Search results

Okay, I was afraid that would be the answer haha. Thank you anyway, Jared! :)

Hi, I'm trying to recover data from a client's 2TB Western Digital Passport (MDL: WD20NPVT-00Z2TT0). The drive is in perfect condition physically, and I'm able to image it completely with PC-3000 software. But the data is encrypted, beyond just native WD encryption, which PC-3000 can decrypt...

Thank you Larry that script looks perfect!

So because of the way Time Machine creates hard-linked filesystems, extracting the entire backups.backupdb folder will take many more times the amount of space than it actually should since data extractor treats each backup as it's own seperate file tree and you end up with many, many...

Aah ok that explains the difficulty. Bummer, I can't use this current NAS for it then, but it will still be useful for backups. It's interesting that most of the data extractor functionality is fine. For example, I can create a task, image a drive, etc but maps and file explorer are the only...

I am migrating from local storage to a NAS, and I have the drive mounted in windows. Whenever I save images to the NAS, I get this error in PC3K, I tried googling it but couldn't find a solution. Is there any way to make Data Extractor play nicely with NAS storage? This is Windows 10 with a NFS...

Awesome thank y'all for the suggestions :)

We are looking to get better versions of some of our cleanroom tools. In particular, we have been pretty underwhelmed with our sets of tweezers. Does anybody have any they use that they particularly like? What about needle-nose pliers?

I would be greatly appreciative if you could help! I'll be in the office tomorrow (Mon) from 12:00PM to 6:00PM PST, but can make pretty much any time any weekday work after 10AMPST. I'll PM you my contact details

Based on my understanding of these drives, there's a decent chance that this would work, but of course there's only one way to know for sure :mrgreen:

I have a peculiar problem with a WD drive, I will gladly pay somebody a $50 USD bounty via paypal (or equivalent crypto if available on coinbase) if they have the correct solution. Drive model: WD5000AAKS-75V0A0 Symptoms: Clicking on startup, no ID, stuck in BSY Heads: 2 (0 and 1) What I have...

Figured it out, turns on under "Edit HDD ID" I had to disable both "drive is locked" and 'self-encrypting drive'. Problem solved :D

I have a WD40EZRX-00SPEB0 drive which is presenting with puzzling symptoms. It IDs correctly and all UA sectors give ABR error. Attempting to start utility results in PC3K thinking that the drive is ATA locked and SED locked. After disabling SA access in ROM, I was able to check modules (all...

Hi Jared, Thank you for your suggestion! I tried your fix (shorted the drive and issued a spin-down command as soon as I got terminal access). At first it just gave me a new error code, but then a minute or two later it miraculously booted up correctly and was able to ID with correct capacity...

Hey y'all, I've got a Seagate 3.5" drive that's stuck in busy. Using PC-3000 software, I was able to apply a Tech Mode Unlock, but I get an error message in the terminal: LED:00000047 FAddr:FFFFFFFE. Tried disabling File 93 via terminal and shorting the read channel. This allows momentary...

Sure, but one wouldn't want to write to the drive before imaging it in a data recovery situation

On the PC-3000 in the WD utility there is a "heads test" function under the service area menu and/or one can read/write the log modules. Is there a safe module to do this on in the HITACHI-IBM-ARM utility? What is the best way to verify heads can read and write successfully before making SA...

Same here

What kind of screws are these? I use an iFixIt toolkit for nearly all my work, and none of the heads seem to work well with these screws. They seem like PH0s but they are shallower and strip so easily. What do y'all use for this?

As I assume many of us do, I re-sell donor drives and parts (once being wiped completely!) on eBay as a secondary revenue stream. I also often buy donors this way. For those of you who buy donors there as well, how does a listing donating part of their profits to charity affect your buying...

Certainly also seeing a dip in sales here in a pretty active outbreak area of the US, expecting a "all non-essential businesses to close" order to come down the pipes soon. I got an e-mail from drivesavers saying they are now offering free faster turnaround on cases, indicating to me they are...

