Corrupted Seagate ROM

[Sling Shot]

It's a strange case where the customer isn't telling me everything about the drive, despite being asked, but thats nothing new, I guess.

Anyway, despite all the screws missing from the drive lid (apparently they removed themselves), it looks like they haven't been inside the drive itself.

However, the PCB has had a diode removed from its powerline side (again, it removed itself).

Anyway, the drive will spin up, but it knocks like crazy. 

Cannot read ROM in boot code mode so programmer read only (dump attached)

Loaded ROM into 3K utility and get a warning:

ROM image contains crytical damaged objects
[CAP, RAP, SAP]

The drives serial matches in the limited info from ROM dump, so it might still be the native PCB.

The question is, can this ROM be fixed, or is it game over ?

Dump text and pics attached: 

Thanks in advance.

[pbzcbf...@gmail.com]

Without actually examining the ROM, if the drive spins up, then the ROM is probably OK. The message about damaged adaptives usually means that only the first half of the ROM was dumped.

[pbzcbf...@gmail.com]

Actually, it's a bad dump. You need to dump the ROM at least twice and compare the dumps.

[Sling Shot]

Thanks Franc, will try again and come back to you.

[pbzcbf...@gmail.com]

I would measure the Vcc voltage on the PCB (pin #8) to make sure your programmer is set correctly.

[Sling Shot]

Did a few re-reads of the ROM, and the first version was definitely a bad dump.

Versions 3 and 4 are identical, so I settled on version 4.

Version 4 ROM and dump text attached.

Vcc on pin 8 was 4.94v, but my programmer doesn't allow for voltage control, so not sure how I can do anything with that unfortunately.

[pbzcbf...@gmail.com]

What!!!

Please get rid of your programmer before you destroy your customers' ROMs. Today's ROMs are 1.8V devices. 5V ROMs disappeared decades ago.

[Sling Shot]

Can't say we've had any issue with this programmer to date, but sure, what do you recommend using instead? 

Also, this 5V case is from 2010, so it should be okay with this one. 

Do you have any ideas on the contents of the ROM info? Can it be fixed? 

[t...@desertdatarecovery.com]

Might be some confusion here. Franc you asked him to measure pin 8 on the PCB and it came back as 5v. Nothing to do with him programmer (or maybe I missed something).

 

Tim Homer - Lead Engineer

Desert Data Recovery

+1 (602) 686 2622

t...@desertdatarecovery.com

www.desertdatarecovery.com

--
Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/47bac36d-bfc3-48f0-bc49-2b3541533c4bn%40googlegroups.com.

[img]

I think he measured the programmer's voltage because on that PCB there is a Winbond 25X40BLSP9 which is a 2,5-3,3V flash so 4,94V definitely an overvoltage for that.

https://www.alldatasheet.com/datasheet-pdf/pdf/443818/WINBOND/W25X40BL.html

4,94V is a typical USB rail voltage which can be originated from the USB powered CH341A without voltage mod. CH341A needs vmod for 3,3V:

https://wiki.chucknemeth.com/usb-devices/ch341a/3v-ch341a-mod

Or you can buy another version from Aliexpress (v1.7 with built-in voltage selector switch):

https://www.aliexpress.com/item/1005009264729721.html

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/00f001dc0b1d%24529a8e10%24f7cfaa30%24%40desertdatarecovery.com.

[Sling Shot]

Just for clarity.

The PCB is powered via a SATA power cable.

Using a multimeter, I have measured the voltage going to each leg of the ROM chip.

Legs 1,2,3 all received 2.5V

Leg 4 receives 0v

Legs 5,6,7 all received 2.5V

Leg 8 receives 0v

The 4.94v was measured from pin 8 of the SATA power on the PCB.

My programmer is a 3.3v unit that hasn't caused me any issues yet, but it doesn't have any switches to drop it to 2.5 or 1.8.

I repeated the process using a donor PCB (that hadn't been tampered with), and I got the same results as above.

The customer has since miraculously remembered plugging the drive into a laptop's PSU, so we can assume the drive was electrocuted.

It also went to the local computer shop before it came to us.

The patient ROM looks like is missing information.

The question is, is this fixable? 

[img]

Thank you for the clarification.

