Editor’s note: Seagate is one of the two major HDD (hard disk drive) manufacturers in the world. Today, many new models of Seagate HDDs such as the well-known Seagate triangle-board HDDs have a diagnostic port lock. This lock is designed to prevent non-technical persons to perform unwanted operations on the HDD firmware, and lead to data loss. However, in digital forensics, this diagnostic port lock is going to stand in our way of extracting important case data from hard drives. So today, SalvationDATA forensic experts will discuss the Seagate diagnostic port lock, so that you will know your ways around this feature in your investigations.

Computer Forensics: An Introduction of Seagate Diagnostic Port Lock

What is Seagate diagnostic port lock?

There are more and more Seagate hard drives with diagnostic port lock (also known as firmware lock). The so-called firmware lock is that the hard drives can get access to T-level, it can execute a few commands to view hard drives’ information, but cannot execute critical operational terminal commands. Under this circumstance, writing and modifying commands could not be executed; what’s more, there will return the notice of “Diagnostic Port Locked” when trying to execute terminal commands. When there is such a notice, we can confirm that there is a firmware lock.

Computer Forensics: An Introduction of Seagate Diagnostic Port Lock

How can the diagnostic port lock influence our work?

When there is a firmware lock, we cannot get access to the data of the system area nor user area. Firmware lock is set by Seagate manufactures, in order to prevent hard drives’ refurbishing. However, it will bring obstacles to data recovery and digital forensics. A hard drive with a firmware lock cannot execute most of the operational terminal commands, cannot read system file, cannot read out module list, cannot recalculate translator, etc., all these will increase the complexity to get user data.

Firmware lock features:

  1. Terminal commands cannot be executed, there will return “Diagnostic Port Locked” notice.
  2. No access to read system file, no access to load module list, no access to read modules, no access to read or write system area, no access to recalculate translator.

Currently, Seagate hard drives with firmware lock in the market mainly include DM series and LM series. It is just because the hard drive cannot read or write system files, so after the operation of recalculating translator, it will generate the malfunction of user sector access interruption due to some unnecessary defect entries in 0x35 system file in the system area. This problem is a hard nut in data recovery and digital forensics. Once a “user sector access interruption” problem has been created, there is no way to repair. Previously, we can only try to backup system files to avoid and restore the hard drives to the status before recalculating the translator, but this method cannot really solve and fix “user sector access interruption” malfunction.

Conclusion

Fortunately, with the latest update of SalvationDATA’s data recovery and digital forensics tool DRS (Data Recovery System), the Seagate diagnostic port unlock feature is now supported. In our future post, our forensic experts will guide you on how to use DRS to solve the diagnostic port lock issue and extract important evidence data. If you are interested in our forensic solutions, come and check out our website for more information. You can also go to our resource page to download our forensic products for free. We welcome you to contact us and claim your free product trial!