It looks like maybe PC-3000 doesn't support this drive model. Are you sure it's supported?

How do you deal with this request? It seems almost all recovery tools are for Windows or Linux, this is how our shop is run at least. Do you use paragon hfs+? Do you have a seperate Mac just for this purpose? Curious as to how y'all handle it. My perspective is that it is our job to recover the...

How difficult is manually applying that much pressure? Or are you using a powered one?

Welcome Juan!

It seems data extractor has a number of ways to export an image to a single-file raw image like ones created by dd, but I don't find any of them particularly reliable. Sometimes this is needed when another data recovery tool is needed for the logical portion of the recovery. Whenever the system...

Aah interesting I didn't know that. That's certainly a useful feature. Thanks friend!

Thanks for the advice, perhaps it is media damage or truly head failure. Just an odd set of symptoms.

I've got a puzzling case. It's a 1TB WD Passport drive, I swapped SATA board & ROM and am able to read with all heads except one (H0) in data extractor/sector edit. All reading modes fail with this head. But when I am in utility and do Service Area -> Head test, H0 appears to be working just...

I don't see it in the bin you uploaded, perhaps it's encoded in some other way (or not stored in ROM at all on this particular model). I would start by getting ROMS from the same model and FW and comparing them to see where they differ. Or simpler maybe just call whoever worked on this before...

It shows the whole SN in both the ROMs I checked, both at the same offset. FWIW The first hex editor I tried couldn't find it either, but the one from Ace labs does, I assume it is interpreting the data somehow.

From another F3 ROM I find it at 0x80030. You should be able to just search with a hex editor or compare to ROM from similar family/FW.

The ROM on that drive should contain the drive SN, you can check it to see if it's a native PCB.

I take it you tried swapping the boards first before doing all those head swaps? Board damage could certainly cause those symptoms and would explain why a head swap didn't fix it. Not sure if cache/nand needs to be cleared on this model or not or if doing so would destroy user data. "Ovly NOT...

Ooh good idea to check but I don't think so, other DE tasks aren't have trouble writing to that disk and I just gave it a full surface scan a few days ago. I would not have thought of this as a culprit though, I would assume DE would throw some terrifying error if it couldn't write to the target...

I have a WD10EZEX-60WN4A0 on the bench with some annoying imaging issues. In PC-3000 Marvell utility I can read all sectors flawlessly using "sector edit" but in Data Extractor there are many red sectors even after upping timeout. Even sectors which timeout in data extractor work fine in sector...

Problem: MyCloud devices don't use a simple, flat filesystem like other external drives, they store files with random-seeming names and directory structures. If your MyCloud is not functioning, you will need to read the SQLite database on the device to determine the original file structure...

Any suggestions for 2060-800022-002?

If your SSD supports it (unlikely), you can try "Read without ECC".

So I ended up getting one in case anybody else was wondering about this. Got a super good deal, but entry-level tabletop models are around $100 USD. It *is* very messy, you'll probably want a large berth for it so you can sweep around it. I think it works for our workflow but it may not work for...

I have been thinking about getting a drill press for the shop to drill holes into drives before sending them to the recycling facility. Have any of you done this? Should any tabletop drill press be able to do this or do I need to get a particularly high HP or special type of drill bit? Any help...

SIM errors often relate to issues building the translation system (so plist & NRG)

Thanks for posting this Joep, I've been looking for a more powerful jpg recovery tool. I don't have any cases in right now that need this but when I do I'll give this a shot, looks really promising!

Same revision, I tried several different boards to the same result. One test was on a regular WD Passport 4TB, the other was on a G-DRIVE (rebranded WD Passport). Who knows why some work and some don't, I'll definitely keep trying and researching though.

Update: I tried some 80022-000 boards on some 4TB drives, none of them worked :(

Whoah this is a major update, glad to see so many improvements coming down the pipe : )

I think this is mainly used by drive refurbishers but I'm curious to hear if there's other uses for it.

