WD Scorpio Blue Platter swap advice - Page 1
Forum section: electronics / repair

author: ESXi
author_rank: Regular Contributor
timestamp: June 05, 2020, 06:41:00 pm
content: Hi there,I have a dead WD5000BEVT MFD 01 Feb 2010. PCb Rev P1 here.I think the movement actuator failed or the heads are messed up. It began with a click and bad sectors, now nothing anymore.What do I need to look after when I swap platters to a working doner disk. Luckily I can find lots of them, also the same version of PCB.Can I just swap the platters and start on the recovery process or isn't it that easy. I can make a "clean room" of my shop vac some nitrite gloves, I know its super sketchy AF but apparently the data isn't worth much so I will try to do it myself...Edit: I checked the platters with 532nm light, seems it was not a stuck head but faulty movement actuator is my guess. I see no big damage at all on the platters, I mean nothing with the naked eye at least..

author: shakalnokturn
author_rank: Super Contributor
timestamp: June 05, 2020, 08:05:28 pm
content: There are better places to ask and read than here.https://forum.acelaboratory.com/https://forum.hddguru.com/

author: ESXi
author_rank: Regular Contributor
timestamp: June 06, 2020, 03:12:54 pm
content: Quote from: shakalnokturn on June 05, 2020, 08:05:28 pmYep, thanks. I know PC-3000. Thing is just a little too expensive for my one time useGreat, I found the information I needed.https://www.donordrives.com/blog/matching-guide#wdI only wonder if I really need Micro Jogs to be with 200 of value. I found the exact same drive on eBay from a good seller. It had even the same firmware so I should be fine with a platter swap, no spi rom swap needed. I am only worried that Micro Jogs value can be out of whack and it might can do damage? Still most worried about bad aligned headsI have a few shitty drives here, let me play with them and see what happens. It really is the physical damage and the NTFS index being fuckered with, otherwise I would have been able create a image with dd and deal with it in all the time. But it's fuckered really good unfortunately.Hmm need to do more research for that. Anyways already ordered two spare boards for recovery and got a good drive now.

author: wraper
author_rank: Unknown
timestamp: June 06, 2020, 03:37:34 pm
content: Quote from: ESXi on June 06, 2020, 03:12:54 pmSwapping platters won't help you without special hardware at all. It will not result in working HDD which you can read by usual means. Also swapping heads is much safer than swapping platters which you don't normally do unless motor/bearings are bad. Not that it very likely to result in normally functioning HDD, though it probably might unlike with swapping platters. Alignment/calibration are different for each HDD. IMHO your chances for success are <1%.

author: fzabkar
author_rank: Super Contributor
timestamp: June 06, 2020, 07:06:29 pm
content: hddsurgery.com has lots of head swap video tutorials.I have written a tool to extract the microjogs from your PCB's ROM:http://www.hddoracle.com/download/file.php?id=9344Headstack matching for Western Digital:http://www.hddoracle.com/viewtopic.php?f=86&t=1036The demo version of WDMarvel can read the ROM and SA firmware from a working drive:https://wdmarvel.com/en/demo/dd is useless for imaging a drive with bad media or weak heads. Instead you need a tool which understands how to deal with such problems.http://www.sdcomputingservice.com/hddsuperclonehttp://www.gnu.org/software/ddrescue/

author: ESXi
author_rank: Regular Contributor
timestamp: June 06, 2020, 08:26:11 pm
content: Quote from: wraper on June 06, 2020, 03:37:34 pmI do understand that but how is it then that I see some people on the net get it done with really nothing at all. Is it luck or what is it?What is the safest way according to you? Change complete head assembly and movement actuator and leave the platters alone or none at all?Not saying PC-3000 is worthless or not needed. Not at all, it's just too expensive for a one time use. I know the software has it's place in the market and is required to do it properly but still. When you see some people who succeeded with nothing at all, you know it can be done (obviously not the best way to do it but hey..). If I can get ~90% of the data back, I am a happy man.Quote from: fzabkar on June 06, 2020, 07:06:29 pmThanks, wonderful! About your tool, isn't it just possible to use smartctl or smartmontools? Not sure have to read man for some switches/options. Anyhow thanks a lot. I ordered a disk that is identical 99.9% the same, also same firmware so I should be able to just swap my board to the doner drive and extract microjogs to verify. Then after that I can test SA. But if I understand correct, I still have to swap the SPI rom or isn't there anything specific that matters in the SA (Service Area)? My guess is yes? I mean the disk already got bad sectors so It needs to have this information because bad secotrs are on the platters. Anyhow the drive I ordered is like the same MDL, MFD, DCM, country of manufacture the same, date of manufacture within 20 days so should be the same. I then only have to microjogs and transfer the SPI rom to the doner and do the platter swap.Quote from: fzabkar on June 06, 2020, 07:06:29 pmI meant after physical damage is resolved. Professional recovery companies set it in debug mode or read-only mode then make a copy and continue with the disk but in case of a failure there's still a image. Well actually I am not really sure about my last sentence. I am however no data or hard disk recovery specialist at all!

