Conner CFS420A IDE hard drive data recovery help needed - Page 1
Forum section: electronics / repair

author: poot36
author_rank: Frequent Contributor
timestamp: August 11, 2018, 07:19:00 am
content: Had a client bring in this totally dead hard drive for data recovery and have determined that the controller PCB was bad. Have swapped PCB with one from a functioning replacement drive and have swapped over the drive calibration EEPROM chip and had drive spin up and identify. The only issue is that it will only dump around 25Mb of the drive and then stop responding. Have tried using ddrescue for Linux and was able to get a clean read until the 25Mb mark and the drive would stop attempting to read and just gave read errors. Here is where it gets interesting though, using the disks program under Ubuntu I was able to start it reading a second partition on the drive (this drive has a hidden partition at the start for the computers BIOS setup program which if it is not there you have no way of accessing the BIOS in the computer, great design Compaq! The users boot partition is the second one.) and was able to also get 25Mb of the drive imaged before it stopped reading the drive. Got any idea why the drive is doing this? I believe that the main micro on the original controller PCB is what died but I am unsure due to lack of datasheets for the chips onboard that have all been rebranded. I also have serial console interface to the drive so any data from there I can provide as well. I can also get to a T> prompt from the serial terminal just like a Seagate drive.

author: Rasz
author_rank: Super Contributor
timestamp: August 12, 2018, 02:43:06 am
content: This isnt exactly a forensic/recovery forum, you might have more luck on russian/ukrainian onesor hddoracle.com / forum.hddguru.comhave you looked with mhdd? does drive this old support HPA? did it come from a computer or some special device (industrial controller of some sort)?

author: poot36
author_rank: Frequent Contributor
timestamp: August 12, 2018, 06:42:53 am
content: I have not yet looked at it with mhdd. I doubt it supports HPA due to it been from 1996 or so. It came out of a standard Compaq 2000 P1 computer with a special ISA interface card to lots of sensors. The hard drive is only 420 Mb in size. I am not sure if this fault is software or hardware related yet. The drive spins up and does not make any weard sounds.

author: tooki
author_rank: Super Contributor
timestamp: August 12, 2018, 07:42:36 pm
content: Why didn’t you send this off to a recovery specialist? Client data isn’t the right place to be learning your own recovery skills...

author: Rasz
author_rank: Super Contributor
timestamp: August 13, 2018, 12:24:49 am
content: I had ~1996 era Compaq Deskpro 2000, used it to run quite popular phpbb forum back in 2001. Bios setup was indeed on hidden ~20MB partition.2x 25MB does sound curious. 2 different partitions would eliminate mechanical head assembly problems like ribbon connection losing contact once head turns above certain angle. Maybe head assembly is overheating? and craps out after certain continuous work time? Hae you tried dumping from random spot in the middle of the drive?Quote from: tooki on August 12, 2018, 07:42:36 pmHe did track pcb for ancient drive and knew to transplant config eprom, sounds like he is a recovery specialist. Not everyone works for Krollor Gillware.

author: poot36
author_rank: Frequent Contributor
timestamp: August 13, 2018, 06:34:08 am
content: I have not yet tried to read from farther into the drive yet. I will double check the size of the recovery partition as I just noticed that when using ddrescue it got a little more then 28000Kb of data from the start of the drive so the recovery partition may only be a few Mb in size and I have not been able to read any more than that. The client is willing to go to cleanroom level if required but is wanting the data back sooner rather then later so if I can get it without needing to send it off all the better. This drive has two EEPROM chips on it, one for the main processer and one for the hard drive calibration data and error logs. I have tried it with both chips swapped over and with just the calibration/error log chip swapped over and no change in behavior. Could the calibration or error logs be so broken that it causes the drive to halt because it believes that there is something very wrong with that area of the drive and just halts all other operations because of it?

author: tooki
author_rank: Super Contributor
timestamp: August 13, 2018, 10:44:23 am
content: Quote from: Rasz on August 13, 2018, 12:24:49 amA professional recovery specialist isn’t gonna be asking questions on an electronics (not even drive recovery!) forum.I guess I have a different definition of “specialist” than you... Knowing about PCB and EPROM swapping isbasics.Meanwhile, in the time since the drive was received from the client to now, DriveSavers would probably already have the recovered data on a server, ready for the client to download.

author: tooki
author_rank: Super Contributor
timestamp: August 13, 2018, 10:46:23 am
content: Quote from: poot36 on August 13, 2018, 06:34:08 amIf time was of the essence, then you should have sent it off to professionals right away instead of dicking around with it yourself. The client could already have their data by now.

