ST4000LM024-2AN17V pc3k, family, headmaps, preamp unknown

[Alandata Recovery]

Model : ST4000LM024-2AN17V Serial : WFF17MX7 Firmware : 0001 Capacity : 4 TB (7 814 037 168) Hi I have this drive. Needs heads. drive family not detected chose kahun_5400 headmaps not available preamp not listed. 1) it makes some buzzy not good noises but comes ready with full id and spins down. So I assume that it has an ssd component. 2) how to I find preamp? Thanks Selected family......................... : 72, Kahuna_5400 Model by ID............................. : <HDD ID NOT READ> Loading default settings! Use the options dialog to review and save utility settings. Then press OK! Family default settings loading! Tech Key... Operation aborted Switching HDD power supply OFF Switching HDD power supply ON Flash type inx... 0x0000000C Flash size....... 0x00200000 Flash prm dmp.... 0xEF 0x60 0x10 0x0B 0x05 0xFF 0x01 0x03 0x3C 0x20 0x40 0x04 0x00 0x01 0x00 0x00 Receiving file flash.bin, length = 2097152 Saving ROM to profile folder File : C:\Program Files (x86)\ACE Lab\PC-3000\Bin\!Profiles\SgF3\Kahuna_5400\ST4000LM024-2AN17V_WFF17MX7_ben\Data\ROM\ROM_WFF17MX7_242452F8.bin Parsing container segment....... Flash ROM image WARNING! Segment header check sum is invalid! Segment: GLOB_FLASH_DIR Parsing segment....... GLOB_FLASH_DIR End parsing segment... GLOB_FLASH_DIR Segment: BOOTFW_CONT_0 Parsing container segment....... BOOTFW_CONT_0 Segment: BOOTFW_DIR Parsing segment....... BOOTFW_DIR End parsing segment... BOOTFW_DIR Segment: GENERAL_DATA Parsing segment....... GENERAL_DATA End parsing segment... GENERAL_DATA Segment: PROG_INQ_DATA Parsing segment....... PROG_INQ_DATA End parsing segment... PROG_INQ_DATA Segment: BOOTFW Parsing segment....... BOOTFW End parsing segment... BOOTFW Segment: IAP Parsing segment....... IAP End parsing segment... IAP Segment: SFW Parsing segment....... SFW End parsing segment... SFW Segment: SHELL Parsing segment....... SHELL End parsing segment... SHELL End parsing container segment... BOOTFW_CONT_0 Segment: GLOB_FLASH_DIR Parsing segment....... GLOB_FLASH_DIR End parsing segment... GLOB_FLASH_DIR Segment: BOOTFW_CONT_1 Parsing container segment....... BOOTFW_CONT_1 Segment: BOOTFW_DIR Parsing segment....... BOOTFW_DIR End parsing segment... BOOTFW_DIR Segment: GENERAL_DATA Parsing segment....... GENERAL_DATA End parsing segment... GENERAL_DATA Segment: PROG_INQ_DATA Parsing segment....... PROG_INQ_DATA End parsing segment... PROG_INQ_DATA Segment: BOOTFW Parsing segment....... BOOTFW End parsing segment... BOOTFW Segment: IAP Parsing segment....... IAP End parsing segment... IAP Segment: SFW Parsing segment....... SFW End parsing segment... SFW Segment: SHELL Parsing segment....... SHELL End parsing segment... SHELL End parsing container segment... BOOTFW_CONT_1 Segment: RAP Parsing segment....... RAP End parsing segment... RAP Segment: UDS_BFW Parsing segment....... UDS_BFW Segment: SAP Parsing segment....... SAP End parsing segment... SAP Segment: CAP Parsing segment....... CAP End parsing segment... CAP Segment: BOOTFLOADER Parsing segment....... BOOTFLOADER End parsing segment... BOOTFLOADER End parsing container segment... Flash ROM image FLASH ROM Info ============== Image size............... : 2097152 QNR Revisions: Flash ROM image.......... : 3 GLOB_FLASH_DIR........... : 3 BOOTFW_CONT_0............ : 0 GLOB_FLASH_DIR........... : 4 BOOTFW_CONT_1............ : 0 CAP ### Validation Key........... : 0x00000020 Fam ID................... : 0x72 (Kahuna_5400) Fam Member............... : 0x1 Head count............... : 9 Date..................... : 15 Aug 2019 SN....................... : WFF17MX7 PCB SN................... : 0000C0143P58 PCB PN................... : ÿÿÿÿÿÿÿÿÿÿ WWN...................... : 5000C500C3591E99 MDL1..................... : ST4000LM024-2AN17V MDL2..................... : ST4000LM024-2AN17V Capacity................. : 7814037168 RAP ### Format revision.......... : 0x0206 Contents revision........ : 0x2B031300 Number Sys Zones......... : 1 Number User Zones........ : 150 Heads count.............. : 12 FW Implementation Key.... : 0x1E SAP ### Addr 0................... : 0x00112F00 Addr 1................... : 0x80000000 Fam ID................... : 0xA1, (M11) Fam Member............... : 0x11 SN....................... : WFF17MX7 Servo FW rev code........ : 0xC607 Max head................. : 8 Seek mode................ : 2000 Flags.................... : 1A39 Head vendor.............. : default RRO mode................. : 0005 Logical head map......... : 01 02 03 04 05 06 07 08 09 09 CODE info ######### Bank 0 ProdType................. : M1A1800.SDMA Controller FW Rev........ : 04170428 Customer Release......... : 0001 Changelist............... : 01570538 Build date / time........ : 4/17/2019 4:28:22 AM Package Global ID........ : 00410701 Package Builder ID....... : Build Rev................ : Package Rev.............. : MD45L1 Pkg P/N.................. : 100852863 Servo FW................. : C607 / ---- / ---- / ---- Package Version.......... : M1A1800.SDMA.MD45L1.0001SDMA Pkg CFW Ver.............. : M1A1800.SDMA.01570538.00410701 Bank 1 ProdType................. : M1A1800.SDMA Controller FW Rev........ : 04170428 Customer Release......... : 0001 Changelist............... : 01570538 Build date / time........ : 4/17/2019 4:28:22 AM Package Global ID........ : 00410701 Package Builder ID....... : Build Rev................ : Package Rev.............. : MD45L1 Pkg P/N.................. : 100852863 Servo FW................. : C607 / ---- / ---- / ---- Package Version.......... : M1A1800.SDMA.MD45L1.0001SDMA Pkg CFW Ver.............. : M1A1800.SDMA.01570538.00410701

