Some time ago, the OS/2 Museum obtained a 10 GB Seagate ST310014ACE hard disk (IDE 3.5″ low profile). The disk was unusable because it was locked. That is, it needed an unknown password to gain access to the medium.
After a few quick searches it turned out that this problem is surprisingly common. The particular model of hard disk was used in the first generation Xbox consoles and indeed it was locked there, which meant that after taking it out of the Xbox the disk was no longer usable.
Except there is a way to unlock these drives, using a serial terminal, a special adapter, and a couple of magic commands. How does that work?
For more than 20 years, Seagate (and other) drives have provided a way to talk to the drive for diagnostic and maintenance purposes through a serial port. IDE (and SCSI) drives have more or less always had some kind of onboard microprocessor and it’s not surprising that over time, those CPUs got more powerful. Hard disks also have the unique property that they have plenty of capacity available and aren’t limited by small ROMs/flash storage. So there’s enough room for fairly complex functionality.
I do not know which vendor first came up with the idea of using almost standard serial communication with their drives but Seagate has certainly been doing that for a while. Two of the jumper pins on IDE/SATA drives can be repurposed to function as RX/TX pins.
The complication is that the drives don’t quite conform to the RS-232 standard. RS-232, being rather old (1960), uses relatively high signaling voltage, typically +/-12V in PC equipment; in fact RS-232 is probably the biggest reason why ATX power supplies still provide a -12V line.
At any rate, the Seagate drives use lower voltages for serial communication and need an appropriate converter. In 3.5″ desktop drives, there actually is 12V power, but that is a) probably not available to the drive electronics (only the motor), and b) it’s not present in 2.5″ laptop drives. Note that there are 2.5″ SATA drives which require 12V power (typically enterprise drives) but 2.5″ IDE drives simply have no way to get 12V power.
It is possible to build an adapter from scrap parts. But in recent years, such adapters are plentiful and cheap because they also happen to be needed for Arduinos and similar devices which don’t have 12V power. I ordered one called ACAMPTAR MAX3232 on Amazon for 2.16 Euro including shipping (from China, so it took a while). The adapter also comes with a very handy connector wire which needs to be attached to the drive’s RX and TX pins (as shown e.g. here):
Now, all this has been done many times before. What I did differently is that I used an USB to IDE adapter which turned to be extremely convenient. The adapter has its own power supply (I did not have it plugged into a USB port at all) and can power a desktop hard disk with a Molex connector. More than that, it also has its own power switch. The USB adapter also has a connector for 2.5″ IDE drives which I used to power the serial adapter—it won’t function without a 5V supply. After connecting the VCC pin on the serial adapter to pin 41 on the 2.5″ IDE connector, the LED on the serial adapter lit up and the drive started talking. Here’s what the mess looked like:
Here’s the connection to the drive. Note that some people claim the disk has to be jumpered as master. I was able to communicate with it when the jumper was either in the Master or in the Cable Select position.
Here’s a close-up of the adapter with the MAX3232 chip:
I used PuTTY as the terminal but more or less anything should work. Seagate drives use standard 8 data bits, 1 stop bit, and no parity; older drives such as the ST310014ACE run at 9600 baud, newer ones run at 38400 baud.
When everything is wired correctly, the drive starts communicating over the serial interface almost as soon as it’s powered up. After the drive is initialized, the terminal looks like this:
After that, it’s necessary to press Ctrl-Z to get to the T prompt and then enter the following sequence of commands, with my comments based on this and especially this document; note that the command language is case sensitive:
T>/2 (change to diagnostic command level 2)
2>S006b (seek to logical cylinder/head, i.e. track 6Bh)
2>R21,01 (read sector 21h into buffer)
2>C0,570 (copy one sector from buffer 0 to buffer 570h)
2>W20,01 (write sector 20h)
It’s not clear to me why the ‘C’ command is needed or what purpose it serves. The unlocking is achieved essentially by reading a certain sector on the disk and copying it over the preceding sector.
After that is done, the drive should be unlocked. It can be powered down, installed in a machine, and used normally. It really does work.
It is an interesting question how those commands became public knowledge (and I don’t know the answer).
It is also a question how far back this diagnostic interface goes. I confirmed that it exists on a Seagate Medalist ST32510A from 1998, even though its command set is, unsurprisingly, more limited. It worked for me on every Seagate PATA drive with an 8-pin jumper block between the power and data connectors. Older drives have different jumper blocks and may not support the serial diagnostic interface.
Newer SATA drives have the diagnostic interface as well, but I couldn’t try that because I didn’t have appropriate wiring on hand (the connectors on the wires that came with the serial converter are too thick, designed for pins with 2.54 mm pitch, but SATA drives have jumpers with 2 mm pitch and very little space around them).
At any rate… another successful hack.