author: wraper
author_rank: Unknown
timestamp: June 06, 2020, 10:50:10 pm
content: If there is more than one platter, swapping them causes guaranteed misalignment between them. Swapping heads may work well enough if you are lucky and replacement head parameters are close enough.

author: fzabkar
author_rank: Super Contributor
timestamp: June 06, 2020, 11:26:01 pm
content: You need to transfer the entire ROM or its contents from patient to donor. That's because each ROM has unique "adaptive" data.Microjogs are not a SMART parameter, so smartctl will tell you nothing. Each head has a read element and a write element. The spacing between these elements varies from head to head due to manufacturing tolerances. That's what microjogs are.See …HDD from inside: Tracks and Zones:https://hddscan.com/doc/HDD_Tracks_and_Zones.htmlAs for the firmware and "adaptives" …The hard drive -- a computer-within-a-computer:http://www.hddoracle.com/viewtopic.php?f=56&t=2600&p=20704#p19087"Adaptives" -- why a straight PCB swap doesn't work in modern hard drives:http://www.hddoracle.com/viewtopic.php?f=56&t=2600&p=20704#p19090As for imaging a failing HDD, professional data recovery companies have "hardware imagers" (eg DeepSpar) which interact with the drive at the firmware level. In this way they can stabilize the drive by disabling features such as read retries, spare reallocation, SMART, etc. These imagers can also disable selected heads, thereby enabling the good heads to be imaged.Ddrescue and HDDSuperClone don't have control at the firmware level, so they limit their retries in software, and they skip over bad patches in the media during the initial pass. On subsequent passes they try to read the more difficult sectors. HDDSuperClone can execute at least one firmware trick which stabilizes some WD drives, and it has a better understanding of "zones" than tools such as ddrescue. Both tools maintain a log, so they can be resumed after an interruption.

author: fzabkar
author_rank: Super Contributor
timestamp: June 06, 2020, 11:28:09 pm
content: Quote from: wraper on June 06, 2020, 10:50:10 pmHere is an interesting thread on this subject:Platter Swap Without Alignment Issues:https://www.recoveryforce.com/forums/viewtopic.php?f=6&t=565

author: ESXi
author_rank: Regular Contributor
timestamp: June 07, 2020, 12:10:03 am
content: Quote from: fzabkar on June 06, 2020, 11:26:01 pmBit by bit the picture is getting complete. Yes in modern drives or solid state drives MCUs have the SPI rom inside the MCU and it's a damn tiny SMD BGA chip with damn like 100+ lead free solder balls, good luck without 500 dollar microscope and skills.. All so tiny SMD stuff that's not just a swap job but need a microscope and precion tools to align the parts otherwise, no success. Back in the days it was embedded devices "glued" together now it is rather silicon dies glued together.Month or two ago I did some micro soldering practicing. Bios mod + In-system programming mod. Mod wire used = old voice coil speaker wire (VW MK3 stock speaker). Ps soldering was done without microscope. T12 C3 tip on the kock off hakko fx-951. Pretty damn good station for the money. Already repaired so much electric devices with it.

author: fzabkar
author_rank: Super Contributor
timestamp: June 07, 2020, 12:52:06 am
content: It's rare to find a HDD PCB where the flash is embedded in the MCU. In most cases the ROM code is implemented in an external 8-pin flash memory. In WD drives it is located at U12.Nice work BTW.

