logo elektroda
logo elektroda
X
logo elektroda
Dostępna jest polska wersja

Czy wolisz polską wersję strony elektroda?

Nie, dziękuję Przekieruj mnie tam

UART in HDD - snapshot elektroda.pl

TechEkspert 24009 4

TL;DR

  • Some hard drives expose a serial UART interface next to the SATA connector for failure diagnostics and occasional defect removal, especially on Seagate and Samsung drives.
  • Connecting requires a USB UART 3.3V converter; TX and RX are found experimentally, with a 1kΩ resistor on the converter TX line for safety.
  • Typical baud rates are 9600, 38400, or 57600 bps, and Seagate access often starts with Ctrl+z before switching command levels like /2 or /3.
  • Samsung drives are more talkative at startup, showing voltage, rotational speed, temperature, test results, and parameters, but the method likely failed on the author’s WD drives.
Generated by the language model.
ADVERTISEMENT
Treść została przetłumaczona polish » english Zobacz oryginalną wersję tematu
📢 Listen (AI):
  • UART in HDD - snapshot elektroda.pl
    Some hard drives have a serial interface with pins next to the SATA connector. Basic information can be found in the topic: Seagate and Samsung HDD FAQ plus terminal - short description . Communication with the disk via the UART interface is usually used for failure diagnostics or in some cases for defect removal (e.g. the once popular problem with ST3500320AS). The connector on which the serial interface can be accessed was once used to ensure the compatibility of SATA II disks with SATA I:







    UART in HDD - snapshot elektroda.pl UART in HDD - snapshot elektroda.pl
    To connect to the disk, you will need a USB UART 3.3V converter (currently popular, among others due to Arduino). The TX HDD pin can be found experimentally, checking the next pins and waiting for the transmission to appear during the disk boot. The RX HDD pin can also be determined experimentally, for safety, including a 1k? resistor in the converter TX line. The baud rate is usually 9600 or 38400 or 57600bps.
    UART in HDD - snapshot elektroda.pl





    The diagnostic interface can also be found on old PATA drives:
    UART in HDD - snapshot elektroda.pl

    Some commands sent to the disk can damage data or the disk, so it is worth trying with a redundant hard disk.

    Seagate:
    When starting the Seagate HDD, we will usually see a short log, e.g .:
    Code: Text
    Log in, to see the code


    In the case of the Seagate HDD, we can start by sending Ctrl + z,
    then we can switch between command levels by entering "/ level_number" and enter eg / 2 second level.
    Level-independent commands such as "." Are also available. current HDD status.
    For example, on level 2 (/ 2), we can issue commands:
    Z - disk spinning is stopped
    U - start disk spin
    and - damage in the current path
    e.t.c.
    At level 3, give the command:
    b - park the heads for a moment
    D - will perform the access speed test (in random mode)
    but e.g. on level 7, issuing the same command means something different:
    D - displays the temperature
    We get the full list of commands at level C (/ C) by issuing the command:
    Q - information about ASCII commands

    For the disk under test, I received quite a substantial set of commands:

    Code: Text
    Log in, to see the code


    Here: information about the Seagate HDD terminal commands .

    There we find quite exotic commands, e.g. performing a test of the head positioning mechanism and displaying data to the Bode chart ...

    Efficient Seagate disks at startup are not too "talkative" we usually get information about the correct startup, that. firmware or disk model data, memory amount, in the case of PATA disks with jumper configuration. Sometimes there is information about the date of the firmware compilation and sometimes about the author of the software.

    Here: more information on attempts to access Samsung HDD "operating" system , and the continuation Link .

    Samsung:
    Samsung HDDs are more "talkative" during startup, we get information about the supply voltage, rotational speed temperature, test results, disk parameters, e.g .:

    Code: Text
    Log in, to see the code


    From ENG> to DBG mode> switch to Esc key, return to ENG> with GO command.

    The available commands can be obtained by typing:
    HE
    Code: Text
    Log in, to see the code


    Public command documentation is weaker for Samsung HDDs than for Seagate HDDs, for example:

    RT - reset, restart
    LB - information about HDD
    DV - firmware information
    LL - possibly sectors pending / damaged

    Checking subsequent commands without knowing them exactly may result in disk damage (eg FE - it could be eg flash erase ...).

    Why did I check this method of communication with HDD?
    This method of communication with the disk is usually used when there is a problem with the HDD. I have two machines where I cannot read SMART disks. In one case the HDDs work in a simple RAID1 handled by the motherboard controller, in the other case the HDD is hidden behind the Intel(R) Smart Response controller. I wanted to use UART communication with the disk for continuous monitoring of the disk's condition (instead of SMART). Unfortunately, in both cases, they were WD drives, which most likely did not have the UART lines on the connector next to the SATA connector.

