Hard disk fraud: More programs, detection methods for other manufacturers
Used Seagate hard disks can be unmasked using smartmontools, other programmers are following suit. We also have tips for Toshiba and WD hard disks.
(Image: c't / ll)
The scandal surrounding used Seagate hard disks continues to grow: We are now also receiving reports from readers who purchased their drives as early as last summer. The production date and FARM values of these drives also indicate earlier use.
The smartmontools, which are available for Linux, macOS and Windows, are classic tools for detecting fraud. The command smartctl -a /dev/sd[X] provides the standard values for the runtimes, the command smartctl -l farm /dev/sd[X] the extended FARM values. The operating hours of the SMART values can be deleted; the operating hours in the FARM values, on the other hand, represent the real operating times.
Owners of a Synology NAS can access the smartmontools, but the version installed there does not yet support querying the FARM values. The installation of the newer version is quite complicated, it is easier to use the Docker image (GitHub) of a Reddit user.
Users of the SMART tool Hard Disk Sentinel can also read the FARM values of Seagate hard disks since beta version 6.20.7. Please be sure to read the instructions, as automatic detection does not take place. The result can be found together with the value from the standard SMART query in the second paragraph of the text file that the tool outputs after detecting the device-specific information.
Twisted date
The FARM values of the Seagate drives also contain the Assembly Date field. This is probably empty in some cases, but we cannot provide an explanation for this.
However, if it is filled, the output of the smartmontools is very confusing. The tool outputs values such as 1283, but there is neither a hard disk from the year 2012 nor a week 83. The explanation is simple: both digits must be swapped. 12 becomes (20)21, 83 becomes 38 – and thus a hard disk that was produced in the 38th week of 2021.
Videos by heise
Seagate without FARM values
Seagate has not implemented the FARM values for all drives. Only the Exos models and the Ironwolf and Ironwolf Pro NAS drives (and possibly the surveillance drives called SkyHawk) respond to such a query. Anyone querying a Barracuda, for example, will receive – an error message with smartctl -l farm /dev/sd[X], as with hard disks from Toshiba and Western Digital –.
It is also uncertain whether FARM detection via USB adapters works in every case; some readers report difficulties with this. In any case, it is safer to connect the disk directly to the mainboard via SATA. We would also advise against using a SATA multiplier.
Other manufacturers
It is currently not clear whether drives from Toshiba and Western Digital are also affected. The FARM values are only available from Seagate. We therefore asked Toshiba and Western Digital whether there are any other diagnostic options apart from the SMART values.
Toshiba replied quite quickly: No, apart from the usual SMART values and some additional manufacturer-specific values (such as for the helium fill level), there is no additional log data.
After more than a week, we have still not received a reply from Western Digital. However, the information available suggests that such values could exist at least for the Red and Purple model series. A few years ago, Western Digital published Device Analytics (WDDA) for integration into monitoring systems to better monitor the hard disks installed in NAS enclosures, for example. However, there are no sources, only Linux shared-objects, no reasonable API documentation – and the license is also questionable.
The programmer of the smartmontools, Christian Franke, has given us some tips on how to recognize a used hard disk with deleted SMART values. In particular, already filled logs – Self Test Log and Error Log – are a clear indication of previous use. The output of smartctl -a /dev/sd[X] should therefore show “No self-tests have been logged”, otherwise self-tests have already been performed.
However, it is better to use the command smartctl -x /dev/sd[X] to output the log. The output of the command with the -a parameter only contains the “traditional” SMART output, which does not require 48-bit ATA commands. The output of -x, however, also contains the “Extended Comprehensive Error Log”(-l xerror) and the still little-known “Device Statistics Log”(-l devstat). “Device Statistics” contains some values that may indicate long operation, such as Lifetime Power-On Reset, Power-on Hours and Logical Sectors Read/Written.
WD has another specialty that could help: The “SATA Phy Event Counters”(smartctl -x or -l sataphy) contain a “Vendor specific” counter under ID 0x8000, which apparently also records the operating time and is persistent. The crooks could also have forgotten this.
If you know of any other methods or programs that can be used to distinguish a new hard disk from a used one with deleted SMART values, please send us an e-mail.
Empfohlener redaktioneller Inhalt
Mit Ihrer Zustimmung wird hier ein externer Preisvergleich (heise Preisvergleich) geladen.
Ich bin damit einverstanden, dass mir externe Inhalte angezeigt werden. Damit können personenbezogene Daten an Drittplattformen (heise Preisvergleich) übermittelt werden. Mehr dazu in unserer Datenschutzerklärung.
(ll)