author: CJay
author_rank: Super Contributor
timestamp: August 13, 2018, 10:49:38 am
content: Conner CP drives with the 68HC11 chip onboard have a serial port located on the header pins at the other end of the PCB to the IDE/Power connectors, these give you access to 'engineering' facilities embedded in the firmware, the commands and their parameters used to be on the web.They may or may not be helpful but they will definitely allow you to trash the data irrecoverably if you get it wrong so be 100% certain you know what you're doing.

author: Rasz
author_rank: Super Contributor
timestamp: August 13, 2018, 10:35:21 pm
content: Quote from: tooki on August 13, 2018, 10:44:23 amI guess you do oil changes in Munich, LA dentist checkups, and fly to SF to update software on your laptop.Not everyone is ready to drop >2K for data, not every data recovery job is worth that much to a client.Quote from: poot36 on August 13, 2018, 06:34:08 amstop trying to read partitions, dump whole drive to an image, skipping read errorslog where errors occur, depending on physical configuration it might be a blown head, bad pcb connection, damaged platter, is it reliably unable to read past X spot, or stops reading at all after X spot. ddrescue might be too high level for the job.Quote from: poot36 on August 13, 2018, 06:34:08 amif its able to read at all itusuallyshould read the rest assuming working hardware, unless someone/something screwed with SA

author: james_s
author_rank: Super Contributor
timestamp: August 14, 2018, 12:08:17 am
content: It's entirely possible that professional data recovery is simply not worth it. I've had people bring me drives on a number of occasions so I could attempt to recover the data for them. There was an understanding going in that it may work, or it may destroy any chance of ever having it recovered. They went ahead on the reasoning that if I couldn't get the data back then it was as good as gone anyway since it wasn't worth hundreds or thousands of dollars.Sometimes I succeeded, sometimes I failed, usually I netted around 50 bucks or a case of beer, there is a place for these sort of amateur efforts. Sometimes it was school papers that could be rewritten but with considerable effort. Sometimes it was music recordings, one guy paid me to repair the drive that held his porn collection, hey who am I to judge.

author: tooki
author_rank: Super Contributor
timestamp: August 14, 2018, 12:20:23 am
content: Quote from: Rasz on August 13, 2018, 10:35:21 pmWhat a moronic reply. You know that it's not the drive manufacturers who do data recovery, right? As if that were even relevant to my point, anyway.The OP said "The client is willing to go to cleanroom level if required but is wanting the data back sooner rather then later so if I can get it without needing to send it off all the better." From this I read that a) they're willing to pay for professional data recovery, and b) time was of the essence. That's not the kind of client where you play around with it yourself. That's when you overnight FedEx the drive to DriveSavers (if you don't happen to be within driving distance of one of their offices), so that it's done a) quickly and b) without any chance of your own recovery attempts causing data loss. This isn't the time and place to be prideful, it's where you respect your client and go straight to a pro.

author: tooki
author_rank: Super Contributor
timestamp: August 14, 2018, 12:22:18 am
content: Quote from: james_s on August 14, 2018, 12:08:17 amOh, I totally agree with everything you said. It's just that the OP's description of the situation tells me this is not one of those situations: "The client is willing to go to cleanroom level if required but is wanting the data back sooner rather then later so if I can get it without needing to send it off all the better."

author: james_s
author_rank: Super Contributor
timestamp: August 14, 2018, 12:34:46 am
content: Oh, yeah that does change things somewhat. If it's worth paying a pro, I might still try a very basic low risk effort but anything you do carries some risk of making things worse.

author: poot36
author_rank: Frequent Contributor
timestamp: August 15, 2018, 06:09:04 am
content: Well mhdd refused to even test the drive erroring with been unable to read the drive in LBA mode even when I tried forcing the mode in the computers BIOS. I know the replacement PCB is good because I dumped the entirety of the replacement drive with no issues. I have decided that this is beyond my recovery level and have left a message with the client about various clean room options. Thanks for the help though.

author: amyk
author_rank: Super Contributor
timestamp: August 16, 2018, 02:13:41 am
content: That drive is old enough that it probably doesn't support LBA, but is CHS only; you need an appropriately old version of MHDD to work with those.

author: satanistik
author_rank: Contributor
timestamp: August 26, 2018, 06:35:13 am
content: I replace HDD in old Siemens Xray generator - it use 20GB HDD but original project use 200MB. Someone in production update driver and use bios parameter like Heads Cylinders ... to make disc visible to system like 200MB. Only way to clone this HDD is use main board supporting this trick. In standard auto mode, program (MSDOS based) start but stop on some reading error. I found this because when I enter to bios and click auto detect hdd, machine stop working and I must copy setting from another unit. It make similar effects - HDD work but partition system not.