Seagate Rosewood Data RecoveryST1000LM035 / ST2000LM007

Is Your Drive a Rosewood?

Rosewood is Seagate's internal codename (also known as the Julius family) for their 7mm 2.5-inch mobile drives manufactured from 2016 onwards. According to Aesonlabs, a Canadian data recovery lab, these drives make up 80% of their incoming hard drive recovery volume due to their ubiquity and fragility.

You can identify a Rosewood drive by its thickness (only 7mm) and the top cover. Unlike older drives with a rigid steel lid, Rosewood drives often use a heavy-duty foil sticker as the top seal.

Model Number Reference

Check the label on the internal drive assembly. If it starts with ST and contains LM, it is likely a Rosewood.

We don't just swap parts and hope things are fixed. Recovery from rosewood drives requires a protocol that respects the drive's unique architecture. Our lead technician has completed ACE Lab advanced Seagate training, which specifically covers Rosewood firmware unlocking and Media Cache repair.

1. Preamp Matching: We validate the donor part not just by model, but by the preamp vendor code (Agilent, TI, or LSI) found on the head connector. A mismatch here means the heads won't read, even if they fit physically.
2. Safe Unstick: We use specialized tools to lift the heads vertically off the platter before moving them to the ramp. Dragging them back, which is a common amateur mistake, leaves scratches.
3. Firmware Stabilization: We patch the ROM to unlock the terminal, then modify System File 93 to disable background processes. This stops the drive from trying to reorganize itself during the imaging process.
4. MCMT Repair: If the Media Cache Management Table (Sys File 348) is corrupt, we reconstruct it in RAM to allow access to user data without triggering the translator paradox.

Media Cache (MCMT) and System File 93

Rosewood drives use an aggressive SMR caching layer called the Media Cache Management Table (MCMT), stored in System File 348. Incoming writes land in a conventional (CMR) cache zone first, then the firmware migrates them to the shingled bands during idle time. If this migration fails mid-write, the MCMT becomes inconsistent: the firmware knows data exists in cache but cannot locate the destination band.

The standard Seagate repair command m0 (translator regeneration) is fatal on Rosewood drives. It wipes the entire MCMT, destroying the only map that links cached writes to their final LBA locations. Data that was pending migration is permanently lost.

Our approach starts with System File 93, which controls the SMP (System Management Process) flags. We patch these flags to disable all background auto-repair, defragmentation, and cache migration before we attempt to read any user data. This freezes the drive's internal state and prevents the firmware from making the corruption worse during imaging.

On a conventional CMR drive, the translator is a static lookup: each LBA points to one physical sector, and that mapping rarely changes after manufacturing. SMR breaks this model. Incoming writes land in a CMR cache zone first, then the firmware migrates cached data to overlapping shingled bands during idle periods. The translator must track both the cache location & the final shingled destination for every pending write. This is why Rosewood firmware corruption is fundamentally different from older Seagate failures.

A common point of confusion: Seagate F3 SysFiles 31 & 32 are Data Integrity Check patterns, not translation tables. On Western Digital drives, Module 31 is the translator. This naming collision has caused technicians to back up the wrong files when preparing for SMR translator repair. On Rosewood, the translation data lives in SysFiles 28 & 348.

Critical System Files for Translation

SysFile 28 (Primary Translator)

Contains the forward & reverse translation tables. The forward table maps each LBA to a physical cylinder/head/sector. The reverse table maps physical locations back to LBAs. Both must be consistent for the drive to resolve read requests. Corruption here produces ABR (Abort) errors on random LBA ranges.

SysFile 348 (MCMT)

The Media Cache Management Table stores the extents map for data pending migration from the CMR cache zone to shingled bands. Each extent entry records the source cache LBA, destination shingled LBA, & byte count. If this file is wiped by an m0 command, all pending cached writes become orphaned. The physical data still exists on the cache zone platters, but no mapping connects it to the file system.

SysFile 35 (NRG List)

The Non-Resident G-List tracks grown defects discovered after manufacturing. Clearing it with i4,1,22 destroys the sector-shifting records, causing the firmware to misalign all subsequent LBA reads. Sectors that were remapped to spare areas revert to their original (defective) physical locations.

COM Port ROM Read

The ROM read uses the drive's serial diagnostic port at 38400 baud (standard Seagate F3 rate). PC-3000 connects via the COM interface & issues a Boot Code mode entry command. In Boot Code mode, the ARM Cortex controller halts normal operation & exposes the ROM contents for transfer using Y-Modem protocol. The entire ROM image (typically 64KB or 128KB depending on the firmware revision) transfers in under 30 seconds at this baud rate.

