it and got all data back except 33 sectors which could not read.

After setting sector-size and count I opened the Hex-Editor and looked for sector one. After that looked promissing i checked if I can read the drive with the File Explorer. As that tool was able to read the filesystem and showed me all folders and files i started imaging. The Data-extractor worked but with a lot of restarts and timeouts - took me ca. 19h and multiple passes to image the 233GB. All user-data works as far as I saw. Practically that case would be solved but anyway I would be interested how to solve the firmware-issue as well...

The firmware-issue is still not fixed and i can't access the terminal or get any serial-number or other informations. I was able to backup the ROM but when I tryed to do a virtual start in MRT I got Error 80000001!
Top
 Profile  
 
maddin
 Post subject: Re: Drive full with two patterns
PostPosted: October 7th, 2019, 18:58 
Offline

Joined: July 27th, 2019, 17:40
Posts: 113
Location: Vienna
maddin wrote:
After setting sector-size and count I opened the Hex-Editor and looked for sector one. After that looked promissing i checked if I can read the drive with the File Explorer. As that tool was able to read the filesystem and showed me all folders and files i started imaging.


... not sure if that's always the case but it saved my butt.
Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  Page 1 of 1
  [ 13 posts ] 

Main » Forums home » Conventional hard drives

All times are UTC - 5 hours [ DST ]

Who is online

Users browsing this forum: No registered users and 45 guests

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Switch to mobile style
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group