Linux has the readPST library so you can convert the PST to mbox or other open formats. You could then use a tool like imapsync to upload to O365 account.

On some passport boards this method doesn't work for me. I have a 800041-000 REV P1 (3TB) in front of me right now. What does work is adding a third connection from the next available pin on the HDD.

Interesting. Do you have any theories as to why this might be? I have two 4TBs in the shop right now along with some previous ones from clients that are safer to do experiments on, I'll be posting whatever those results are shortly.

Awesome thanks I'm going to run some tests with it

Has anybody tried using 800022-000 on the 4TB models?

Aah I see, short of finding a vuln in the OS I don't imagine you're getting in. Maybe they're running an old Android version with a publicly-known exploit. If not, you might be able to use a fuzzing technique to get access but then you're really getting into territory where it's probably not...

Do you mean it's locked out from too many password attempts or just that there is a lock screen with a pattern? If it's the latter and the pattern is known, a mouse/keyboard and an external monitor should get you in. I find often phones with broken screens still register touch correctly even if...

Some androids support host USB mode which you can use to attach an adapter to an HDMI out so you can see the screen on an external screen. You could also attach a mouse/keyboard this way.

Thanks for the review Larry that was really thorough and well-done. There's so much smoke-and-mirrors in the DR world, nice to see folks talking openly about things :D.

Looks like HDDGuru has some for that model for example: http://files.hddguru.com/index.php?acti ... hi-IBM&SID

Welcome Robert! People seem to be more open to sharing these days, hopefully as you learn more you'll be doing the same : ).

@Jared This should probably be added as an asterisk on the original list. Sitting in front of me right now I have a 2060-771737-000 REVA (USB, 512KB, has ROM chip in U12 and and what looks like ANOTHER ROM chip right next to it) and 2 "compatible" SATA boards. One is 2060-771692-006 REVA (256KB)...

+1 for DDrescue, I've used it on a number of damaged optical disks with good results. Remember that using different readers and/or reading speeds may be helpful. If the drive returns a "bad sector" to ddrescue, ddrescue (or any other tool without specialized reader hardware) can't make the...

I tried this method to no avail on a 2060-800041-000 REV P1, was unable to enter BOOT ROM mode. I'm not an expert at soldering but pretty sure I soldered the connections right. I notice my PC USB TERMINAL board says 3.3v instead of 5v so maybe that's the issue. Any suggestions? What is a good...

This is a translator issue, how did you regenerate the translator?

Instead of dealing with drive mapping, you can just configure the database tool to connect to a remote database with an IP, port combo. Just make sure you're keeping frequent backups!

I don't have experience doing this, but I've heard one can just mark the edge of the platter with a sharpie

What do you mean "shield" heads? Disable them?

A proper CRM is a really good idea for anybody running pretty much any kind of business. I've seen good things from SuiteCRM but I use a custom-built Drupal for this purpose. Nothing quite like having every function perfectly just the way you want it : ).

If the fusion drive can't be re-assembled then yes, I'd expect file carving to get back at least some of the data. JPGs will recover pretty well, other file formats work less well for file carving. On HFS I'd say ballpark you'd be getting back 70-80% of the JPGs but this is very dependent on...

Yes

If you select the disks and do "scan" and "search for known file types", it will show a separate item that looks like a partition called "recognized files". That's the carved files. Photorec is also a good tool for this, which is free.

If you look at a particular file's record, you should be able to see the LBA range, if it's negative or beyond the range of that particular drive, it's most certainly what I'm describing here. Luckily HFS+ doesn't fragment much (not sure about APFS), so carving works well for it. I believe all...

My guess is that the LBA's the HFS FS is saying files exist at only make sense when both drives are in the picture, hence why all the files are coming out garbage. You can always do carving.

I've done this with 4TB drives and going backwards it starts reading in a matter of seconds. Maybe you're writing to a filesystem that doesn't support sparse files like a network share? Sparse files eliminate any need to pre-allocate all the space. Well, you do pre-allocate, but instead of...

