Some aspects of pricing policy in the field of information recovery services
Hello Habravchanam! With you again, Artem Makarov, a leading engineer at Hardmaster , specializing in various voodoo-shamanism with hard drives and flash drives.
Today I would like to talk about curious, for the uninformed person, areas in the “Data Recovery” industry in live, so to speak material. I know from experience that for a number of customers this is a real revelation.
With a short break, we received two disks, which were before us in a couple of very well-known offices that occupy the TOP-s of the profile output in search engines and positioning themselves as “Number 1”. The story, for a competitive environment, is usual, turned to them, the price did not work, they began to look for cheaper.
')
Just want to make a reservation that I will not give any specifics in the names of organizations, for two reasons. Firstly, it is not encouraged by the administration of Habr himself, and secondly, since I have long known “in the subject” and all the leading representatives of the industry personally, the appearance of any “exposure” earlier, on the pages of my blog or in articles on the site, resulted Exactly to one — within a few hours, the call to the mobile phone rang and the head of a company, conditional Vasya or Kolya, exchanging on-duty greetings, began to reproach me and insist on editing the text with the urgent requests “to remove, and then to cheat!”.
The first disc of the Seagate ST9500325AS Wyatt family, the original problem - “tired” heads. Goes out with difficulty, pours errors into the diagnostic terminal. The germoblock was opened before the disk got to us.
The second drive is Western Digital WD3200AAKS-75VYA0 of the Tornado 2D family, the initial problem is the failure of one of the four heads in the package. Hermeson also opened.
Not everyone understands why if you have to work with disks in which there was extraneous interference, then the analysis is usually paid, and the cost of work is higher (sometimes significantly). Then I will tell you why.
The first disk, Seagate, after selecting a compatible block of magnetic heads went into readiness according to the status registers (DRD and DSC bits), gave a passport when requested, but for any attempt at technological work with the drive, the microcode gave an error to the diagnostic port, followed by a “hang”.
There are such passengers who ask “you change the heads for me, and I myself consider the information”, which causes constant emotion. The fact is that after replacing the block heads, the vast majority of disks require additional measures. Due to the fact that the block of heads for a specific “can” is sufficiently unique and their “lapping” to each other goes on at the final stages of the conveyor assembly at the stage of factory self-testing, the donor block of heads even differs from the disc by one symbol in the serial , one day released "will not work perfectly. Moreover, in order to at least read something on this particular drive mentioned in the example, it is required to make edits to the microcode loaded in RAM, at the start.
A disk with “non-native” heads at the start immediately detects excessive access timings, marks them as unstable, puts them in the appropriate candidate-defect list and because of the fact that these sectors are the entire surface, the labeling process of “bad” is so exciting that the disk stops respond to external stimuli.
A less experienced engineer would not have managed this situation. It immediately became clear to me that the disc either does not read so-called. “Overlays”, i.e. technological microcode, or read, but their version is different from the version of the base microcode in the ROM.
Seagate has a full-time option to load microcode into memory via the ATA command 92h, which is used in the manufacture of a disk, for recording a scanned set of microprogram. Using this feature, you can download a “self-made” bootloader, created from modules of the hard disk compatible with the version of FirmWare.
Having done this, I discovered the full technological functionality, analyzed the service information modules and found, as I assumed, that everything is readable, but the overlay version is not compatible with the rest of the microcode. “By itself” this could not happen, the result of the unsuccessful update of the firmware by the user is the same (in this case, the overlays in the ROM are written before the so-called “pancake”, that is, on the plates). Moreover, such an operation would be meaningless from the point of view of gaining access to the user area. It is obvious that this kind of manifestation is the essence of a man-made change of microcode in order to make it impossible to restore information in a hypothetical “other place”.
With the WD disk, the situation is more fun. After replacing the block of heads, the disk is recalibrated, gives the passport, but when trying to read the user area, it gives an error code ABRT. This code, in contrast to the UNC code (uncorrectable data error), which is typical for a bad block, indicates a discrepancy between the translation tables and the actual physical geometry of the disk. Began to analyze service information.
Step one - read modules by identifier. In this case, the drive itself will check the integrity of the module based on the checksum check. And right away the bug is the id31 module, in which the translation tables have a broken checksum.
Translator module with which the disc went to work
Just in case, I reread it on ABA (the area of ​​the sectors occupied by the module, without checking the “validity”). I am convinced that the disc with donor heads actually writes (due to the difference in geometrical parameters between the donor and the original sets of heads, the recording can go at a different offset and the recorded cannot be read in the expected place). I recalculate the checksum in the broadcast module, restart power, read attempt - ABRT.
