Data Recovery

701675 - 771672 (256 / 512) Marn5 

UART: YES
SATA KERNEL MODE: YES 10 MINUTES
SED LOCKED NO

STANDARD WD ENCRYPTION YES

SCREWDRIVER: T6

771761 - 771692 (256 / 512) Helios, Zephyr

UART: YES
SATA KERNEL MODE: YES 15 MINUTES
SED LOCKED NO
SCREWDRIVER: T6

2060-771692-005 Rev A
Zephyr
88i9146B2 0x(7412)
ROM Data size: 256 Kb

07JUN23 : WDC WD10TMVW-11ZSMS4 (HELIOS)
Drive was clicking and beeping. Not detected. Sata converted ok. Mrb. Headsmap. Needs decryption mode with SED keys

05DEC23: WDC WD5000BMVW-11AMCS2 (Zephyr)
Drive had symptoms of slow response bug. Not detected. SATA converted ok (read/write ROM via boot rom mode). Requires decryption, autodetects ok.

771801 - 771823 Firebird

UART: YES
SATA KERNEL MODE: YES
SCREWDRIVER: T6

11Apr23:    WD7500BMVW-11S5XS0, SN WD-WXB1A8292057, Capacity : 750 GB (1 465 149 168). Drive would ID with no access to data area. Convert to Sata. MRB. Drive is reading very slowly

1Sep23: WD5000BMVW-11S5XS0, SN: WX91EC1ADRK2,Capacity : 500 GB (976 773 168). Drive would not ID with no access to data area. Convert to Sata. MRB. Had to decrypt with this Key in the task:

Drive was reading very good. Got data back.

771814 - 771820

UART: YES
SATA KERNEL MODE: YES
SCREWDRIVER: T6
Shorting Points: TV9 TV10

771859 - 771852 Sydney

23May22 HUBBLE Read USB ROM with wires. Write SATA pcb with kernel mode but SED locked. Block 30 failed. Blocked regions and RAM update ok. SRS.

771939 - 771959

771949 - 771959 or 771939 (771960 works electronically, but doesn't fit physically)

FBLITE
771961 - 771960, 771939, or 771959

UART: YES
SATA KERNEL MODE: YES

STANDARD WD ENCRYPTION YES

SCREWDRIVER: T6

771962 - 771931 or 771959 (771960 works electronically, but doesn't fit physically)

771817 - 771820

800022 (SATA)

800022(SATA)=800041(USB3.0)= 810012 (TYPC) 3T 4TB 5TB

800038 - 800025

800041 - 800022-000 (for 3Tb Boondall ) 800022-002 or 800022-003 (for 4Tb Boondall)
800041 SED SATA METHOD - 10JAN21 - SA was accessed on 4tb using 800022-002 (Non Unlocked) SATA pcb Module 30 Blocked method. Data was accessed by removing SED Techmode locked and SED mode. Created Task and Decrypted.
800041 SED USB METHOD can be bypassed with rom swap on donor 800041 pcb.
08Dec21 - Tested with SpyGlass 3TB

31Mar23 - WD40NMZW-34GX6S1: Would ID very slowly via usb. No access to SA. Read rom via USB mode. No SED in rom. Used Sata 800022-003 but would not spin. Converted USB to SATA ok. Drive has 10 heads.

9May24 - WD40NMZW-11GX6S1: was clicking,MHA swap. IDs,sounds good, MRB. SpyGlass.Could not build heads mapbut it is NOT SED locked.SATA convert with an adapter.Built heads map. Some areas were bad. Drive was exfat. Imaged the drive and scanend in rstudio. Got data back.

800041 SPYGLASS2:

SCREWDRIVER: T5
UART NO: COM PORT MODE WILL NOT WORK WITH SED LOCK
UART: YES WITHOUT SED LOCK
SED LOCKED

ROM READING PROBLEMS? TRY: IS25WD040@SOIC8 works for IS25WQ040, 25Q40EWVIG

28FEB23 - WDC WD50NDZW-11MR8S1 - HDDs ROM reading error VSC Command error: SED DRIVE LOCKED.  88i1047F0 0x(5450). Programmed 800022-002 with original and sed removed rom but doesn't work. Convert USB to sata can read sectors but very slow. Uart connects to full utility but sed locked. Uart com port mode fails. Donor unlocked rom used on usb patient pcb ok, mrb.