--

Alandata Data Recovery -  (949)287-3282  
"Cleanroom Data Recovery of RAID, VMware, NAS, Linux, Tape, Disk, Forensics"

www.alandata.com   www.alandataRecovery.com

[Data Recovery Guru]

To my knowledge, no NAND on it.

It is M10 family.

Typically they have heads and usual firmware issues. Bad sectors are a given.

Head swap kind of tricky with the magnet - have to remove one of the bottom screws.

Petri

DATARECOVERYGURU

(617)571-9172

www.datarecoveryguru.com

https://www.linkedin.com/company/data-recovery-guru

https://www.facebook.com/datarecoveryguru

https://www.instagram.com/datarecoveryguru

https://www.youtube.com/c/Datarecoveryguru1

https://twitter.com/DataRecoverGuru

https://plus.google.com/+Datarecoveryguru1

--
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/CAH-%2BjWRJ%3DKYD86xCg%3DJnc1kT6uzWdAnEyhDbOqzeWXS0RcLe5w%40mail.gmail.com.

[IT LAND]

+1 to labtech, no nand on this one. You can use M10 utility to read ROM. This model will show id from the ROM even if the heads are dead.very common to have bad heads with firmware corruption and bad sectors, sometimes media cache issue. Most of the heads swaps I did with this model were successful, I found the heads quite resilient for a Seagate.

[compos mentis]

I might be able to extract the preamp ID from the adaptives, if you upload the ROM image.

[Carlos Marmolejos]

Match 1st 3 serial number letters and will be ok. But be aware this model you can't import adaptatives from donor, most of the time it read after head swap but slow reading from 100kbps to 4 mbps, it's normal, by the issue that you can't import adaptatives. Be ready to spend a lot of time if need to img 4tb...

El lun., 29 jun. 2020 8:35 p. m., compos mentis <pbzcbf...@gmail.com> escribió:

I might be able to extract the preamp ID from the adaptives, if you upload the ROM image.

--

You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/b85d1acc-2726-4cab-9c0b-25a85e1ba3b3o%40googlegroups.com.