Update: The pre-filling problem doesn't happen for me. "External file" works just fine, I assume it's just making a sparse file. This is on a NTFS destination.

I had a similar case recently. R-Studio and PC-3000 RAID can both work with fusion drives, though in my case the FS/Partition table was damaged so R-studio didn't recognize it as a fusion drive. Luckily with Macs, file carving tends to work pretty well due to less fragmentation than NTFS. The...

Hot air is the way to go for removal, but for soldering yes a microsoldering pen and a microscope is the way to go

Welcome to the forums, nice to have somebody from Poland : )

Even with the encryption, chip-off will still work to recover the encrypted data. All that needs to be done is to build a translator/decrypter for it.

I've got an interesting Seagate drive (ST2000LM007-1R81754 Mobile HDD 2TB) in the shop right now, wondering if anybody else has seen the behaviour. The drive has 4 heads, 3 of which are working flawlessly, but head 3 is intermittently either giving loss of readiness or returning the same sector...

That's what I'm hoping, though I'm hoping somebody here has an example or knows the signature and I don't have to go out and buy a mac to make it

Unfortunately no, it appears whatever sectors in the catalog listed the location of this plist file are unreadable.

I have a case in the shop of a damaged drive which has Apples HFS+ encryption built-in. Unfortunately, the encryptedboot.plist.wipekey is missing from the recovery partition, but we do have the password. From what I understand, this wipekey is needed as it contains information needed to assemble...

This is a very good way to look at it, thanks for this perspective Jared!

I generally charge clients for donors at cost if they need to be ordered, how do you all charge for donors that you have in stock? I'm just now building up enough stock that I think this might happen soon, curious as to how other places handle it.

Welcome to the forums!

What are the stability issues you've encountered? I ask as there's a number of situations where I thought it would be a perfect fit for some project but I ended up doing something custom with Drupal as I didn't want to spend the time learning OO if I was going to end up having to switch to...

Wow Larry that's a beautiful system you have there! How have you liked OO Base? I've looked into it a number of times and I can't find much contemporary stuff written about it. Last I read it was kind of unstable and clunky, I take it that hasn't been your experience?

I'm curious how you all are organizing your inventory of drives. I currently am using some shelving that fits 3.5" form factor decently, with each HDD slot having a horizontal and vertical number. So for example, a HDD would be located in AZ3-4 which means "Shelving box A, column Z, row 3, drive...

Good to know thanks Jared!

Thanks!

Question on PCB swaps, I have the following boards and based on my research they can be swapped with the following boards: Board 1 2060-771801-002 REV A -> 771823 Board 2 2060-771961-001 REV B -> 771960, 771939, or 771959 My question is: Does the 001/002 or the REV number matter for donors...

Thank you! In trying the various configurations, I assumed I had to fill all the pin holes in the adapter, it wasn't until I saw your picture that I realized not all of them were full and now I have terminal access! I think I'm going to go the PCB swap route with this one, thanks for your help!

Doesn't this mean that when you plug in the USB drive to Windows, that it might automatically run a chkdsk and end up wiping a bunch of valuable data from the drive? Seems like a better route would be to have a SATA -> USB adapter so one could plug into the PC-3000 directly instead of having to...

I received a WD My Passport USB 3.0 into the shop today which as you know only has a USB port on the board. I know I can swap the PCB for a SATA board and swap the ROM chips, but I would like to avoid this if possible. I can't figure out how to get COM/Terminal access on this drive. I am a...

Model: ST31000524AS Detected Family: 3F Pharaoh Things that work: Terminal (get output) Boot code and ROM extract via terminal, no need to short pins, auto mode works just fine HDD ID and capacity correct When drive starts it outputs this to terminal Rst 0x20M RW: Disc Ctlr Initialization...

Thanks Jared and good to know about it pre-filling the spots, that's a pretty major drawback.

Is there a way to have the Data Extractor store data in raw/dd format by default? Exporting images every time is getting to be a bit dull.

