WD40NDZW-11BCSS1 (SpyGlass3) corrupted ROM and encrypted sectors.

307 views
Skip to first unread message

Sling Shot

unread,
Apr 24, 2025, 12:28:49 PM4/24/25
to DataRecoveryCertification
The drive spins up ok but doesn't show any ID, LBA, etc., in PC3K using the patient's USB PCB (it doesn't ID on any tools).

Parsing the ROM with Franc's tool only shows partial information (see attached .txt) 

I re-read the ROM using the programmer, and there was no difference between it and the original. I read it multiple times, and the result was the same as the original ROM every time - corrupted.

Cycling through a few donor ROM's, I found 2 (slight variants) that would allow the drive to boot correctly, timely and give full ID, LBA, and sector access. All mods test fine, T2 is good, shows correct zero data area, and everything is as expected.

However, the user data shows as encrypted, despite being connected via the patient USB PCB, but I can't fathom out why. The customer insists he hasn't encrypted or password-protected the drive, so it must be a drive error...

Does anyone know what might be happening here and how to fix it ?

TIA.



Patient_RJZ.bin
ROManalysis.txt

t...@desertdatarecovery.com

unread,
Apr 24, 2025, 12:33:46 PM4/24/25
to datarecovery...@googlegroups.com

Unfortunately with an SP3 the MCU and ROM are tied to encryption. So you need both the original ROM and MCU to decrypt the data. However I have heard recently that there may be a way to recreate the ROM. But I don’t know any additional details at this time.

 

--
Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/6e906a04-d23c-4401-971a-4719dbb8f99bn%40googlegroups.com.

Sling Shot

unread,
Apr 24, 2025, 12:44:40 PM4/24/25
to DataRecoveryCertification
Oh that is bad news, the customer will be devastated... 

Western Digital nonsense strikes again :(

Thanks for the response, though Tim 👍

pbzcbf...@gmail.com

unread,
Apr 24, 2025, 5:35:27 PM4/24/25
to DataRecoveryCertification
Can you read SA modules 0x129 or 0x130, plus 0x109, if they exist? I can recover the ROM from these modules.


t...@desertdatarecovery.com

unread,
Apr 24, 2025, 5:56:55 PM4/24/25
to datarecovery...@googlegroups.com

For the OP, 129 and 130 are normally hidden modules.

 

 

--

Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.

Sling Shot

unread,
Apr 24, 2025, 6:16:58 PM4/24/25
to DataRecoveryCertification
The only one I can see in the directory is 109 (attached) 

Even a module search in the SA doesn't bring up 129 or 130.

Not sure how else I could get at those hidden mods ?

109.rpm

t...@desertdatarecovery.com

unread,
Apr 24, 2025, 6:41:40 PM4/24/25
to datarecovery...@googlegroups.com

Depending on which version of PC3K you have, when you are backing up the resources it gives you an option to save “hidden” modules. Before that was added, there was an option to search for modules in the ‘reading modules’ drop down (I think), but its been a few years since I used it and cannot remember exactly where it was.

 

 

Sling Shot

unread,
Apr 24, 2025, 6:44:23 PM4/24/25
to DataRecoveryCertification
Yes, that option is there, just reran it, making sure that was selected but get errors for those mods:

90...................................... : Module ID 90 reading error Device Error Detected: "FM ERR HEADER II SIGNATURE INVALID"
129..................................... : Module ID 129 reading error Device Error Detected: "FM ERR HEADER II SIGNATURE INVALID"
130..................................... : Module ID 130 reading error Device Error Detected: "FM ERR HEADER II SIGNATURE INVALID"

t...@desertdatarecovery.com

unread,
Apr 24, 2025, 6:47:33 PM4/24/25
to datarecovery...@googlegroups.com

Did you change reading methods and also composite reading.

Did the drive still ID before this happened?

Sling Shot

unread,
Apr 24, 2025, 6:53:26 PM4/24/25
to DataRecoveryCertification
Hmm, this is interesting...

I've loaded up the other donor ROM, booted, drive, ran through the SA backup procedure, and it has backed up the hidden modules with no problems (see attached)

Also, put 109 in from this backup, too.

Wonder if Franc can do anything with this lot now ? 
90.rpm
109.rpm
130.rpm
129.rpm

pbzcbf...@gmail.com

unread,
Apr 24, 2025, 10:01:56 PM4/24/25
to DataRecoveryCertification
That explains a lot. I was wondering why these modules don't appear in module 0x01.

Here is my tool.

Tool to regenerate WD ROM from 0x109 and 0x129:

pbzcbf...@gmail.com

unread,
Apr 24, 2025, 10:35:39 PM4/24/25
to DataRecoveryCertification
Attached.
rom.7z

t...@desertdatarecovery.com

unread,
Apr 25, 2025, 9:59:50 AM4/25/25
to datarecovery...@googlegroups.com

Will be interesting to see if it works. I expect not, but really hope it does.

 

 

From: datarecovery...@googlegroups.com <datarecovery...@googlegroups.com> On Behalf Of pbzcbf...@gmail.com
Sent: Thursday, April 24, 2025 7:02 PM
To: DataRecoveryCertification <datarecovery...@googlegroups.com>
Subject: Re: WD40NDZW-11BCSS1 (SpyGlass3) corrupted ROM and encrypted sectors.

 

That explains a lot. I was wondering why these modules don't appear in module 0x01.

--

Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.

pbzcbf...@gmail.com

unread,
Apr 25, 2025, 11:42:53 AM4/25/25
to DataRecoveryCertification

"Works just fine fzabkar." -- @WebClaw

t...@desertdatarecovery.com

unread,
Apr 25, 2025, 11:46:32 AM4/25/25
to datarecovery...@googlegroups.com

Indeed, but I was referring to working on a SP3.