'The customer has since miraculously remembered plugging the drive into a laptop's PSU, so we can assume the drive was electrocuted.' -> It makes sense then.

'Leg 8 receives 0v' -> It is interesting because pin 8 is the positive power supply (VCC) input of the flash chip so if there's 0V then it means the chip does not get power supply or at least something is shorted on that power rail.

Can you measure 3,3V anywhere on that board?

'My programmer is a 3.3v unit' -> Okay, that will be fine for this type of flash.

'I repeated the process using a donor PCB (that hadn't been tampered with), and I got the same results as above.'

So you replaced the flash chip from the patient board to a donor PCB and then the patinet drive with the donor PCB acted with the same symptoms? Or you just measured the untouched donor board for reference?

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/bfae9976-c437-4b3a-9e70-ffcc4e7f1b1an%40googlegroups.com.

[img]

And IDK from the top of my head which is the read channel on that board but you should check that - and the preamp - for (partial) short or other damages due to the PCB is 'electrocuted'.

[Sling Shot]

I'll jump back on it tomorrow and see what I can measure.

As for the donor board, I didn't swap the ROM chip over; I just used an untouched board as a reference.

My initial feeling was a nuked pre-amp, but the entire interaction with the customer—missing screws, tampered PCB, weird ROM dumps, and half-truths extracted through painstaking repeated questioning—left me somewhat suspicious of the whole debacle.

[Sling Shot]

Theres only one place I can measure 3.3v (marked on below photo).

Doing a continuity test on the read channels and preamp isnt finding a short either.

Just for clarity on the ROM legs, leg 1 is by the dot and leg 5 is opposite the dot. 

[img]

'Just for clarity on the ROM legs, leg 1 is by the dot and leg 5 is opposite the dot.'

As I expected too.

I didn't found the exact same board but the one with the same Winbond flash: on the flash's pin 8 there must be some voltage, probably 2,5V (not 3,3V so my initial assumption was wrong). If there's absolutely no voltage: what resistance to the ground can you measure on that pin (without powering on the board)? If no low resistance (dead short or partial short) measured (and also on the desoldered chip) then the fastest way is to move the flash ROM to an identical donor board and test the patient drive with that. And also in PC3K for reading / writing the ROM.

If you're in the mood of measuring, you can check up some things on the damaged patient board:

If the TVS diode is shorted on the 12V power rail than the the Smooth motor controller can be damaged, which also provides a few sub power rails to the components.

'Doing a continuity test on the read channels and preamp isnt finding a short either.'

That is good news.

On the PCB (in idle state, without the HSA attached) you can measure 1,3V (LSI MCU power supply), 2.5V but also there is 3,3V and 5V. Are they there? Some of the voltages are appears only when the drive is reading or writing, so you can find only these in idle state.

Can you measure very low resistance to the GND, on both sides of the bigger capacitors anywhere?

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/489e53ab-3782-4586-b4db-501898f320e4n%40googlegroups.com.

[Sling Shot]

After a long time, the customer finally contacted us and asked us to do whatever was necessary to obtain the data.

Internal inspection revealed that the heads were trashed... so it had suffered more than an electrical shock (possibly thrown at the floor by the customer).

Anway, donor was sought and off we go.

Comparing donor ROM and patient ROM was interesting, as the contents looked the same.

So, patient ROM has now been physically moved to donor PCB and we now have terminal access on the drive.

Heads have been swapped, drive spins up, no horrible noises, came ready with full ID, LBA etc.

Accessed 93 and turned off usual flags, restarted the drive and now no ID, etc.

Drive spins no problem, and keeps spinning, can access 93 through terminal and SA (if shorted) and write changes to both copies, albeit writing copy 1 seems more problematic.

Have tried many variants of 93 flags and currently have the 'show additional diag option' checked.

Drive still behaves the same, just sits in BSY state.

Terminal log:


Rst 0x20M
Servo Processor Is Reset.
RW: Disc Ctlr Initialization Completed.
ExecuteSpinRequest
 FAIL Op=0100 Resp=0005
 FAIL Op=0900 Resp=0005
 FAIL Op=0600 Resp=0005
 FAIL Op=0055 Resp=0005
(P) SATA Reset

RAW OFF

 FAIL Op=0165 Resp=0005
 FAIL Op=0055 Resp=0005

....and continues spinning in BSY state.