    Cool? Ranking DIY
    About Author
    TechEkspert
    Editor
    Offline 
    TechEkspert wrote 6976 posts with rating 5419, helped 16 times. Been with us since 2014 year.
  • ADVERTISEMENT
  • #2 15933340
    spamove
    Level 10  
    Sensational post, just a comment: Samsung drives sometimes have 2x2 pins, the interface is then this:

    UART in HDD - snapshot elektroda.pl

    As for pin z *, in some (mainly older) drives it allows to force SATA I mode, in others it does nothing or does various strange things.

    Added after 2 [hours] 5 [minutes]:

    After my tests, I present an extended list of "decrypted" commands for Samsung (there may of course be errors here, plus not every drive responds to all of the same):

    HD502IJ F1_3D disk:

    HE RT RC RF PD D DS DL DB DW DI M MD MS ML MB
    MW FB FW DX SB CA DN DT DG BI SP TP RB ZM DZ LE
    PP RP FE FU EP EF RD WR SK QT QB QK QN QA QL QS
    QG QW QR QD R0 R1 XT XL XN XA XC XE XS SL OU ST
    SU SD PK UV SM SG EI WI MI PR PW IF TF RU WU TI
    TU IC TC DV LI WS CB BD BS BC GO SS NS DA DR MR
    LL LM LR LS LV LT LB LD LC L4

    * general

    Escape key - exits from ENG to DBG mode
    HE - Help (displays the above, i.e. a list of commands)

    * commands of the "R" + "PD" group (typical "service" commands)

    RT - Device reset
    RC - displays the "header" of the disk in hexadecimal (for me, after converting hex-> ASCII, you can easily find the disk name there, as well as the disk serial number and firmware revision number)
    RF - displays the firmware "header" in hexadecimal
    PD - displays a fragment of the firmware (hexadecimal) containing "IBR_SETL"

    * group commands "D" "M" "F" and similar (debugging)

    D DS DL DB DW DI
    M MD MS ML MB MW
    FB FW
    - probably access to data / firmware memory while debugging (the second letter is (?) short for Short Long Byte Word, respectively)

    DX SB CA DN DT DG BI
    WI MI PR PW TF RU WU TU IC DB BS BC SS NS DA DR MR RP - as above

    SP TP - ScriPt (possibly run scripts from memory)

    ZM - "CmdZeroMC" (NOTE: I did "reset" the firmware)

    PP - runs something (?)

    FE - Flash Erase (turns HDD into an avant-garde paperweight; not recommended)

    TF RU WU RB SM EI TU DZ LE -? (I think I have NOP)

    IF - executes "InitMcfs"
    TI - displays various information regarding the execution of firmware code (flags, code address, stack pointer, etc.)
    LI - next command treats as an array, and does something with it ("EPOK"?)
    WS - displays "DONE", so it * does * something.
    BD - displays active breakpoints for firmware debugging
    GO - exits from DBG to ENG mode

    DV - I have NOP (after TechEkspert I say that in other drives it may display information about the firmware)

    * commands of the "X" group (mechanical tests and setting their parameters)

    XT parameter - without a parameter displays the possible "CLASS OF SERVO MEASUREMENT", with the parameter sets the desired value
    XA - Equivalent to XT 10, sets HEAD_MISALLIGN test mode
    XN - Equivalent to XT 80, sets test mode NOTCH_ID
    XE - Equivalent to XT 4, sets SEEK_TIME test mode
    XC - runs the "servo spin Current test"
    XL - runs the "servo Latch force test" (I do not recommend running it too long, especially on older drives)
    XS - runs the "Servo head Stiction test"

    * commands related to "X" commands (mechanical commands)

    SL - runs "Servo Latch force test" in old Samsung phones (I have the message "Latch force measurement command is changed from SL to XL")
    OU - park and Unlatch (first one, then another)
    ST - Servo STatus (HDD servo status)
    SD - Disk SpinDown
    SU - Disk SpinUp
    PK - ParK (parks the disc head)
    UV - Unlatch the disk head

    * various commands

    R0 - displays the value "erase Rcc @ SrvC / H"
    R1 - displays the value "write Rcc @ SrvC / H"
    SG - displays possible "CLASS OF SERVO SCANGRAY OPTION", but apparently takes no parameter

    * group commands "L" ("List")

    LL LM LR LS LV LT - "Number of defects" + list of "defects", the second letter in the command is the defect type
    LB - various info about HDD (e.g. serial, firmware rev. Etc.)
    LD - A list of "areas" with defects, along with their ABA, LBA, etc. addresses
    LC -? (some random information)
    L4 - various information on calibration and amplification of warheads

    * unchecked (TODO)

    FU EP EF RD WR SK QT QB QK QN QA QL QS
    QG QW QR QD
  • ADVERTISEMENT
  • #3 15934234
    TechEkspert
    Editor
    Thank you for the interesting supplement.

    I wonder if SAS disks have such an interface and if SCSI disks did.