Go ahead. WD drives have the opportunity, in the event of a serious destruction of the translator tables, to recalculate them based on the factory defect list (P-List). By itself, the p-list is not important when reading data (not on all disks, but on this family). I recalculate, make sure that the contents of the id31 translator module has changed, I try to read - again ABRT.
Ok, climb further. Analyzing the contents of the factory defect list, - 0 defects are described. From the factory, the disks do not go like this :) Obviously, not only the translator is not native, but also the factory defect list is “zeroed out”.
The module of the factory defect-list is empty, only the title is registered
I look further, with the track defect list, there are also suspicions of “self-harm”.
To solve the problem, I had to consult with my colleague in the workshop, who lives in distant Simferopol. As a result, an elegant solution was found and tried, - take a factory self-test script, manually edit it, cutting off all steps, except for generating a defect-management scan from the logs (P-list, T-list), write the whole service to a known good disk -Donor, thus obtaining a kind of hardware clone, and run a trimmed script factory self-test on this clone. As a result, original defect lists were formed on the donor disk, and after recalculating the translator, a set of service microcode (modules) corresponding to the original was obtained.
P-List module after recovery
Translator module after recovery
Of course, in this case, the possibility “the disc itself has spoiled everything” is excluded. Obviously, the modules were corrupted "out of harm"
Thus, I think it is clear that instead of the initial “typical” set of information recovery measures, I had to spend a lot of extra time on non-trivial and unplanned research. From here both increase of cost of works, and the paid analysis of disks in which "dug before us".
And it is still lucky that in the previous place not very smart masters work. A smart disk would, if desired, be purely programmed, that there are no options for recovery except for obtaining the original microcode (which, of course, remained only for the “clever man” in a single copy) - would not have remained.
There is only one conclusion - before choosing a performer and applying for a service (not only in the field of DR - absolutely in all areas), you need to think three times and weigh well. Pay special attention to those who are in the TOP-10 PS and TOP contextual advertising (this often means high budgets for SEO, and a scrap price, rather than a high level of services), is critical of all these “we are the best”, “most large and the most honest.
As the old Müller used to say to the old Stirlitz - “Nobody can be trusted. I can".
Today I would like to talk about curious, for the uninformed person, areas in the “Data Recovery” industry in live, so to speak material. I know from experience that for a number of customers this is a real revelation.
With a short break, we received two disks, which were before us in a couple of very well-known offices that occupy the TOP-s of the profile output in search engines and positioning themselves as “Number 1”. The story, for a competitive environment, is usual, turned to them, the price did not work, they began to look for cheaper.
')
Just want to make a reservation that I will not give any specifics in the names of organizations, for two reasons. Firstly, it is not encouraged by the administration of Habr himself, and secondly, since I have long known “in the subject” and all the leading representatives of the industry personally, the appearance of any “exposure” earlier, on the pages of my blog or in articles on the site, resulted Exactly to one — within a few hours, the call to the mobile phone rang and the head of a company, conditional Vasya or Kolya, exchanging on-duty greetings, began to reproach me and insist on editing the text with the urgent requests “to remove, and then to cheat!”.
The first disc of the Seagate ST9500325AS Wyatt family, the original problem - “tired” heads. Goes out with difficulty, pours errors into the diagnostic terminal. The germoblock was opened before the disk got to us.
The second drive is Western Digital WD3200AAKS-75VYA0 of the Tornado 2D family, the initial problem is the failure of one of the four heads in the package. Hermeson also opened.
Not everyone understands why if you have to work with disks in which there was extraneous interference, then the analysis is usually paid, and the cost of work is higher (sometimes significantly). Then I will tell you why.
The first disk, Seagate, after selecting a compatible block of magnetic heads went into readiness according to the status registers (DRD and DSC bits), gave a passport when requested, but for any attempt at technological work with the drive, the microcode gave an error to the diagnostic port, followed by a “hang”.
Rst 0x08M
(P) SATA Reset
F3 T> V4 (for example)
LED: 000000CC FAddr: 0027245B
LED: 000000CC FAddr: 0027245B
There are such passengers who ask “you change the heads for me, and I myself consider the information”, which causes constant emotion. The fact is that after replacing the block heads, the vast majority of disks require additional measures. Due to the fact that the block of heads for a specific “can” is sufficiently unique and their “lapping” to each other goes on at the final stages of the conveyor assembly at the stage of factory self-testing, the donor block of heads even differs from the disc by one symbol in the serial , one day released "will not work perfectly. Moreover, in order to at least read something on this particular drive mentioned in the example, it is required to make edits to the microcode loaded in RAM, at the start.