[wayne horner]

Thanks

Alandata Data Recovery -  (949)287-3282  

"Cleanroom Data Recovery of RAID, VMware, Network Attached Storage, Linux, Tape, Disk, Forensics"

www.AlanData.com   www.AlanDataRecovery.com

On Mon, Jun 29, 2020 at 5:35 PM compos mentis <pbzcbf...@gmail.com> wrote:

I might be able to extract the preamp ID from the adaptives, if you upload the ROM image.

--

[Alandata Recovery]

here is ace response...

Hello,

This drive belongs to the A1, M11 family.
This is not SSHD.
In the utility in the section of the CAP ROM, the family is erroneously specified.
Changing the head map is not available.
Preamp code from ROM is not available.
You can watch the preamp code on a working drive with the command "Ctrl+L".
To select a donor, you can use the recommendations from the manual on page 85
Before using the donor, it is recommended to remove the original heads and examine the sliders under a microscope in reflected light.
If there is damage on the sliders, there is no point in changing the heads, the donor heads will also be damaged.

----------------
Best regards,
Garry
Technical Support Engineer
ACE Lab 

 

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/CAJEn65rGmbs%3DB_%3Dg%2BYgOJ1rKxJtN9DerpKOHj7r916M3hymcLQ%40mail.gmail.com.

--

Alandata Data Recovery -  (949)287-3282  

[Steve]

Pretty much what Carlos said. 

I've done a couple of these, and every time I've hit the dreaded "slow copying" problem.  It will eventually finish, just be prepared to let it run for a month if there's a lot of data.  I've also seen these with stuck heads, and boy it's not fun to unstick them. 

This is basically just like the Rosewood drives, and to my knowledge, very few can get the preamp from the ROM. I would not say it's impossible, however.  If Franc can't help, then consider having a chat with Pepe or Doomer from HDDgurus.  

I've just used matching the serial method and date code, you should be fine doing that.  Not even worth it to search for the preamp, IMO. 

Perhaps with the new PC3K update, you can block SA writing in RAM and see what happens? I haven't had one of these since the update, so I can't comment on how that will go. 

As a side note, ApexToolLab makes some nice combs for these.

[IT LAND]

Must say that i had about 10 of those in the past few months with bad heads, 2 swaps failed due to media damage, 2 were slow copying, and the rest were imaging very good after 1 head swap and the heads lasted quite well. Also when you match the standard parameters on the sticker in most cases heads will be compatible. They are not as bad as Rosewood, Rosewoods are the incarnation of el diablo. 

[Steve]

Yeah, I agree. I meant like the Rosewoods in that you can't get the preamp. 

They're definitely not as bad, but I've seen my share of these with media damage.  Not to mention, donors are $$$$ 

[IT LAND]

Gotcha Steve, yes just seeing a Rosewood freaks me out :-) 

Yes, you can't read preamp info from the ROM on both.

[Luke Coughey]

You can get the preamp from a Rosewood ROM, if it isn't the newer AF family.  You just need to know where to find it manually. 

--

You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/9aeb79fd-04f3-4a62-b534-eb9963cc57c1n%40googlegroups.com.

[IT LAND]

cheers luke, where is it located in the Rosewood ROM?

[Desert Data Recovery]

Luke is probably fast asleep by now. FWIU, if the preamp is not detected from the ROM dump info button, then the ROM data is compressed and preamp is not currently available. 

Also it is strange how Ace chose specifically to say that this particular drive is toast with debris on the sliders. I have never heard them say that before. Maybe obvious to us but even so. 

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/80f257c3-2ede-46ad-8ab1-cf4358d6ffb2n%40googlegroups.com.

[IT LAND]

Hi Tim, that's what i understood as well, but maybe there is a way to identify the preamp ver?

[compos mentis]

I haven't been able to find the preamp ID in the SAP module. I believe I know in which area it should be, but I can't narrow it down, probably because it isn't present.

Basically I've taken the "dumb" approach (as described in the following article) and zeroed out those areas which cannot possibly hold this value. For example, if there is a large section of tabular data, then this table can be excluded and replaced with zeros.