    I plan to look at an SSD and see if there is a debugging interface on the board inside the case, which will perhaps reveal a little more about the internal life of the SSD, in particular how the built-in GarbageCollector, WearLeveling works and how (how long) the command is carried out TRIM.
  • ADVERTISEMENT
  • #4 19863472
    Łukasz_W

    HDD and data recovery specialist
    TechEkspert wrote:
    I wonder if SAS disks have such an interface

    Yes, at Seagate, for example.
    It is also present in some SSDs (SanDisk, Samsung).
    Company Account:
    HEX SERWIS
    Smołdzinska 2B/16, Kobysewo, 83-304 | Tel.: 530XXXXXX (Show) | Company Website: https://hex-serwis.pl
  • #5 19864426
    TechEkspert
    Editor
    Thanks for the information!
    In SSD, UART is sometimes available inside the case as a PCB field.
📢 Listen (AI):

FAQ

TL;DR: Three common baud rates—9600, 38 400, and 57 600 bps—unlock a UART console on many Seagate/Samsung HDDs; “Some commands can damage data” [Elektroda, TechEkspert, post #15882403] Connect a $3 3.3 V USB-UART adapter and capture the boot log in < 4 s [Elektroda, spamove, post #15933340]

Why it matters: Direct UART access reveals deeper diagnostics than SMART and can salvage—or brick—drives fast.

Quick Facts

• Signal level: 3.3 V TTL [Elektroda, TechEkspert, post #15882403] • Typical connectors: 4-pad header or 2×2 pins near SATA power [Elektroda, spamove, post #15933340] • Default speeds: 9 600 / 38 400 / 57 600 bps [Elektroda, TechEkspert, post #15882403] • Samsung boot log: 26 °C, 5.01 V, 16 MB DDR detected [Elektroda, TechEkspert, post #15882403] • FE (Flash Erase) bricks firmware in <1 s [Elektroda, spamove, post #15933340]

What hardware do I need to read a hard-drive UART port?

Use a USB-to-UART converter that outputs 3.3 V logic, three flying leads (GND, RX, TX), and a terminal program. Cost averages US $3–5 [Elektroda, TechEkspert, post #15882403]

How can I find the TX and RX pins on the drive?

  1. Attach converter GND to any drive ground.
  2. Probe each candidate pad while the drive boots; the one that prints text is TX.
  3. Place a 1 kΩ resistor in the converter-TX line and send a key; the pad that echoes is RX [Elektroda, TechEkspert, post #15882403]

Which baud rate should I try first?

Start at 9 600 bps. If you see gibberish, switch to 38 400 bps and then 57 600 bps. These three cover >90 % of Seagate/Samsung models [Elektroda, TechEkspert, post #15882403]

What useful data appears in the startup log?

Seagate logs show reset reason and spin-up status. Samsung adds voltage (5.01 V), temperature (26 °C), DDR size (16 MB) and readiness time (2.67 s) [Elektroda, TechEkspert, post #15882403]

Are UART command sets identical across all Seagate drives?

No. Core commands such as Ctrl-Z, /level, Z (spin-down) and U (spin-up) repeat, but functions shift by level. Example: D shows temperature at level 7 yet measures speed at level 3 [Elektroda, TechEkspert, post #15882403]

Which commands are safe for simple health checks?

At level C issue Q to list ASCII commands, then use . to display status and ^B to read temperature. These are read-only and leave data untouched [Elektroda, TechEkspert, post #15882403]

Do SAS or SSD devices expose a similar UART?

Yes. Seagate SAS HDDs and some SanDisk or Samsung SSDs include 3.3 V UART pads on the PCB [Elektroda, Łukasz_W, #19863472; TechEkspert, #19864426].

Can the side pins force SATA I mode?

In some older Samsung drives the z* pin forces 1.5 Gb/s SATA I, while newer models ignore it or behave unpredictably [Elektroda, spamove, post #15933340]

How can I park and un-park heads through UART?

Send PK to park and UV to unlatch on Samsung drives; use b (park) and U (spin-up) at Seagate level 3 [Elektroda, spamove, #15933340; TechEkspert, #15882403].

Three-step quick test to capture a boot log?

  1. Wire GND, RX, TX between drive and converter.
  2. Open terminal at 9 600 bps, 8-N-1.
  3. Power the drive; copy the text that scrolls within 4 s [Elektroda, TechEkspert, post #15882403]

What if no text appears at any speed?

Some Western Digital drives expose no UART on the external pads [Elektroda, TechEkspert, post #15882403] Others hide TX behind pull-ups on the PCB; internal solder points may be required. Failure rate for external access on WD >95 % in field reports.

Can UART logs replace SMART when drives sit behind RAID?

Yes. SMART often fails through motherboard RAID or Intel RST caches, but UART logs still stream directly from firmware, giving spin-up, temperature and error info in real time [Elektroda, TechEkspert, post #15882403]
Generated by the language model.
ADVERTISEMENT