Seagate Malfunctions (Barracuda IV, V and 7200.7)

A very common flaw is disruption of protective diode along the +12V circuit and resulting outage of the computer power supply unit. In that case the external look of that component does not allow identification of the damage, because its case remains unaffected. An attempt to connect a drive so damaged to an operable power supply for diagnostics will most likely result in breakdown of the latter. Therefore if such a drive is brought for repair then first of all you should probe the 0 and +12 V circuit with a regular tester to check for a short circuit.

The protective diode originally designed using the “transil” technology at SGS Thomson is intended for protection of electronic circuitry from short power supply peaks not greater than 10 – 20 microseconds. But in that case their common failures demonstrate that HDD designers did not expect to encounter so poor quality of power supply units. Thus drive operation can be resumed after simple removal of that damaged element from its circuits but we cannot guarantee flawless HDD operation without that component.

Read More

SSD Flash Hard Drives Data Recovery Video

How Solid State Flash Hard Drives work and how to rebuild them for data recovery. This presentation was at Shmoocon 2008 given by Forensic Expert Scott Moulton from My Hard Drive Died, and Forensic Strategy Services.
Part 1:httpv://www.youtube.com/watch?v=l4hbdZFWGog
Part 2:httpv://www.youtube.com/watch?v=mglEnIPnzjo
Part 3:httpv://www.youtube.com/watch?v=3psy_d-pyNg
Part 4:httpv://www.youtube.com/watch?v=pKeZvhDd5c4
Part 5:httpv://www.youtube.com/watch?v=9XMBdDypSO4
Part 6:httpv://www.youtube.com/watch?v=LY36SWbfQg0

Read More

Advanced Hard Drive Data Recovery Video

New different material! This is a new video on advanced data recovery by Scott A. Moulton. This is from August 2007 at Defcon 15 on how to do your own hard drive recovery.
Part 1: httpv://www.youtube.com/watch?v=vCapEFNZAJ0
Part 2: httpv://www.youtube.com/watch?v=w2FGKD4u8TU
Part 3: httpv://www.youtube.com/watch?v=jAUtv6kOCGE
Part 4: httpv://www.youtube.com/watch?v=5xdboKrOllE
Part 5: httpv://www.youtube.com/watch?v=MydSI4Jv2EI

Read More

Hard Drive Recovery Video

Hard Drive Recovery presented at Toorcon by Scott Moulton of Forensic Strategy
Services, LLC. Very detailed info on rebuilding hard drives and recovery of your own data.
Part 1:httpv://www.youtube.com/watch?v=Kx-D1nJcv0k
Part 2:httpv://www.youtube.com/watch?v=Tg0Uli2_rwI
Part 3:httpv://www.youtube.com/watch?v=Cayzw1iThjM
Part 4:httpv://www.youtube.com/watch?v=1_sNdPoQdcM
Part 5:httpv://www.youtube.com/watch?v=eOvZZakhihM
Part 6:httpv://www.youtube.com/watch?v=CH6pKDsggZc
part 7:httpv://www.youtube.com/watch?v=TNhajraPuWY

Read More

IBM malfunctions

Manufacturer: IBM, drive families: DJNA, DPTA, DTLA, AVER, AVVA
Malfunction signs: A drive spins up the spindle motor, recalibrates itself, reports on readiness, BIOS identifies it correctly but at a reading attempt the drive produces “scratching” sounds and reveals numerous BAD sectors on its surfaces.

That malfunction is connected with a mismatch between the cyclical redundancy check code in the data fields and the information recorded in the sector service field. Such a situation appears when recording to a sector is unfinished. That may result from lack of contact at the connector between the PCB and HDA. That connector consists of needle-like pins touching tinned pads on the PCB (please see figure 11). With time soft solder becomes perforated and contact quality deteriorates.

Figure 11. Pin contacts of magnetic heads’ assembly connector in IBM drives (view from behind the PCB)

In order to repair that malfunction you should remove the control board, clean the old solder off the contact pads and cover them again using silver-based solder, then carefully wash the soldered location. Install the board back to HDA. Then you will have to clear the whole disk surface overwriting it with any code using freely available software (please see part 4); that will accomplish recording of correct CRC codes.