author: ESXi
author_rank: Regular Contributor
timestamp: June 07, 2020, 11:54:47 pm
content: Quote from: fzabkar on June 07, 2020, 12:52:06 amThat's true. But few weeks ago I opened up a 512GB SSD from Samsung.I know HDD and SSD are not completely the same(at all), but just thinking in future next generation storage devices techology. MCU blown up because of inrush current or too much ripple. NAS PSU was faulty, I told the guy don't use it anymore it can kill your drives if you're unlucky.. He called me next week 4x512gb SSDs dead.. Was not even able to put the disk in debug mode. Nothing, checked with freeze spray MCU burning away saw bright a cube burning die in the ice, nice & RIP.I still like it that almost all of them still use the external rom and nor like Apple chips that self destruct for "security reasons" with embedded roms..

author: wraper
author_rank: Unknown
timestamp: June 08, 2020, 12:11:43 am
content: Quote from: ESXi on June 07, 2020, 11:54:47 pmAlmost all of them encrypt data stored in NAND and encryption key is in controller. If controller fails, RIP the data.

author: fzabkar
author_rank: Super Contributor
timestamp: June 08, 2020, 08:04:54 am
content: Samsung SSDs typically have an e-fuse at the 5V input. It appears that it didn't do its job. :-(PCB protection devices:http://www.hddoracle.com/viewtopic.php?f=100&t=1615

author: coromonadalix
author_rank: Super Contributor
timestamp: June 08, 2020, 10:14:24 am
content: The fuse is almost the last device to blow ... never the first

author: ESXi
author_rank: Regular Contributor
timestamp: June 08, 2020, 07:25:55 pm
content: Quote from: wraper on June 08, 2020, 12:11:43 amYep even modern WD external drives they have a controller with encryption enabled by default and the encryption key can't be changed/set. I had one of these and the board not the mechanical drive failed quickly after almost no use.Almost lost some data, but was lucky that it still worked after a few tries so I quickly took important data off it. Nowadays I have better backup plans obviously. Dead drives I have nowadays are from friends, family, or just people that know me. Anyways I do still use some WD types (My Passport X) but the ones without encryption for cold storage perfect.Quote from: fzabkar on June 08, 2020, 08:04:54 amYep I know it sucked so much. MCU was burning away, here check.

author: fzabkar
author_rank: Super Contributor
timestamp: June 08, 2020, 08:54:48 pm
content: That looks like an 850 Evo:https://www.storagereview.com/review/samsung-ssd-850-evo-ssd-reviewThe SSD in the review appears to have a 5V TVS diode for protection. However, your PCB doesn't have one.Here is the 840 Evo:https://www.storagereview.com/review/samsung-840-evo-ssd-reviewThe e-fuse is in the top left corner.

author: ESXi
author_rank: Regular Contributor
timestamp: June 09, 2020, 12:05:29 am
content: Quote from: fzabkar on June 08, 2020, 08:54:48 pmThanks but I gave the drives back. Think there was not much I could do because of higher current draw with no brains even in debug mode. Seemed like a fried MCU.

author: amyk
author_rank: Super Contributor
timestamp: June 09, 2020, 03:24:34 am
content: Quote from: fzabkar on June 06, 2020, 11:28:09 pmI can't read that link (says "site blocked" --- they're blocking, not me nor my ISP) but I thought HDDs have been using embedded servo since the early 90s? Otherwise even thermal expansion/temperature gradient between the top and bottom would be enough to misalign the tracks and sectors.All I can find from searching the Internet is lots of paranoia and fearmongering; not surprising given how much $$$ the data recovery companies make... and then this one story of someone who did it:http://helios.himmelbauer-it.at/blogs/general/rescuing-data-from-a-click-of-death-harddisk-unexpected-success/Also, someone who ended up with a successful "platter replacement"!https://superuser.com/questions/1435504/after-performing-a-platter-swap-hard-drive-repair-it-seems-like-the-issue-isn

author: ESXi
author_rank: Regular Contributor
timestamp: June 09, 2020, 09:40:01 am
content: Quote from: amyk on June 09, 2020, 03:24:34 amDon't have that issue. Don't understand why your ISP would block the website it's a flat-forum bulletin board about hdd recovery..

author: ESXi
author_rank: Regular Contributor
timestamp: June 12, 2020, 01:47:45 am
content: What do you guys think about these tools?Platter swap tools:https://a.aliexpress.com/_BUFTz2Platter unlock main screw:https://a.aliexpress.com/_B0Q41O532nm green light:https://a.aliexpress.com/_BSVXvSHead assembly swap:https://a.aliexpress.com/_BUufReMissing nothing I hope?Laminar flow hood:I can get a A/C unit forward blade turbine blower, only need to cut and use some sheet metal and pop nails to make a laminar flow hood for dust free environment.PC-3000. Maybe when the market is recovery a little more. By the way nice program to get Micro Jogs from firmware module. Written in Delphi, looks like Pascal. Is there a SDK for this, or is it a hacky way of gathering the information out of the modules? Still have to check the *.bas file. Looked like the source code. Haven't really checked it.