Welcome to the forums, glad to have you here :)

Agreed that people should be able to set their own prices. Though I think a suggested price function would be nice, for example, it could poll historical prices for that model or the average selling price from the eBay API. It could save sellers a lot of time.

This looks really cool, I would love to have an alternative to eBay for selling donor drives.

Yep, and it sounds like it's trying to seek. It sounds more like a beep than anything, but pretty sure it falls into the "clicking" category. The motor is really quiet, honestly I can't tell that it's spinning, but I can hear the actuator arm moving around and figure it wouldn't do that if the...

I have a Seagate ST1000LM035 with is outputting this on the terminal (using a PC-3000): Low Current Spin@4@4@4@4@4@4@4@4@4@4@4@4 FAIL Servo Op=0100 Resp=0003 I am assuming this means a head or motor failure? With just the PCB attached, I'm able to extract the ROM via terminal, so I'm guessing...

This is really interesting, thanks for posting and researching this!

That's my proposal: that data recovery labs pool their resources to design some open source head swap tools which can be printed using a 3D printer. Perhaps read more carefully before you jump to judgement :D.

What would really be great is for some data recovery shops to pool resources and get some models for 3D printers made up so people can share them. There's no reason some printed plastic can't put the need for expensive head swap tools to rest.

The tutorials you've written are great for building backlinks, I know that ddrescue one of yours has been linked to from one or more places. I think if you keep that up, it's all you need.

Hello Ali, greetings from Oregon and welcome to the forum : )

This is probably more what you're looking for, creates an image of the entire storage device: https://dfir.science/2017/04/Imaging-An ... nd-dd.html

Have you tried disabling/enabling each head individually? Sounds like this could be a bad head based on my limited online research

Yep. There's some clicking, sounds like seeking to me but it's hard to tell, then the clicking/attempts stop. My guess is the head is stuck to the platter based on the terminal output. Its too quiet to hear if it's spinning specifically

You can use ddrescue to clone to a partition or file depending on what you want to do. Let's say your source drive is /dev/sda and the drive you're cloning to is /dev/sdb. You can just do: ddrescue /dev/sda /dev/sdb ddrescue.log If you want to same the clone as an image, which is my...

Welcome N0m0! Glad to have you with us : )

Thanks Jared! I believe I've watched a few of the videos you've done if you're the same Data Medics guy on Youtube, they've been super helpful for me thanks for making those : )

Aah thank you for your help on this Jared, I feel like such a dope! I've got terminal access now : ). Drive still showing as BSY. I figure there's some issue accessing the SA. I tried going to HDD Initialization -> RAM Head Map editing and cycling through heads 0-3. Each time, I put "0,0,0,0"...

For those of you who offer previews to clients where they can decide whether it's worth paying for the recovery or not, what software do you use, why do you like it or not? We're looking into a bunch of options and I would love to hear some feedback from people who have experience with various...

This model just uses a SATA -> USB adapter, so I just removed the adapter and used a direct SATA connection. The COM section is connected using the Samsung adapter which is connected to the PCB USB Terminal 2, which is then connected to the PC via a USB cable on a USB 2.0 port, and the UART...

Just wanted to introduce myself. I have been doing data recovery for 10 years (logical and ddrescue mainly) but just recently got a PC-3000 and am really diving into the more complex stuff. I'm hoping to meet some of y'all and share and learn with you. Looks like there's a lot of great knowledge...

I use the HighPoint RocketRaid series and have been very happy with those cards, you can get them used on eBay for pretty cheap.

My guess would be that the MFT or equivalent where it stored data about those folders was somehow corrupted, so your data recovery tool reported "good sectors" and those sectors were fine, but they were the wrong sectors. That would explain these symptoms. If no logical file recovery tools can...

I have a Samsung Spinpoint ST1000M024 which is stuck at BSY. Soft and hard resets seem to do nothing. It fails to identify at all. The full specs are below. Using the utility Spinpoint USB and Spinpoint M8E 2.5 HN-M101BB I'm unable to even get terminal access (using UART bridge) or detect the...