Repair and fix SSHD hybrid ST1000LX015 FireCuda

Artem Makarov aka Robin
30.08.2020
4704 views

The brand new Seagate FireCuda hybrid drives Rosewood 8C family brought with them the same problems as the old family Seagate Kahuna drives. Despite advertising assurances, Seagate disks don't get better over time. All problems confidently move from old models to the new ones, adding with new errors along the way.

SSHD ST1000LX015 FireCuda data recovery

So, the breakdown, as in the Kahuna, is expressed in fact that when power is applied, the disk does not spin motor spindle without emitting any sounds, the BUSY status in the SATA registers, and the message is issued to the diagnostic port:

Boot 0x80M DensityList:0x0000
PrgF
LED:0x000000BD FAddr:0x000059D8

LED:0x000000BD FAddr:0x000059D8

LED:0x000000BD FAddr:0x000059D8

Seagate ST1000LX015 FireCuda fix and repair

Replacing the main board from another disk will not solve the problem, because all important parts of the microcode are in the NAND, including the ROM, and even replacing the ROM chip, HDD will not work. The best solution of this problem is re-initialize NAND from safe mode, but at the time this possibility has not yet been fully explored. Nevertheless, I found the following solution:

Read the ROM dump from a faulty storage via SDLD or via the programmer, make a changes in the one of the modules in literally a few bytes, followed by a checksum recalculation, which turn off NAND part and turning the drive into a non-hybrid type. Finding this location is not at all difficult if you compare the ROM dumps of the hybrid and non-hybrid storages by bytes. Additionally include a patch for add start interrupt after loading technological overlays. After restarting, we get the following:

Boot 0x80M!
Tech Unlock Handshake: 0x015F77F6
Reply:
Srv DETCR init 0x0000
MCMTBufferPtr->Header.MCMTHeader.MCMTExtentCount = 0x00003817
MediaTableExtentCount = 0x00003814
MCMTBufferPtr->Header.MCMTHeader.MediaCacheExtentCount = 0x00001AE0
MediaCacheExtentCount = 0x00001AE0
DensityList:0x0000
LED:0x000000BD FAddr:0x000059D8

LED:0x000000BD FAddr:0x000059D8

LED:0x000000BD FAddr:0x000059D8

Looks like nothing has changed, the disk also falls into the "LED"; nevertheless, the line "Tech Unlock Handshake" indicates that the hard drive stopped accessing the NAND chip at startup, and reads directly from the service area on the platters. Thus, it becomes clear that MCMT first flew on the disk, then all this was a double into the NAND, and the hard drive got stuck.

Further, after stopping the download on "Tech Unlock Handshake" and waiting for a "Reply", you should disable reading the microcode. This can be achieved either by short-circuiting the contact group of the reading channel on the PCB, or by short-circuiting the spindle motors points to stop the engine with parking the heads assembly and then disconnect the entire contact group to the HDA.

After waiting for the diagnostic port to be ready, we give a command to spin spindle motor up, after which via the terminal reads the FIDs of the factory defect list, the translator module and the media cache. After backing them up, we reset the media cache:

 MCInitialize: Start:  Host VBM Size (Bytes): 00000210 Metadata VBM Size (Bytes): 
 MCInitialize:  MCMTBufferPtr->Header.MCMTHeader.MediaCacheDiscStateFlags = 0000000A
 MCInitialize:  MCMTBufferPtr->Header.MCMTHeader.MCStateFlagsDisc = 00000001
 MCInitialize:  MCStateFlags = 00000001

 WB Ptr Initialization Complete
 MCInitialize: Init complete: 
ALF Parametric Tables Preserved
 WB Ptr Initialization Complete
 MCInitialize: Start:  Host VBM Size (Bytes): 00000210 Metadata VBM Size (Bytes): 
 MCInitialize:  MCMTBufferPtr->Header.MCMTHeader.MediaCacheDiscStateFlags = 0000000A
 MCInitialize:  MCMTBufferPtr->Header.MCMTHeader.MCStateFlagsDisc = 00000001
 MCInitialize:  MCStateFlags = 00000001

 MCInitialize: Start:  Host VBM Size (Bytes): 00000210 Metadata VBM Size (Bytes):   Starting LBA 007480F858, Count 00006270.
 ClearMC:  Completed, Last LBA 0074815AC8  Starting LBA 00747B05D8, Count 00052DA0.
 ClearMC:  Completed, Last LBA 0074803378
 MCInitialize:  MC Cleared 
 MCInitialize:  MCMTBufferPtr->Header.MCMTHeader.MediaCacheDiscStateFlags = 0000000A
 MCInitialize:  MCMTBufferPtr->Header.MCMTHeader.MCStateFlagsDisc = 00000001
 MCInitialize:  MCStateFlags = 00000001

 WB Ptr Initialization Complete
 MCInitialize: Init complete: 
(MC POR Duration): 00000007D9

Flash was erased and ALF Tables have successfully been initialized

and the NAND contents:

 WB Ptr Initialization Complete
 MCInitialize: Start:  Host VBM Size (Bytes): 00000210 Metadata VBM Size (Bytes): 
 MCInitialize:  MCMTBufferPtr->Header.MCMTHeader.MediaCacheDiscStateFlags = 00000022
 MCInitialize:  MCMTBufferPtr->Header.MCMTHeader.MCStateFlagsDisc = 00000001
 MCInitialize:  MCStateFlags = 00000001

 MCInitialize: Start:  Host VBM Size (Bytes): 00000210 Metadata VBM Size (Bytes):   Starting LBA 007480F858, Count 00006270.
 ClearMC:  Completed, Last LBA 0074815AC8  Starting LBA 00747B05D8, Count 00052DA0.
 ClearMC:  Completed, Last LBA 0074803378
 MCInitialize:  MC Cleared 
 MCInitialize:  MCMTBufferPtr->Header.MCMTHeader.MediaCacheDiscStateFlags = 0000000A
 MCInitialize:  MCMTBufferPtr->Header.MCMTHeader.MCStateFlagsDisc = 00000001
 MCInitialize:  MCStateFlags = 00000001

 WB Ptr Initialization Complete
 MCInitialize: Init complete: 
(MC POR Duration): 00000007DE

Flash and Parametric Table was erased and ALF Tables have successfully been initialized

and after restart HDD get ability to read user data. In case of a complete nand cache failure, to replace the electronics board with a donor's one: mcmt and nand are cleared on the donor disk, and the donor ROM is immediately written, with the disable access to the cache, after that the board can be put on the patient disk. At the first start, all important parts of the service area will be write into the new cache.

We offer service for remotely solving the same and the others problem with your storage. For detailed information, contact as at the any available way.

Write a comment
Data salvage
14 february 2024, 07:10

hello how do you make a changes in the one of the modules in literally a few bytes, followed by a checksum recalculation?

Artem Makarov aka Robin
19 february 2024, 13:09

Read module, use HEX editor for make neccessary changhes, write module