A disk with “non-native” heads at the start immediately detects excessive access timings, marks them as unstable, puts them in the appropriate candidate-defect list and because of the fact that these sectors are the entire surface, the labeling process of “bad” is so exciting that the disk stops respond to external stimuli.
A less experienced engineer would not have managed this situation. It immediately became clear to me that the disc either does not read so-called. “Overlays”, i.e. technological microcode, or read, but their version is different from the version of the base microcode in the ROM.
Seagate has a full-time option to load microcode into memory via the ATA command 92h, which is used in the manufacture of a disk, for recording a scanned set of microprogram. Using this feature, you can download a “self-made” bootloader, created from modules of the hard disk compatible with the version of FirmWare.
Having done this, I discovered the full technological functionality, analyzed the service information modules and found, as I assumed, that everything is readable, but the overlay version is not compatible with the rest of the microcode. “By itself” this could not happen, the result of the unsuccessful update of the firmware by the user is the same (in this case, the overlays in the ROM are written before the so-called “pancake”, that is, on the plates). Moreover, such an operation would be meaningless from the point of view of gaining access to the user area. It is obvious that this kind of manifestation is the essence of a man-made change of microcode in order to make it impossible to restore information in a hypothetical “other place”.
With the WD disk, the situation is more fun. After replacing the block of heads, the disk is recalibrated, gives the passport, but when trying to read the user area, it gives an error code ABRT. This code, in contrast to the UNC code (uncorrectable data error), which is typical for a bad block, indicates a discrepancy between the translation tables and the actual physical geometry of the disk. Began to analyze service information.
Step one - read modules by identifier. In this case, the drive itself will check the integrity of the module based on the checksum check. And right away the bug is the id31 module, in which the translation tables have a broken checksum.
Translator module with which the disc went to work
Just in case, I reread it on ABA (the area of ​​the sectors occupied by the module, without checking the “validity”). I am convinced that the disc with donor heads actually writes (due to the difference in geometrical parameters between the donor and the original sets of heads, the recording can go at a different offset and the recorded cannot be read in the expected place). I recalculate the checksum in the broadcast module, restart power, read attempt - ABRT.
Go ahead. WD drives have the opportunity, in the event of a serious destruction of the translator tables, to recalculate them based on the factory defect list (P-List). By itself, the p-list is not important when reading data (not on all disks, but on this family). I recalculate, make sure that the contents of the id31 translator module has changed, I try to read - again ABRT.
Ok, climb further. Analyzing the contents of the factory defect list, - 0 defects are described. From the factory, the disks do not go like this :) Obviously, not only the translator is not native, but also the factory defect list is “zeroed out”.
The module of the factory defect-list is empty, only the title is registered
I look further, with the track defect list, there are also suspicions of “self-harm”.
To solve the problem, I had to consult with my colleague in the workshop, who lives in distant Simferopol. As a result, an elegant solution was found and tried, - take a factory self-test script, manually edit it, cutting off all steps, except for generating a defect-management scan from the logs (P-list, T-list), write the whole service to a known good disk -Donor, thus obtaining a kind of hardware clone, and run a trimmed script factory self-test on this clone. As a result, original defect lists were formed on the donor disk, and after recalculating the translator, a set of service microcode (modules) corresponding to the original was obtained.
P-List module after recovery
Translator module after recovery
Of course, in this case, the possibility “the disc itself has spoiled everything” is excluded. Obviously, the modules were corrupted "out of harm"
Thus, I think it is clear that instead of the initial “typical” set of information recovery measures, I had to spend a lot of extra time on non-trivial and unplanned research. From here both increase of cost of works, and the paid analysis of disks in which "dug before us".
And it is still lucky that in the previous place not very smart masters work. A smart disk would, if desired, be purely programmed, that there are no options for recovery except for obtaining the original microcode (which, of course, remained only for the “clever man” in a single copy) - would not have remained.
There is only one conclusion - before choosing a performer and applying for a service (not only in the field of DR - absolutely in all areas), you need to think three times and weigh well. Pay special attention to those who are in the TOP-10 PS and TOP contextual advertising (this often means high budgets for SEO, and a scrap price, rather than a high level of services), is critical of all these “we are the best”, “most large and the most honest.
As the old Müller used to say to the old Stirlitz - “Nobody can be trusted. I can".
Source: https://habr.com/ru/post/259229/
All Articles