Conner CFS420A IDE hard drive data recovery help needed

[poot36]

Had a client bring in this totally dead hard drive for data recovery and have determined that the controller PCB was bad.  Have swapped PCB with one from a functioning replacement drive and have swapped over the drive calibration EEPROM chip and had drive spin up and identify.  The only issue is that it will only dump around 25Mb of the drive and then stop responding.  Have tried using ddrescue for Linux and was able to get a clean read until the 25Mb mark and the drive would stop attempting to read and just gave read errors.  Here is where it gets interesting though, using the disks program under Ubuntu I was able to start it reading a second partition on the drive (this drive has a hidden partition at the start for the computers BIOS setup program which if it is not there you have no way of accessing the BIOS in the computer, great design Compaq!  The users boot partition is the second one.) and was able to also get 25Mb of the drive imaged before it stopped reading the drive.  Got any idea why the drive is doing this?  I believe that the main micro on the original controller PCB is what died but I am unsure due to lack of datasheets for the chips onboard that have all been rebranded.  I also have serial console interface to the drive so any data from there I can provide as well.  I can also get to a T> prompt from the serial terminal just like a Seagate drive.

[Rasz]

This isnt exactly a forensic/recovery forum, you might have more luck on russian/ukrainian ones or hddoracle.com / forum.hddguru.com
have you looked with mhdd? does drive this old support HPA? did it come from a computer or some special device (industrial controller of some sort)?

[poot36]

I have not yet looked at it with mhdd.  I doubt it supports HPA due to it been from 1996 or so.  It came out of a standard Compaq 2000 P1 computer with a special ISA interface card to lots of sensors.  The hard drive is only 420 Mb in size.  I am not sure if this fault is software or hardware related yet.  The drive spins up and does not make any weard sounds.

[tooki]

Why didn’t you send this off to a recovery specialist? Client data isn’t the right place to be learning your own recovery skills...

[Rasz]

I had ~1996 era Compaq Deskpro 2000, used it to run quite popular phpbb forum back in 2001 . Bios setup was indeed on hidden ~20MB partition.

2x 25MB does sound curious. 2 different partitions would eliminate mechanical head assembly problems like ribbon connection losing contact once head turns above certain angle. Maybe head assembly is overheating? and craps out after certain continuous work time? Hae you tried dumping from random spot in the middle of the drive?

Why didn’t you send this off to a recovery specialist? Client data isn’t the right place to be learning your own recovery skills...

He did track pcb for ancient drive and knew to transplant config eprom, sounds like he is a recovery specialist. Not everyone works for Kroll
 or Gillware.

[poot36]

I have not yet tried to read from farther into the drive yet.  I will double check the size of the recovery partition as I just noticed that when using ddrescue it got a little more then 28000Kb of data from the start of the drive so the recovery partition may only be a few Mb in size and I have not been able to read any more than that.  The client is willing to go to cleanroom level if required but is wanting the data back sooner rather then later so if I can get it without needing to send it off all the better.  This drive has two EEPROM chips on it, one for the main processer and one for the hard drive calibration data and error logs.  I have tried it with both chips swapped over and with just the calibration/error log chip swapped over and no change in behavior.  Could the calibration or error logs be so broken that it causes the drive to halt because it believes that there is something very wrong with that area of the drive and just halts all other operations because of it?

[tooki]

Why didn’t you send this off to a recovery specialist? Client data isn’t the right place to be learning your own recovery skills...

He did track pcb for ancient drive and knew to transplant config eprom, sounds like he is a recovery specialist. Not everyone works for Kroll
 or Gillware.

A professional recovery specialist isn’t gonna be asking questions on an electronics (not even drive recovery!) forum.

I guess I have a different definition of “specialist” than you... Knowing about PCB and EPROM swapping is basics.

Meanwhile, in the time since the drive was received from the client to now, DriveSavers would probably already have the recovered data on a server, ready for the client to download.

[tooki]

The client is willing to go to cleanroom level if required but is wanting the data back sooner rather then later so if I can get it without needing to send it off all the better.

If time was of the essence, then you should have sent it off to professionals right away instead of dicking around with it yourself. The client could already have their data by now.

[CJay]

Conner CP drives with the 68HC11 chip onboard have a serial port located on the header pins at the other end of the PCB to the IDE/Power connectors, these give you access to 'engineering' facilities embedded in the firmware, the commands and their parameters used to be on the web.

They may or may not be helpful but they will definitely allow you to trash the data irrecoverably if you get it wrong so be 100% certain you know what you're doing.

[Rasz]

I guess I have a different definition of “specialist” than you... Knowing about PCB and EPROM swapping is basics.