Read More

Fujitsu malfunctions

Fujitsu, M1638TAU drive family
Malfunction signs: The spindle motor does not start
The connection scheme of VCM (Voice Coil Motor) & SPM (Spindle Motor) controller is practically identical for the following drive families: M1614TAU, M1638TAU, MPA30xxAT, MPB30xxAT and MPC30xxAT.

VCM&SPM controller regulates 3-phase motor; it is programmed by the MB9004 processor produced by Fujitsu. There are three modes of spindle motor control: start mode, acceleration mode and stable rotation mode. In the start mode at power-up Power Monitor (MP3771) sends a “reset” signal to the microprocessor (MB9004) and the VCM & SPM controller. Microprocessor uses a serial channel to program internal registers of VCM & SPM controller for a start and charges the pump capacitor of the controller using the “Charge pump” signal. Charge volume determines the current which will flow to the spindle motor. As soon as the start-up capacitor is charged sufficiently the microprocessor programs SPM controller for a start mode, then ~ 1,3А current flows to the spindle motor. Controller generates phase switching signals. The spindle motor at that begins rotation generating self-induced EMF. The controller detects EMF and notifies the microprocessor about that; the latter uses the signal for rotation control. In the acceleration mode the microprocessor speeds up phase switching and measures spindle motor rotational speed until it reaches 5400 RPM. When the speed is reached the controller switches to stable rotation. In that mode microprocessor calculates the time required for one spindle motor revolution on the basis of the phase signal and adjusts the rotational speed charging or discharging the pump capacitor. Adjustment control (charge/discharge) is performed every 1/6 spindle revolution.

The complexity of diagnostics is determined by the fact that SPM controller monitors EMF generated during spindle rotation and at an attempt of spindle spin-up it makes just 2 – 3 phase switches which are difficult to track using oscilloscope. If the spindle does not begin rotation (for whatever reason) the controller, as a rule, either switches off or retries its attempt after some time. Thus, if you use a regular oscilloscope, you can see only presence of pulses falling within a certain range, which is insufficient for complete diagnostics. In an ideal case we would recommend using 3-channel oscilloscope with memory function operating in the automatic recorder mode. Probably such device is not really commonplace. Therefore it is possible just to check the presence of pulses for motor phases.

VCM & SPM controller is a quite reliable microchip and it rarely goes out of order. More frequently a spindle motor does not start because of other malfunctions. Still, if the chip fails such failure is usually caused by overheating with clearly visible traces on chip case. During repair of the start circuit you should check the Stop Spindle signal from the MB3771 chip. The signal forces parking of magnetic heads and stops the spindle motor with keys Q8 and Q9. Active level of that signal in the parking mode is “1”, in the operational drive mode it is “0”. If a spindle motor begins to spin up you can check the operation of output keys of HA13525A chip controlling phase signal with oscilloscope. To do so select 10 ms/div sweep with 2V/div amplification (it is advisable to use the 1:10 multiplier). A phase may be diverted by a disrupted Q8 or Q9 key. HA13525A and HA13525B chips are compatible from top downward, i.e. in models belonging to the M1638TAU and MPA drive families both of those chips can be used. In MPB and MPC drive families only HA13525B is allowed.

Manufacturer: Fujitsu, drive families: MPB, MPC
Malfunction signs: A drive begins to detect a higher own capacity than the actual rated value, the so-called “megalomania”.

That malfunction is quite frequent in the above-mentioned drive families; it is caused by corruption of firmware in Flash ROM chip on the control board of the drive. Those drive families employ Flash ROM chips using 64К structure based on 16-bit words, programming voltage is 5 or 12 V, package type is PLCC44.

Elimination of that malfunction requires just reprogramming of Flash chip by recording a known good firmware of the corresponding version. Version number in Fujitsu drives is indicated in the lower right corner of the label over HDA below bar code and it looks like: xyy-zzzz, where x –means the month when the drive was manufactured in hexadecimal notation, yy – means version prefix and zzzz – means the actual firmware version, e.g.: С02-2009. For version compatibility in MPB and MPC drive families just the actual version match is sufficient, the prefix and month of manufacture are not important.

