Notices by Tube🌞Time (tubetime@mastodon.social), page 6

of course it controls the head position regardless of the physical platter, so it wouldn't really be helpful unless the drive only had a single platter in it. i've never seen an actual chip soldered in here and it was completely removed in later board revisions, so i guess they never fully implemented it.

another fun one is the empty space for an EPROM and a latch chip. these weren't used to store drive firmware (as i thought before) but they store a giant lookup table of microstep values *for each individual track* so you could presumably trim individual drives to avoid bad areas on a platter.

confirmed that there are two index tracks, one at track -2 (relative to user data starting on track 0) and another on track 616 (user data ending on track 614). the D2 square wave is directly from the hall effect sensor, 2 cycles per revolution. the D1 pulses are this signal divided by 2. MCU read data is the index signal as seen by the MCU after being processed with a one-shot.

with this setup I can control the stepper from the Arduino without the drive's microcontroller interfering. then I can use the Saleae to digitize the data.

time to reverse engineer the platters themselves. what secrets can we find?

now it gets a little strange. there seems to be a secret set of 17 hidden sectors on track -1.

here is a closeup. the raw MFM data shows a square wave of 5MHz for most of it, but there is a short section (4ms long) of 1.8MHz. the one-shot acts as a primitive data separator and the MCU can then detect this index marker and reset the hall effect divider flip flop.

this will confuse the drive when it powers up. it'll eventually go find the index track on the outside edge, but only after an extended search sequence. you can't command the drive to step to track -1, so you can't overwrite that track.

to allow your computer's HDD controller to park the heads, it lets you step past the user data area end track of 614 to go all the way in to track 670. theoretically, if you mistype the BIOS # of cyls, you could try to store data here and even overwrite the inner index track!

i made a table showing the layout on the platters themselves. only head 0 has the index marker tracks. there are 2 of them, one at track -1 and the other at track 617.

oops didn't mean to leave you hanging. turns out my track numbering is off by one. this is actually track 0 and it has regular MFM data on it. i wrote a quick-and-dirty routine to convert it and it just has regular WD1010-style headers for 17 sectors.

the real reason for all this is that there's data on this ST225N (SCSI version of the drive) on the right. I want this data.

I already tried a board swap but the SCSI version stores its firmware on track -1 and -2 instead of an index signal. my hacked board should be able to handle it, though.

trying to digitize the entire drive using the Saleae. one drawback is exporting as a CSV takes f o r e v e r

wrote a crappy python program to interpret MFM data, and it seems we have some sectors. they are using a different sector header format and there seems to be a lot of corrupted data.

boards are swapped. now let's image the whole drive in about 175 seconds to a giant Saleae capture file!

the design of the ST225N is essentially an ST225 but with the data separator and controller built in. they changed the microcontroller to an 8051, and stored a bunch of the firmware on some hidden tracks.

wow there is definitely data on this drive. i'm fudging the MFM decoding to try and skip over errors.

the sector header might follow the format used by the Adaptec AIC-010 chip (which the ST-225N uses). wow, a 32-bit CRC. i wonder which one...

there are a few sectors with the drive firmware (negative cylinders) but then there appears to be real data. "DOS" might be part of some partition table scheme.

hmm there's some funny stuff in here.