Locating the preamp ID in a Seagate F3 ROM:

[url]http://www.hddoracle.com/viewtopic.php?f=59&t=2173[/url]

I have attached the complete SAP module and one which I have partially zeroed.

https://groups.google.com/forum/#!topic/datarecoverycertification/n8QuudXZwHk

AFAICT, the preamp ID would be stored in the vicinity of the head map(s). The following example would appear to support this hypothesis, as does the Grenada example in my tute.

https://recuperodatos.com/disco/seagate-st3000dm001-1er166-pc-3000gb-595-1014

SAP
###
Addr 0................... : 0x00013C00
Addr 1................... : 0x40002000


Fam ID................... : 0x58, (Grenada)
Fam Member............... : 0x3
SN....................... : Z501L84H
Servo FW rev code........ : 0xDE58
Max head................. : 5
Seek mode................ : 2020
Flags.................... : 1A09
RRO mode................. : 0005
Preamp type.............. : 04B7
Heads polarity........... : 00 00 00 00 00 00 00 00 00 00
Logical head map......... : 00 01 02 03 04 05 06 07 08 09
Phys head maps........... : 00 01 02 03 04 05 06 07 08 09
: 00 01 02 03 04 05 06 07 08 09
: 00 01 02 03 04 05 06 07 08 09

These are the Seek mode, Flags and RRO mode words:

Offset(h) 00   02   04   06   08   0A   0C   0E


00000F80                 0020 391A 0500

These appear to be logical and/or physical head maps.

Offset(h) 00   02   04   06   08   0A   0C   0E


00001080                      0000 0100 0200 0300
00001090  0400 0500 0600 0700 0800 0900
........
000010E0                                0000 0100
000010F0  0200 0300 0400 0500 0600 0700 0800 0900
........
00001160  0000 0100 0200 0300 0400 0500 0600 0700
00001170  0800 0900

One could reasonably expect that the preamp type, if it exists, would be stored somewhere in between.

ISTR that pepe (at HDD Guru) said that certain ROMs don't store the preamp type, and that this information needs to be retrieved from the preamp itself via a Ctrl-L or some other command.

The adaptive parameters can sometimes be identified via the "I" command in terminal:

http://www.hddoracle.com/viewtopic.php?f=59&t=2173&start=20

[wayne horner]

Thanks for the anaysis !

I have another same model that works

Do you want that rom and reports for analysis?

You probably have your own to play with.

Alandata Data Recovery -  (949)287-3282  
"Cleanroom Data Recovery of RAID, VMware, Network Attached Storage, Linux, Tape, Disk, Forensics"

www.AlanData.com   www.AlanDataRecovery.com

--

You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/6a837aa0-daf6-46a2-bd93-284ef8292254o%40googlegroups.com.

[Luke Coughey]

I would share, but it is the findings of Jared at Data-Medics.  If you join his forum and seek access to the hidden section, he has it posted there.

That said, I don't feel that Rosewood preamp matters, as it is either C2 or 82.  I do find that the key for full read/write access is to match the number of heads and the Rosewood family.

I've been trying to track things when I remember to record them on my forum  here - https://www.recoveryforce.com/forums/viewtopic.php?f=12&t=537

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/CAJEn65o8Yyrwk_VUTYkLU3KnUAsdQOwRhVpYjpmELK_91%2BtUPg%40mail.gmail.com.

[compos mentis]

It would be a lot easier if you could upload the ROM and the preamp ID from the Ctrl-L output of a working drive. Then you would know what to look for. 

[compos mentis]

I'm guessing that the preamp ID may be 52 82 (or 82 52). This word is just beyond the head maps. You can see it at offset 0x11C0 in the full SAP and my edited version. 

Offset(h) 00   02   04   06   08   0A   0C   0E

000011A0  0200 0200 0000 0000 0000 0000 3504 3504
000011B0  3504 3504 3504 3504 3504 3504 3504 0003
000011C0  5282 0100 0000 0001 0215 0001 0215 0001
000011D0  0215 0001 0215 0001 0215 0001 0215 0001
000011E0  0215 0001 0215 0001 0215 0001 0215 0101

Offset(h) 00   02   04   06   08   0A   0C   0E

000011A0  0200 0200 0000 0000 0000 0000 0000 0000
000011B0  0000 0000 0000 0000 0000 0000 0000 0003
000011C0  5282 0100 0000 0000 0000 0000 0000 0000
000011D0  0000 0000 0000 0000 0000 0000 0000 0000
000011E0  0000 0000 0000 0000 0000 0000 0000 0000