15FEB22 - WD40NDZW-11MR8S0 - Rom read with xeltek. 800022-002 sata used. SED tech mode was not set by default. SRS. Could not find a decryption method. Original PCB was used.
11MAR22 - WD40NDZW-11MR8S1 - No com terminal. Rom read with xeltek.

10JUL22 - Model : WDC WD40NDZW-11MR8S0, Serial : WDC-ROM SN# XYZ----, Firmware : 02.01A02, Capacity : 0 MB (1):

Drive spun up detected in Kernel mode only
Read rom via xeltek. SATA pcb would not spin drive
ROM swap to donor USB pcb. Upload LDR ok, Upload dir into RAM ok but no SA access
Convert usb to sata using adapter tool
Detects as previous methods but SED lock prevents access
Programmed donor usb pcb with regions blocked rom - not detected via usb.
Converted donor usb pcb to sata (remove caps) with regions blocked rom but SED prevents access
Probably needed head swap

800041 PEBBLEB:

SATA KERNEL MODE: YES (Connected to MHA and motor for 1 a few seconds)
SCREWDRIVER: T5

03JUN22 - WD30NMVW-11C3NS2 - Read rom with xeltek. 3TB sata board can be programmed connected with non native rom. 30 was blocked. LDR. Upload Dir into RAM. Saved modules. SRS. Disable SED. MRB. Decryption failed without user password.

30AUG22 - WD40NMZW-11GX6S1 - Full ID via usb but poor response. Sata convert. MFT very bad but drive performs ok

1 - Program donor rom with com port
2 - Enter utility with USB mode
3 - Recover data with original usb pcb. Not sure if SATA convert works yet.
4 - If data is zero filled then make task reading from utility and select bottom option VSC mode

800069 - 800066 (confirmed) or possibly 800052 (??? unconfirmed ???)

800067 - 800065 (Requires Unlocked PCB) :

SCREWDRIVER: T5
UART: ?
SATA KERNEL MODE: YES (3 MINUTES)
SED: YES (REMOVE WITH PHYSICAL CHIP PROGRAMMING)

Take care with USB pcb as it may be required for decryption. Keys stored in mcu.

Charger and Spyglass 2 version 2 encryption:

Assuming the original PCB works, this is a summary of our procedure:
1) Write the original or a compatible ROM to an unlocked PCB.
2) Backup the important firmware modules.
3) Check the integrity of the second level translator(T2).
4) Make adjustments to the firmware to stabilize the drive.
5) Modify the original USB PCB by adding a SATA connector. (https://blog.acelaboratory.com/pc-3000-hdd-how-to-solder-a-sata-adapter-to-the-usb-western-digital-drive.html)
6) Recover the data using PC-3000 SATA port + Data Extractor.

11Feb22: Soldered wires failed on com port mode. Used xeltek and wrote rom to sata pcb with module 30 blocked. Drive was immediately accessible for DA & SA.
12May22: WD20SDRW-11VUUS0 (Charger) SATA convert failed to ID drive. Unlocked pcb also failed to ID. Block 30 & Normal mode failed to upload LDR at 90%. Module ID 90 reading error. 

23Sep22: WD10SDRW-11A0XS0 (Palmer) Spin without id. SED patch rom. Would enter utility but not detect family. Convert usb to sata. Could read modules via ID but important modules were bad. LDR failed. Modify rom to access SA.

Palmer A

810003 - 800065

SCREWDRIVER: T5
UART USB-C PCB: NO
SATA KERNEL MODE: YES
SED: YES (REMOVE WITH PHYSICAL CHIP PROGRAMMING)

Silkscreen markings: E71, E72, E73, E91=E74 Above
USB Controller: asmedia ASM225CM
Marvel 88i1053-NXZ2

08AUG23 - Charger WD20SMZM-59H3FS1 USB-C. Drive would id but freezing too bad to access. Programmed sata pcb with unlocked rom. Mrb. Data access. Drive has bad sectors.