author: fzabkar
author_rank: Super Contributor
timestamp: June 12, 2020, 09:57:35 pm
content: The headstack matching tutorial tells you exactly where the microjogs are located, at least for most WD models.Those head combs are not very well regarded, but for a one-off job you probably wouldn't want to pay for tools from hddsurgery.com or apextoollab.com.There is a good DIY laminar flow cabinet at hddguru.com (by LarrySabo), but it still costs more than you would want to pay for a one-off recovery.

author: ESXi
author_rank: Regular Contributor
timestamp: June 13, 2020, 12:15:29 am
content: Quote from: fzabkar on June 12, 2020, 09:57:35 pmAlright. Yeah I was thinking since jobs are a horror now, to start with my new part time job soon and build my own lab bit by bit. Still need a microscoop, laminar flow hood, smd reflow station, the hdd tools and PC-3000 etc and then I will try if this works out for me and start my own small repair/recovery company. If not I can still use it for my hobby or sell it after a few repairs. Big thanks for sharing your knowledge and answering my questions! I really appreciate it.

author: fzabkar
author_rank: Super Contributor
timestamp: June 13, 2020, 07:44:23 pm
content: I would suggest that you start by accumulating free and low cost tools, both software and hardware, and use these to practise on HDDs from all makes. PC$10K is a big investment which cannot be resold, at least not with a valid licence. MRT Lab have a similar tool which can be purchased on an instalment basis.Be aware that modern HDD firmware architectures (from WD and HGST) are not yet supported by PC3000, and there is no word when such support will be available.

author: ESXi
author_rank: Regular Contributor
timestamp: June 13, 2020, 09:16:34 pm
content: Quote from: fzabkar on June 13, 2020, 07:44:23 pmLicense yeah. That's always a issue, in most expensive software the DRM is what it is. I remember this from work (e-licsense, or included in the MCU), anyways this is something for when it works out well (a expensive piece of hardware with software).Quote from: fzabkar on June 13, 2020, 07:44:23 pmHm well maybe in the time when we need it some smart guy already figured out how it works, or someone leaks information that can be used for RE and repair. Same with most brands or manufacturers these days, we have to figure it out ourselves no support at all.Ps do you think these tools from AliExpress are any good might want to try spares first that I have laying around.

author: ESXi
author_rank: Regular Contributor
timestamp: June 14, 2020, 05:31:33 pm
content: Quote from: fzabkar on June 06, 2020, 07:06:29 pmWorks great, just dumped the SPI rom of a random WD3200BVVT-63A26Y0 2.5'' disk just to test it.Nice I like it, good jobjust ROManalysis.txt alone is really helpful.For whoever needs the rom in some case. I have attached it.

author: ESXi
author_rank: Regular Contributor
timestamp: June 15, 2020, 11:19:56 pm
content: Hm I really don't know where to start.. Was thinking of adding a gui and fw parameter editor.Dead end?All I can find is this information about the MrJog parameters.Also some other information, not sure how useful this is because it seems to be really old..LinkMost likely really have to JTAG into the Marvell processor and debug the thing to see if there's a easier way or by WinAPI ATA interface..I looked at WDMarv32.sys in IDA. Driver for windows sets access map for the drive. Not sure what happens then, never went deep in drivers. It needs ring0 access also load unsigned .sys file and also needs to put windows in unsigned driver state to load the home brew driver.

author: fzabkar
author_rank: Super Contributor
timestamp: June 15, 2020, 11:59:44 pm
content: That DolphinLabs article is about a Starling drive (eg WD2500BB).Analysis of the "ROM" code on a Western Digital WD2500BB-55RDA0 PCB:http://www.hddoracle.com/viewtopic.php?f=59&t=181Your drive has a slightly different firmware architecture:Analysis of the "ROM" on a Western Digital ROYL HDD:http://www.hddoracle.com/viewtopic.php?f=59&t=225I have no experience with any of the head combs, but I would think that the cheap combs should be OK for experimentation. I'm sure many DR shops use them, even if they don't admit to it.