[Alandata Recovery]

heres a working same model rom

and ctl_l

also read in the ram preamp area

ASCII Diag mode

F3 T>
ASCII Diag mode

TCC:001C EMCDataErr:00000011

F3 T>
M11 CheopsLiteA  SATA 2.0 RAP30.8.2 SMR 2MB Flash 150 zn zoneds
Product FamilyId: 72, MemberId: 01
HDA SN: WCK1APDS, RPM: 5527, Wedges: 178, Heads: 8, OrigHeads: A, ActiveHdMap: 00FF, Lbas: 00003ADABD42, PreampType: 84 30
Bits/Symbol: C, Symbols/UserSector: CB6, Symbols/SystemSector: CB5
PCBA SN: 0000E75237NE, Controller: CHEOPSLITE_1_0_SATA(1410), Channel: Unknown, PowerAsic: Unknown Rev 00, BufferBytes: 8000000
SF ID: EF 60, SF Part Size: 800, Flash Used: 800
Package Version: M1A1804D6.SDMA.MD0004.0001    , Package P/N: ---------, Package Global ID: 00480560,
Package Build Date: 12/27/2016, Package Build Time: 23:14:40, Package CFW Version: M1A1804D6.SDMA.MD0004.01174104.00480560.0001    ,
Package SFW1 Version: D604, Package SFW2 Version: ----, Package SFW3 Version: ----, Package SFW4 Version: ----
Controller FW Rev: 12272314, CustomerRel: 0001, Changelist: 01174104, ProdType: M1A1804.SDMAQC, Date: 12/27/2016, Time: 231440, UserId: 00480560
Servo FW Rev: D606
TCG IV Version: 30.05
Package BPN: 8
RAP FW Implementation Key: 1E, Format Rev: 0206, Contents Rev: 2B 03 13 00
Active BFW Container: 0
4K Sys Area: 1
Features:
- IOEDC enabled
- IOECC enabled
- DERP  enabled v. 6.0.00.0000000000000001
- LTTC-UDR2 disabled
- SuperParity 4.1 enabled
- Humidity Sensor disabled
- Media Cache Partition enabled
- Media Cache enabled
- Low Current Spin Up Low
- Ready Sequence Optimization enabled
- Torn Write Protection enabled
- Zone Remap enabled[PLBA:00000000 Len:00E5C366 Offset:393DF1AD][PLBA:00E5C366 Len:393DF1AD Offset:FF1A3C9A][PLBA:3A23B513 Len:00B7082F Offset:00000000][PLBA:3ADABD42 Len:00000001 Offset:00000000]
- AGB enabled
- SubRelease:0
- Critical Event Log v. 1
- FAFH 40.11 disabled
- EWP:0
- DRAM Mirror:0

--
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/fa084405-71c8-459a-8dec-85aad6eaa1abo%40googlegroups.com.

--

Alandata Data Recovery -  (949)287-3282  

[compos mentis]

Offset 0x11C0 in your latest SAP has a value of 31 84 (or 84 31).

Your text logs refer to a preamp type of 84 30, so it would appear that my guess was correct, ie the preamp type for your patient is 82 52.

Offset(h) 00   02   04   06   08   0A   0C   0E

000011A0  0000 0000 0000 0000 0000 0000 3504 3504
000011B0  3504 3504 3504 3504 3504 3504 0003 0003
000011C0  3184 0100 0000 0001 0215 0001 0215 0001

000011D0  0215 0001 0215 0001 0215 0001 0215 0001

000011E0  0215 0001 0215 0001 0215 0001 0215 0501

[Alandata Recovery]

Thanks!

If I search for serial number in the rom I find the block

at 14600

Is this the sap table

is there an address in the header that points to the sap ?

then +11c0 I find the preamp code.

Isnt there a tool that helps interpret this?

I dont see a template in the pc3k hexedit for this

--
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/0fab58ce-1cfb-495d-b4c4-97467748c503o%40googlegroups.com.

[compos mentis]

There is a tool called F3ROMExplorer that does all this:
http://www.hddoracle.com/viewtopic.php?f=22&t=2534

My tutorial explains how to identify each of the ROM components in the header.

Analysis of Seagate F3 ROM:

http://www.hddoracle.com/viewtopic.php?f=59&t=2173

[Alandata Recovery]

Awesome!

Thanks

--

You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/5763b7a9-49ff-4831-9a65-0669d51cecfbo%40googlegroups.com.

[IT LAND]

Thanks Frank, great info, just used it on the case that i'm on now.