810033 (88I1054) SPYGLASS 2 ULTRA: SATA 810030 (Programmable by Kernel Mode)

28OCT22 - Cracked USB pcb. Read rom via xeltek. Chip is Macronix MX25U4032E. Chip will save as 513kb with default setting. Change to 80000. Chip was not SED locked. Programmed sata pcb via sata port. MRB. No data with normal mode or 2 decryption keys.

21FEB22 - 2060-810033-001 REVP0 - ROM Swap to donor USB-C PCB Sata convert detects as: WDC ROM MODEL-SPYG2ULT- Detects on USB-C with this setup but no data access.

04OCT22 - WD40NDZM-59A8KS1: USB connect fractured on pcb. Sata convert. Spyglass 2 Ultra. No spin. Detects in kernel mode with SED lock. Reprogrammed rom with unlock SED patch. Drive entered utility but no spin. LDR failed to get access.

810035 USB: SATA 810030 (88i1054)  (Programmable by Kernel Mode)

SCREWDRIVER: T5
UART: ?
SATA ADAPTER KERNEL MODE: NO SED LOCKED YES SED REMOVED
SATA KERNEL MODE: 
SED: YES (REMOVE WITH PHYSICAL CHIP PROGRAMMING)

Take care with USB pcb as it may be required for decryption. Keys stored in mcu.

800065 (SATA)

800065(SATA)=800067(USB3.0)= 810003 (TYPC) 2TB

800066 (SATA)

800066(SATA)=800069(USB3.0)= 800086 (TYPC) 1TB

810030(SATA)

810030(SATA)=810035(USB3.0)=810067(USB3.0) =810033 (TYPC) 4TB 5TB

800001(SATA)- Rembrndt

UART: UNKNOWN
SATA KERNEL MODE: UNKNOWN
SED LOCKED NO

STANDARD WD ENCRYPTION UNKNOWN

SCREWDRIVER: T8 and x1 T6 for the drive and T6 for the PCB, very strong magnet

TERMINAL

WD USB WITH 10 PINS AND SATA POWER USE MARVEL UTILITY > Boot ROM (COM Port)

24/08/2021 : WD Charger : Hardsolder wire Com Port does not work for 2060-800067-001 Rev P1

Read ROM from USB to SATA PCB

WD WITH NO CONNECTING PINS

800022 terminal port com port mode:

CONNECT COM PORT TO SATA PCB

Write ROM to SATA PCB

KERNEL MODE JUMPERS

Connect 3 jumper pins as pictured

PC USB TERMINAL 3 TX & RX PINOUT

POWER CONTROL VIA SATA FOR USB DRIVES

To control the power via sata for usb drives : Connect the USB drive to Adapter PC USB 3.0.

1. Connect SATA power cable from PC3000 to the adapter and a cable that we use for terminal on another end.
2. Connect hard drive via USB 3 cable to the Adapter PC USB 3.0.
3. Turn on the power via pc3000 from selected port of sata power cable.
4. Hard drive should appear in the disk management or file explorer.

How to perform a hot swap

When the patient drive has a damaged service area that cannot be repaired (e.g. because the SA heads can't write), we can take a drive from the same family with a matching heads map (and close enough adaptives) and write the patient's SA resources to it. Then we can initialise the MCU/RAM using the repaired SA on the donor drive, swap the PCB, and gain access to data on the patient.

• get required patient resources (rom, SA modules)
• backup donor resources so drive can be restored
• modify adaptives in donor rom (module 47)
• exit utility, repower drive and start utility
• write patient DIR to donor by ID
• exit utility, repower drive and start utility
• will likely need to upload ldr (modules 5C and 11 should suffice)
• write the rest of the modules by ID (don't write mod 01)
• write patient rom to donor board (might need to adjust adaptives again)
• exit utility, repower drive
• start utility, upload ldr from patient profile and choose to load resources from profile
• rewrite mod 01
• exit utility, repower drive and start utility
• we get full ID of patient drive
• send standby command, wait for motor to stop (make sure the drive doesn't spin up again!!! don't want to cause stiction)
• physically swap the PCB to the patient drive
• send recalibration command
• access the data