 

 

From: datarecovery...@googlegroups.com <datarecovery...@googlegroups.com> On Behalf Of pbzcbf...@gmail.com
Sent: Friday, April 25, 2025 8:43 AM
To: DataRecoveryCertification <datarecovery...@googlegroups.com>
Subject: Re: WD40NDZW-11BCSS1 (SpyGlass3) corrupted ROM and encrypted sectors.

 

--

Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.

Sling Shot

unread,
Apr 25, 2025, 1:27:02 PM4/25/25
to DataRecoveryCertification
Franc, you're a genius, it worked, flawlessly :)

You got a 'buymeacoffee' link or something so I can send you a few bucks ?

This case meant a lot to the customer, so it was a spectacular win—and I guess for the wider community, too.

😎

pbzcbf...@gmail.com

unread,
Apr 25, 2025, 1:29:54 PM4/25/25
to DataRecoveryCertification
Thanks for the feedback. I'm just curious as to how the ROM came to be corrupted. The corruption looks man-made, so I'm wondering whether some other shop messed up somehow.

t...@desertdatarecovery.com

unread,
Apr 25, 2025, 1:36:54 PM4/25/25
to datarecovery...@googlegroups.com

Well done Franc. That’s great news.

 

 

From: datarecovery...@googlegroups.com <datarecovery...@googlegroups.com> On Behalf Of pbzcbf...@gmail.com
Sent: Friday, April 25, 2025 10:30 AM
To: DataRecoveryCertification <datarecovery...@googlegroups.com>
Subject: Re: WD40NDZW-11BCSS1 (SpyGlass3) corrupted ROM and encrypted sectors.

 

Thanks for the feedback. I'm just curious as to how the ROM came to be corrupted. The corruption looks man-made, so I'm wondering whether some other shop messed up somehow.

 

--

Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.

Sling Shot

unread,
Apr 25, 2025, 1:39:32 PM4/25/25
to DataRecoveryCertification
That's interesting. 

If it was man-made, and considering the customer/contents, there's a high probability the drive went to 'IT' before it came to us.

It hadn't been to another lab though, because its casing was still well sealed.

pbzcbf...@gmail.com

unread,
Apr 25, 2025, 1:45:12 PM4/25/25
to DataRecoveryCertification
Thanks for the offer of payment. Would you consider offering your client a little discount on my behalf instead?

I recall someone (A Rubtsov?) saying that some drives spontaneously corrupt their own keys, but the specifics are hazy. Perhaps this is one of those cases?

Sling Shot

unread,
Apr 25, 2025, 1:51:24 PM4/25/25
to DataRecoveryCertification
If you're sure you don't want any money for your help here Franc, then yes, I can cut the customer a deal with some discount on your behalf 🏆

I'll also try to probe a little deeper to see who did what to it before it came to us. I'm not sure I'll get the truth, though; it rarely happens.

$300 Data Recovery

unread,
Apr 25, 2025, 5:57:33 PM4/25/25
to DataRecoveryCertification
I'm curious if extracting 1B6 from 129 and writing it to the ROM would have also fixed this. I've used this solution before when data looks encrypted (1B6 is backup encryption key). 

Sling Shot

unread,
Apr 25, 2025, 6:33:34 PM4/25/25
to DataRecoveryCertification
I'll give it a try and see what happens.

How do I get 1B6 out of 129 ?

$300 Data Recovery

unread,
Apr 25, 2025, 6:43:24 PM4/25/25
to DataRecoveryCertification
I think it's hidden in a drop-down menu after opening 129. It will say something like "extract 1B6 module."

Sling Shot

unread,
Apr 25, 2025, 6:56:12 PM4/25/25
to DataRecoveryCertification
I got 129 open in Ace's HexEdit and looked around the menu, including the plugins, but I didn't find that option.

$300 Data Recovery

unread,
Apr 25, 2025, 6:57:26 PM4/25/25
to DataRecoveryCertification
I suspect you need to be in the utility then.? 

Sling Shot

unread,
Apr 25, 2025, 7:01:22 PM4/25/25
to DataRecoveryCertification
This gets more interesting ... the ROM has now corrupted itself and the drive can't boot🤦‍♂️

I'll have to fix that up tomorrow now, but once operational again, how do I get the hidden modules to show in the utility ? 

$300 Data Recovery

unread,
Apr 25, 2025, 7:25:52 PM4/25/25
to DataRecoveryCertification
https://youtu.be/WK2P9p6Mf7s?si=qiz1FMypYd07dng2&t=3317

pbzcbf...@gmail.com

unread,
Apr 25, 2025, 9:08:20 PM4/25/25
to DataRecoveryCertification
In the original patient dump, the area 0x7c000 - 0x7cfff was filled with 0xff, ie this 0x1000-byte block was erased. Module 0x1A2 in the patient differs from the one I extracted from 0x129.

pbzcbf...@gmail.com

unread,
Apr 25, 2025, 11:07:47 PM4/25/25
to DataRecoveryCertification
Here is an alternative approach. I used module 0x129 to repair the erased 0x1000-byte block in the patient ROM dump and left everything else untouched. This means that this version should be identical with the original undamaged ROM, and it should contain the original 0x1A2 module rather than the one from 0x129.
rebuilt_ROM_patient_1A2.7z

pbzcbf...@gmail.com

unread,
Apr 25, 2025, 11:50:59 PM4/25/25
to DataRecoveryCertification
I have a hypothesis. Perhaps the ROM has an unreliable block that decays over time. After you program the ROM and power up the drive, the MCU unpacks the ROM code and loads it into SDRAM. The drive then keeps running, even while the ROM is erasing itself. It's only at the next power cycle that the MCU encounters the erased block.


Reply all
Reply to author
Forward
0 new messages