WD45AA drive is detected as WD75AA

[Oliver Friedmann]

Hi,

I'm trying to recover the data on a WD45AA (45 GB) hard disk a friend of
mine gave me. I've seen many damaged hard disks, but this particular one
is quite interesting, because the bios (and the data lifeguard tool from
WD which is generally supposed to work without caring about any bios
options) both are detecting this drive as a WD75AA (7,5 GB).
I'm not able to access any data, but I'm wondering where the string
"WD75AA" comes from. Obviously the bios cannot contain a table of all
hard disk drive descriptors, thus the drive itself claims to be a WD75AA
(which is not true).
That brings me to the conclusion that either the controller card on the
drive is a "mass production" that can handle different WD drive types
and is internally configured (by a jumper, an eeprom or whatever) or the
drive parameters (descriptor, but also cylinders, heads and so on) are
stored within a writeable eeprom (maybe in order to be able to apply
firmwares) that is corrupted.
How can that be? Maybe a virus that writes to such a firmware, but I
doubt so, because a virus wouldn't change the model of a specific hdd
(WD45AAA to WD75AA) but just destroy any relevant firmware data. Maybe
there is an internal jumper on the inner side of the controller card
that specifies which model the controller card has to handle that has
been fallen off.
What do you guys think?

Thanks in advance,
Oliver

 

[Arno Wagner]

Hi,

I'm trying to recover the data on a WD45AA (45 GB) hard disk a
friend of mine gave me. I've seen many damaged hard disks, but this
particular one is quite interesting, because the bios (and the data
lifeguard tool from WD which is generally supposed to work without
caring about any bios options) both are detecting this drive as a
WD75AA (7,5 GB). I'm not able to access any data, but I'm wondering
where the string "WD75AA" comes from. Obviously the bios cannot
contain a table of all hard disk drive descriptors, thus the drive
itself claims to be a WD75AA (which is not true). That brings me to
the conclusion that either the controller card on the drive is a
"mass production" that can handle different WD drive types and is
internally configured (by a jumper, an eeprom or whatever) or the
drive parameters (descriptor, but also cylinders, heads and so on)
are stored within a writeable eeprom (maybe in order to be able to
apply firmwares) that is corrupted. How can that be? Maybe a virus

Sorry, but that is nonsense. A simple bit error in the eeprom is
far more likely.

that writes to such a firmware, but I doubt so, because a virus
wouldn't change the model of a specific hdd (WD45AAA to WD75AA) but
just destroy any relevant firmware data. Maybe there is an internal
jumper on the inner side of the controller card that specifies which
model the controller card has to handle that has been fallen off.
What do you guys think?

Also unlikely. Most of the drive's firmware is actually on disk.
Only the mots basic parts are on the controller card, to allot the
drive to boot itself up.

Arno

 

[Oliver Friedmann]

Also unlikely. Most of the drive's firmware is actually on disk.
Only the mots basic parts are on the controller card, to allot the
drive to boot itself up.

So is it possible then to write to this region of the disk i.e. could a
virus (or a malfunctioning "tool") overwrite this disk information so
the drive can never be used again? Or do you think the drive is just
irreversibly damaged and that's all?

Oliver

 

[Arno Wagner]

So is it possible then to write to this region of the disk i.e. could a
virus (or a malfunctioning "tool") overwrite this disk information so
the drive can never be used again? Or do you think the drive is just
irreversibly damaged and that's all?

I think the drive was just damaged by random physical event, not any
malicious software. Whether the damage is reversible, I cannot tell.
If it is reversible, then reversal will likely require intimate
knowledge of the disks internals, that is not readily available.

Arno

 

[Folkert Rienstra]

Hi,

I'm trying to recover the data on a WD45AA (45 GB) hard disk a friend of
mine gave me. I've seen many damaged hard disks, but this particular one
is quite interesting, because the bios (and the data lifeguard tool from
WD which is generally supposed to work without caring about any bios
options) both are detecting this drive as a WD75AA (7,5 GB).

I'm not able to access any data,

How about bios showing size?

but I'm wondering where the string "WD75AA" comes from.

Initial firmware, most likely.

Obviously the bios cannot contain a table of all hard disk drive descriptors,
thus the drive itself claims to be a WD75AA (which is not true).

That brings me to the conclusion that either the controller card on the

drive is a "mass production" that can handle different WD drive types

Within a model range.

and is internally configured (by a jumper, an eeprom or whatever)

Or just has a default name in eeprom for that particular product line
that is overwritten with the drivename stored on the platters.

The default name is only revealed when the drive fails to initialize.

or the drive parameters (descriptor, but also cylinders, heads and so on)
are stored within a writeable eeprom (maybe in order to be able to apply
firmwares) that is corrupted.

Likely just the drive unable to come up and load the platter stored firmware.

How can that be?

Dead R/W amp? Firmware storage area corrupted?

Maybe a virus that writes to such a firmware, but I doubt so,
because a virus wouldn't change the model of a specific hdd.
Right.

(WD45AAA to WD75AA) but just destroy any relevant firmware data.

It likely just can't read the modelname from the platters (or anything else)
so it comes back with the startup firmware stored name.

Maybe there is an internal jumper on the inner side of the controller card
that specifies which model the controller card has to handle that has been
fallen off.

What do you guys think?

It's dead.

 

[Rod Speed]

I'm trying to recover the data on a WD45AA (45 GB) hard disk
a friend of mine gave me. I've seen many damaged hard disks,
but this particular one is quite interesting, because the bios
(and the data lifeguard tool from WD which is generally
supposed to work without caring about any bios options)
both are detecting this drive as a WD75AA (7,5 GB).

I'm not able to access any data, but I'm wondering where the string
"WD75AA" comes from. Obviously the bios cannot contain a table of all
hard disk drive descriptors, thus the drive itself claims to be a
WD75AA (which is not true).

That brings me to the conclusion that either the controller card on
the drive is a "mass production" that can handle different WD drive
types and is internally configured (by a jumper, an eeprom or
whatever) or the drive parameters (descriptor, but also cylinders,
heads and so on) are stored within a writeable eeprom (maybe in order
to be able to apply firmwares) that is corrupted.

Its more common to store the basic data on the platter itself.

How can that be? Maybe a virus that writes to such a firmware, but I
doubt so, because a virus wouldn't change the model of a specific hdd
(WD45AAA to WD75AA) but just destroy any relevant firmware data.

Yes, its much more likely that the config data, wherever its stored,
has got corrupted by the failure or its fine and cant be read anymore.
It may default to WD75AA and when it cant read the config data of
the platter anymore, you see the default data.

Maybe there is an internal jumper on the inner side
of the controller card that specifies which model the
controller card has to handle that has been fallen off.

Nope, its not normally done with jumpers, essentially because
it makes a lot more sense to do it by eeprom or data on the platter.

What do you guys think?

That it cant get the config data properly anymore and is
likely defaulting to WD75AA. It may be that that still allows
some access to the data you want to recover anyway.