If the COM port is unresponsive (no terminal echo at all), the ROM can be read via an external SPI programmer connected directly to the ROM chip on the PCB. This bypass is necessary when the bootcode itself is corrupted & the drive cannot enter Boot Code mode through the serial interface.

Tech Mode Unlock Patch

Each Rosewood firmware revision (identified by a CC## code, such as CC49 or EB01) has a unique Diagnostic Port Lock implementation. PC-3000 analyzes the ROM image & generates a patch specific to that revision. The patch disables the lock in RAM only; it does not permanently modify the ROM chip. This distinction matters because a permanent ROM write would alter the drive's boot sequence & risk bricking the controller if power is lost during the write.

Writing the patched ROM back uses higher baud rates: 460800 for standard write-back, or 3M-6M baud for bulk transfers on newer PCB revisions. The faster rate reduces the write-back window & lowers the risk of a power interruption during the operation.

Once the terminal is unlocked, we immediately back up SysFiles 1B, 28, 35, 93, & 348 before any further interaction. After recovery is complete, the patch is removed & the original ROM state is restored so the drive's security posture returns to factory default.

Why SMR Makes Weak Heads Worse

On a CMR drive, each track has a guard band separating it from its neighbors. A weak head with reduced signal amplitude can still read its target track because the guard band provides isolation. On an SMR drive, tracks overlap by design. The read head must resolve the target track's signal from a composite waveform that includes energy from both adjacent tracks. A head operating at reduced amplitude drops below the EPRML decoder's confidence threshold, producing uncorrectable ECC errors even though the magnetic data on the platter is intact.

This is why a Rosewood drive with stiction-damaged heads often shows selective zone failures: the head reads inner tracks (narrower overlap, stronger signal) but fails on outer tracks (wider overlap, weaker composite signal). The data isn't gone; the head simply can't decode it at the default channel settings.

PC-3000 Read Channel Adjustments

1. Read Adaptive Parameters (RAP): These control the analog amplifier gain & equalization filters for each head independently. PC-3000 reads the current RAP values from the System Area & allows per-head tuning. Increasing the preamplifier gain compensates for reduced head output, but pushing it too high introduces noise that the Viterbi decoder mistakes for valid transitions.
2. Head Map Editing: If one head in a multi-head stack is too weak to read at any RAP setting, we disable it in the head map & image only the working heads first. On a 2-platter ST2000LM007 with 4 heads, losing one head means losing access to one platter surface (roughly 500GB of the 2TB capacity). We image the accessible surfaces first, then attempt the weak head with aggressive timeout & retry settings.
3. LDPC Timeout Extension: Rosewood uses Low-Density Parity-Check error correction. The default LDPC iteration count is optimized for speed in normal operation. PC-3000 allows increasing the iteration limit, giving the decoder more passes to resolve marginal sectors. This trades imaging speed for recovery rate on zones where the head signal is borderline.

Preamp Vendor Identification

Each Rosewood head stack contains a preamp chip from Texas Instruments (TI), Agilent (AG), or LSI. The vendor code is identified through the Ctrl+L terminal command on a working drive, which outputs the preamp register values. On a non-functional drive, the code is extracted from the ROM hex dump. The raw hex format uses a masked representation where CC 36 corresponds to preamp code 0x36CC (the active head indicator is masked out during readback).

We maintain a donor inventory organized by preamp vendor code, not just model number. When a Rosewood arrives for head swap recovery, we identify the preamp vendor before pulling a donor from stock. This eliminates trial-and-error swaps that risk additional platter contamination from repeated open/close cycles on the 0.02 micron ULPA clean bench.

Compatibility Rules

TI preamps are strictly isolated. A TI-equipped head stack will not work in a drive whose firmware expects AG or LSI, & vice versa. The servo microcode calibration tables are vendor-specific; cross-vendor installation causes the servo loop to fail immediately.

AG & LSI preamps are sometimes cross-compatible, depending on the specific microcode revision of the donor & patient drives. When the microcode revisions match, the servo parameters are close enough for the drive to lock onto tracks. When they don't match, the result is the same as a full vendor mismatch.

A mismatched preamp produces the terminal error FAIL Servo Op=0100 Resp=0003, meaning the servo system sent an initialization command (Op=0100) & received a rejection (Resp=0003). The heads physically installed and the motor spins, but the drive cannot lock onto any servo track.

After a successful donor swap, the Servo Adaptive Parameters (SAP) & Controller Adaptive Parameters (CAP) must be recalculated. SAP values tune the servo loop's PID controller for the new head's mechanical resonance. CAP values adjust the read channel's analog front-end for the new preamp's output impedance. PC-3000 runs this recalculation automatically when the adaptive parameter module is loaded for the Rosewood family.