Anyone any ideas to get this thing to come ready ? 

[t...@desertdatarecovery.com]

Most likely this is not a 93 issue but media damage. I know this is after the fact, but you can set SMP flags in RAM instead of rebooting a drive after a head swap which is not recommended. Also always test if a drive can write on a minor sys file before changing other system files.

 

What does the SA drop down ‘SA reading errors search by last 32 RW cmd list’ show you?  

 

Tim Homer - Lead Engineer

Desert Data Recovery

+1 (602) 686 2622

t...@desertdatarecovery.com

www.desertdatarecovery.com

 

From: datarecovery...@googlegroups.com <datarecovery...@googlegroups.com> On Behalf Of Sling Shot
Sent: Friday, September 19, 2025 3:18 AM
To: DataRecoveryCertification <datarecovery...@googlegroups.com>
Subject: Re: Corrupted Seagate ROM

 

After a long time, the customer finally contacted us and asked us to do whatever was necessary to obtain the data.

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/0f2bb08f-dcf3-45f3-a4a1-191a224720a6n%40googlegroups.com.

[Sling Shot]

SA reading errors search by last 32 RW cmd list:

Test  : SA reading errors search by last 32 RW cmd list...
Calling tracing...
Detecting SA Phys Sct Size...
Result.................................. : 512
Ts(ms)     dT(ms)   xT(ms)  Type Option Mode  St EC       Info
4294967295 99999999        0 FF  FFFFFFFF FFFFFFFF FF FFFFFFFF
4294967295        0        0 FF  FFFFFFFF FFFFFFFF FF FFFFFFFF
4294967295        0        0 FF  FFFFFFFF FFFFFFFF FF FFFFFFFF
4294967295        0        0 FF  FFFFFFFF FFFFFFFF FF FFFFFFFF
4294967295        0        0 FF  FFFFFFFF FFFFFFFF FF FFFFFFFF
4294967295        0        0 FF  FFFFFFFF FFFFFFFF FF FFFFFFFF
4294967295        0        0 FF  FFFFFFFF FFFFFFFF FF FFFFFFFF
4294967295        0        0 FF  FFFFFFFF FFFFFFFF FF FFFFFFFF
4294967295        0        0 FF  FFFFFFFF FFFFFFFF FF FFFFFFFF
4294967295        0        0 FF  FFFFFFFF FFFFFFFF FF FFFFFFFF
4294967295        0        0 FF  FFFFFFFF FFFFFFFF FF FFFFFFFF
4294967295        0        0 FF  FFFFFFFF FFFFFFFF FF FFFFFFFF
4294967295        0        0 FF  FFFFFFFF FFFFFFFF FF FFFFFFFF
4294967295        0        0 FF  FFFFFFFF FFFFFFFF FF FFFFFFFF
4294967295        0        0 FF  FFFFFFFF FFFFFFFF FF FFFFFFFF
4294967295        0        0 FF  FFFFFFFF FFFFFFFF FF FFFFFFFF
4294967295        0        0 FF  FFFFFFFF FFFFFFFF FF FFFFFFFF
4294967295        0        0 FF  FFFFFFFF FFFFFFFF FF FFFFFFFF
4294967295        0        0 FF  FFFFFFFF FFFFFFFF FF FFFFFFFF
4294967295        0        0 FF  FFFFFFFF FFFFFFFF FF FFFFFFFF
4294967295        0        0 FF  FFFFFFFF FFFFFFFF FF FFFFFFFF
4294967295        0        0 FF  FFFFFFFF FFFFFFFF FF FFFFFFFF
4294967295        0        0 FF  FFFFFFFF FFFFFFFF FF FFFFFFFF
4294967295        0        0 FF  FFFFFFFF FFFFFFFF FF FFFFFFFF
4294967295        0        0 FF  FFFFFFFF FFFFFFFF FF FFFFFFFF
4294967295        0        0 FF  FFFFFFFF FFFFFFFF FF FFFFFFFF
4294967295        0        0 FF  FFFFFFFF FFFFFFFF FF FFFFFFFF
4294967295        0        0 FF  FFFFFFFF FFFFFFFF FF FFFFFFFF
4294967295        0        0 FF  FFFFFFFF FFFFFFFF FF FFFFFFFF
4294967295        0        0 FF  FFFFFFFF FFFFFFFF FF FFFFFFFF
4294967295        0        0 FF  FFFFFFFF FFFFFFFF FF FFFFFFFF
      1186     1187 99999999 2F  000000 000000 FF FFFFFFFF SPN_UP NORMAL
SA reading errors are not found!