Manufacturer: Fujitsu, MPG3xxxAT/AH drive family
Malfunction signs: Quite unexpectedly for user and user data a drive is no longer identified in PC BIOS.

We should note that this very drive model has broken all records of failures, which happen in most cases after a year of operation, just after completion of the warranty period. The main cause of the malfunction was in the Cirrus Logic CL-SH8671-450E chip. It can hardly be replaced with a working chip because those microcircuits were produced for a special Fujitsu order and the manufacture of that drive family was discontinued long ago. However, there is a method of “revival” and “revitalizing” a malfunctioning chip which allows extending HDD life a little. However, if you ignore drive “hangings” and do not take due steps (at least backup valuable data) the table of S.M.A.R.T. logs in firmware zone will be gradually overfilled and the drive will additionally corrupt its modules in firmware zone, which cannot be restored without specialized software.

One of the versions explaining the cause of problems with those chips is the use of a new polymer compound during production of chip case. The compound decomposes under the influence of increased temperature in humid conditions producing phosphoric acid. But it is just a version; we may never learn whether it is so or not. However, one thing is known for sure: if you unsolder that chip, remove old solder from its pins and contact pads on the board, flush the location for the chip and then solder it back the drive will begin to work properly.

Read More

Quantum malfunctions (Fireball drive families)

Manufacturer: Quantum, Quantum Fireball drive families: EL, EX, CR, CX, lct08, lct10, lct15

Malfunction signs: A drive operates normally for some time (from15 minutes to several hours), then it begins to hit its positioner against the limiting stop.

It is a very frequent malfunction in those drive families, it is caused by the chip controlling the spindle motor and positioner; the chip has poor quality of factory soldering (please see the table), overheats because of that and stops to function normally.

One peculiarity of the TDA5247HT (AN8428NGAR) microchip is the availability of space for soldering in the lower part of its case acting, by the way, as its heatsink. It accomplishes heat abstraction from the chip and its dissipation along the board. Thus mounting and removal of that chip should be performed using a thermal air unit.

To repair that malfunction, you should unsolder the chip, broaden the soldering pad as shown in the figure 9 (that work can be performed using a lancet for removal of a portion of protective layer), blanch it and the lower part of the chip and solder the latter back pressing its case gently during soldering in such a manner that solder shows through board openings on the other side. Then you should carefully flush the soldered location because that chip has high-resistance analog outputs and fusing agent residue may disturb its normal operation.

That method undoubtedly improves the thermal conditions of the chip but it does not yield positive results always. If a chip used to be overheated for a long time, its resoldering does not remedy the situation. In that case the chip should be replaced. It is advisable to replace it with an identical model offered by Panasonic and having better thermal characteristics. Such chips can be purchased at stores selling electronic components. Its price may vary from 5 to 10$.

Read More

What Does It Take to Do Forensics?

Hardware
1. Become familiar with the inside of the computer
2. Understand hard drives and their settings
3. Motherboards
4. Power connections
5. Memory

Knowledge of Operating Systems and Software

Operating Systems
–Microsoft Products
–Linux RedHat
–UNIX

Software
–Forensic Software
–HTML
–Microsoft Office
–Quick View Plus

Training
1. New Technologies (NTI) in Gresham, OregonGuidance Software (Encase)Access
DataHTCIA Annual Conference
2. PatienceOne needs the ability to be able to sit in front of the computer
and analyze the data for what could be an extensive amount of time.”No such
thing as point and click forensics.”

Read More

Where Should Computer Forensics Begin?

Analysis Areas
–Email
–Temp Files
–Recycle Bin
–Info File Fragments
–Recent Link Files
–Spool (printed) files
–Internet History (index.dat)
–Registry
–Unallocated Space-free space on the hard drive
–File Slack-free space between the end of the logical file and the end of physical file (cluster)
–RAM Slack-free space between the end of the logical file and the end of the containing sector
•Sector-the smallest group that can be accessed on the disk. A group of disk sectors as assigned by the operating system are known as clusters

Read More