Meanwhile, in the time since the drive was received from the client to now, DriveSavers would probably already have the recovered data on a server, ready for the client to download.

I guess you do oil changes in Munich, LA dentist checkups, and fly to SF to update software on your laptop.
Not everyone is ready to drop >2K for data, not every data recovery job is worth that much to a client.

I have not yet tried to read from farther into the drive yet.
I will double check the size of the recovery partition

stop trying to read partitions, dump whole drive to an image, skipping read errors
log where errors occur, depending on physical configuration it might be a blown head, bad pcb connection, damaged platter, is it reliably unable to read past X spot, or stops reading at all after X spot. ddrescue might be too high level for the job.

Could the calibration or error logs be so broken that it causes the drive to halt because it believes that there is something very wrong with that area of the drive and just halts all other operations because of it?

if its able to read at all it usually should read the rest assuming working hardware, unless someone/something screwed with SA

[james_s]

It's entirely possible that professional data recovery is simply not worth it. I've had people bring me drives on a number of occasions so I could attempt to recover the data for them. There was an understanding going in that it may work, or it may destroy any chance of ever having it recovered. They went ahead on the reasoning that if I couldn't get the data back then it was as good as gone anyway since it wasn't worth hundreds or thousands of dollars.

Sometimes I succeeded, sometimes I failed, usually I netted around 50 bucks or a case of beer, there is a place for these sort of amateur efforts. Sometimes it was school papers that could be rewritten but with considerable effort. Sometimes it was music recordings, one guy paid me to repair the drive that held his porn collection, hey who am I to judge.

[tooki]

I guess I have a different definition of “specialist” than you... Knowing about PCB and EPROM swapping is basics.

Meanwhile, in the time since the drive was received from the client to now, DriveSavers would probably already have the recovered data on a server, ready for the client to download.

I guess you do oil changes in Munich, LA dentist checkups, and fly to SF to update software on your laptop.
Not everyone is ready to drop >2K for data, not every data recovery job is worth that much to a client.

What a moronic reply. You know that it's not the drive manufacturers who do data recovery, right? As if that were even relevant to my point, anyway.

The OP said "The client is willing to go to cleanroom level if required but is wanting the data back sooner rather then later so if I can get it without needing to send it off all the better." From this I read that a) they're willing to pay for professional data recovery, and b) time was of the essence. That's not the kind of client where you play around with it yourself. That's when you overnight FedEx the drive to DriveSavers (if you don't happen to be within driving distance of one of their offices), so that it's done a) quickly and b) without any chance of your own recovery attempts causing data loss. This isn't the time and place to be prideful, it's where you respect your client and go straight to a pro.

[tooki]

It's entirely possible that professional data recovery is simply not worth it. I've had people bring me drives on a number of occasions so I could attempt to recover the data for them. There was an understanding going in that it may work, or it may destroy any chance of ever having it recovered. They went ahead on the reasoning that if I couldn't get the data back then it was as good as gone anyway since it wasn't worth hundreds or thousands of dollars.

Sometimes I succeeded, sometimes I failed, usually I netted around 50 bucks or a case of beer, there is a place for these sort of amateur efforts. Sometimes it was school papers that could be rewritten but with considerable effort. Sometimes it was music recordings, one guy paid me to repair the drive that held his porn collection, hey who am I to judge.

Oh, I totally agree with everything you said. It's just that the OP's description of the situation tells me this is not one of those situations: "The client is willing to go to cleanroom level if required but is wanting the data back sooner rather then later so if I can get it without needing to send it off all the better."

[james_s]

Oh, yeah that does change things somewhat. If it's worth paying a pro, I might still try a very basic low risk effort but anything you do carries some risk of making things worse.

[poot36]

Well mhdd refused to even test the drive erroring with been unable to read the drive in LBA mode even when I tried forcing the mode in the computers BIOS.  I know the replacement PCB is good because I dumped the entirety of the replacement drive with no issues.  I have decided that this is beyond my recovery level and have left a message with the client about various clean room options.  Thanks for the help though.

[amyk]

That drive is old enough that it probably doesn't support LBA, but is CHS only; you need an appropriately old version of MHDD to work with those.

[satanistik]

I replace HDD in old Siemens Xray generator - it use 20GB HDD but original project use 200MB. Someone in production update driver and use bios parameter like Heads Cylinders ... to make disc visible to system like 200MB. Only way to clone this HDD is use main board supporting this trick. In standard auto mode, program (MSDOS based) start but stop on some reading error. I found this because when I enter to bios and click auto detect hdd, machine stop working and I must copy setting from another unit. It make similar effects - HDD work but partition system not.