It might give a different result when shorted, but I'm not in the office now to try that.

[Sling Shot]

SA reading errors search by last 32 RW cmd list:

Test  : SA reading errors search by last 32 RW cmd list...

Calling tracing...

Ts(ms)     dT(ms)   xT(ms)  Type Option Mode  St EC       Info

     20920 99999999     3394 02  002241 000000 2 C3160080 XFR RD SYS LBA B 00000002FD3D L 00000001 BO 000000 BES 007660A.02FFFFF.0076D8A  =FILE= ???
     24314     3394       36 02  002241 000000 2 43110081 XFR RD SYS LBA B 00000006B13E L 00000051 BO 000000 BES 007660A.02FFFFF.007660A  =FILE= ???
     24351       37      288 02  002241 000000 0 43110081 XFR RD SYS LBA B 00000006B13E L 00000001 BO 000000 BES 007660A.02FFFFF.007660A  =FILE= ???
     24639      288      344 02  002241 000000 2 C3160080 XFR RD SYS LBA B 00000006B13F L 00000050 BO 000000 BES 007660A.02FFFFF.007664A  =FILE= ???
     24983      344      397 02  002241 000000 0 C4090082 XFR RD SYS LBA B 00000006B153 L 00000001 BO 000000 BES 007660A.02FFFFF.0076B4A  =FILE= ???
     25381      398      127 02  002241 000000 2 C3160080 XFR RD SYS LBA B 00000006B154 L 0000003B BO 000000 BES 007660A.02FFFFF.0076B8A  =FILE= ???
     25508      127      397 02  002241 000000 0 C4090082 XFR RD SYS LBA B 00000006B154 L 00000001 BO 000000 BES 007660A.02FFFFF.0076B8A  =FILE= ???
     25905      397      128 02  002241 000000 2 C3160080 XFR RD SYS LBA B 00000006B155 L 0000003A BO 000000 BES 007660A.02FFFFF.0076BCA  =FILE= ???
     26033      128      397 02  002241 000000 0 C4090082 XFR RD SYS LBA B 00000006B155 L 00000001 BO 000000 BES 007660A.02FFFFF.0076BCA  =FILE= ???
     26430      397      127 02  002241 000000 2 C3160080 XFR RD SYS LBA B 00000006B156 L 00000039 BO 000000 BES 007660A.02FFFFF.0076C0A  =FILE= ???
     26557      127      397 02  002241 000000 0 C4090082 XFR RD SYS LBA B 00000006B156 L 00000001 BO 000000 BES 007660A.02FFFFF.0076C0A  =FILE= ???
     26954      397      128 02  002241 000000 2 C3160080 XFR RD SYS LBA B 00000006B157 L 00000038 BO 000000 BES 007660A.02FFFFF.0076C4A  =FILE= ???
     27082      128      397 02  002241 000000 0 43110081 XFR RD SYS LBA B 00000006B157 L 00000001 BO 000000 BES 007660A.02FFFFF.0076C4A  =FILE= ???
     27479      397      127 02  002241 000000 2 C3160080 XFR RD SYS LBA B 00000006B158 L 00000037 BO 000000 BES 007660A.02FFFFF.0076C8A  =FILE= ???
     27606      127      397 02  002241 000000 0 C4090082 XFR RD SYS LBA B 00000006B158 L 00000001 BO 000000 BES 007660A.02FFFFF.0076C8A  =FILE= ???
     28004      398      127 02  002241 000000 2 C3160080 XFR RD SYS LBA B 00000006B159 L 00000036 BO 000000 BES 007660A.02FFFFF.0076CCA  =FILE= ???
     28131      127     2717 02  002241 000000 2 43110081 XFR RD SYS LBA B 00000006B159 L 00000001 BO 000000 BES 007660A.02FFFFF.0076CCA  =FILE= ???
     30848     2717      651 02  005041 000000 2 C4440080 XFR WR SYS LBA B 000000028FBC L 00000008 BO 000000 BES 003CEDA.003D0D9.003CEDA  =FILE= ???
     31499      651     2195 02  005041 000000 2 C4440080 XFR WR SYS LBA B 000000028FBC L 00000001 BO 000000 BES 003CEDA.003D0D9.003CEDA  =FILE= ???
     33694     2195      619 02  005041 000400 2 C4440080 XFR WR SYS LBA B 000000028FBC L 00000008 BO 000000 BES 003CEDA.003D0D9.003CEDA  =FILE= ???
     34333      639        0 27  005041 000400 1 00000080 SND_SRV 0C01 0000 0000 0000 0000 0000 0000 0000 0001 C3E1 00D0
                                                          D4E8 0000 0000 0000 0003 FC00 F430 3F9D 0003 0000 0000 0000 0000 0000 0000 0000
     34427       94       97 02  002241 000000 0 43110081 XFR RD SYS LBA B 00000002B857 L 00000190 BO 000000 BES 003D11A.0043519.003D11A  =FILE= ???
     34527      100      616 02  005041 000000 2 C4440080 XFR WR SYS LBA B 00000002FD3D L 00000001 BO 000000 BES 003CE1A.003CE59.003CE1A  =FILE= ???
     35143      616     2345 02  005041 000000 2 C4440080 XFR WR SYS LBA B 00000002FD3D L 00000001 BO 000000 BES 003CE1A.003CE59.003CE1A  =FILE= ???
     37489     2346      618 02  005041 000400 2 C4440080 XFR WR SYS LBA B 00000002FD3D L 00000001 BO 000000 BES 003CE1A.003CE59.003CE1A  =FILE= ???
     38117      628        9 02  002241 000000 1 00000080 XFR RD SYS LBA B 000000029088 L 00000001 BO 000000 BES 003C0B1.003C0F0.003C0B1  =FILE= ???
     38126        9      617 02  005041 000000 2 C4440080 XFR WR SYS LBA B 000000028FBC L 00000008 BO 000000 BES 003CEDA.003D0D9.003CEDA  =FILE= ???
     38743      617     2271 02  005041 000000 2 C4440080 XFR WR SYS LBA B 000000028FBC L 00000001 BO 000000 BES 003CEDA.003D0D9.003CEDA  =FILE= ???
     41014     2271      618 02  005041 000400 2 C4440080 XFR WR SYS LBA B 000000028FBC L 00000008 BO 000000 BES 003CEDA.003D0D9.003CEDA  =FILE= ???
     41642      628        0 47  000000 000400 1 00000080 DISC_SLIP
     50682     9040        4 02  005041 000000 1 00000080 XFR WR SYS LBA B 00000002FD67 L 00000001 BO 000000 BES 0043E80.0043EBF.0043E80  =FILE= ???
     50686        4       34 02  005041 000000 0 89800094 XFR WR SYS LBA B 00000006B186 L 00000001 BO 000000 BES 0043E80.0043EBF.0043E80  =FILE= ???
 FAIL Op=0065 Resp=0005
 FAIL Op=0165 Resp=0005
Found Errors:
SYS LBA: 0002FD3D; Files(Vol.FID(Copy), hex): ???
SYS LBA: 0006B13E; Files(Vol.FID(Copy), hex): ???
SYS LBA: 0006B13F; Files(Vol.FID(Copy), hex): ???
SYS LBA: 0006B153; Files(Vol.FID(Copy), hex): ???
SYS LBA: 0006B154; Files(Vol.FID(Copy), hex): ???
SYS LBA: 0006B155; Files(Vol.FID(Copy), hex): ???
SYS LBA: 0006B156; Files(Vol.FID(Copy), hex): ???
SYS LBA: 0006B157; Files(Vol.FID(Copy), hex): ???
SYS LBA: 0006B158; Files(Vol.FID(Copy), hex): ???
SYS LBA: 0006B159; Files(Vol.FID(Copy), hex): ???
SYS LBA: 0002B857; Files(Vol.FID(Copy), hex): ???

Despite all of this drives problems, I still managed to fix it, stabilse it and get it imaging.

Why is it that the most problematic drives are always the fullest 😅

Thanks to those who helped with this one.