WD Purple Surveillance Data Recovery

Surveillance Drive Firmware Internals: AllFrame, Workload Rate Limit, and SMR Translator Mechanics

Most WD Purple troubleshooting writeups online repeat the same marketing summary: 24/7 duty, AllFrame, TLER, 180 TB/year. None of those phrases describe what the firmware actually does to the drive when an NVR runs into a fault. This section bridges marketing terminology to firmware reality. It also corrects a misconception that has spread through legacy donor-matching forums: the "AC-family" designation sometimes attached to surveillance drives refers to 1990s Western Digital Caviar IDE models such as the AC-2420, not modern surveillance hardware. Modern WD Purple drives run on Marvell V2 SoCs for standard CMR models on the Carmel and Venice platforms, with Module 190 acting as the T2 Translator on the related VeniceR and CarmelR platforms used for DM-SMR variants in the wider 3.5-inch WD line, or on the HGST Command Code Based platform inherited from the HGST acquisition for 12TB and larger helium-sealed Purple Pro drives.

AllFrame and the ATA Streaming Command Set

AllFrame is WD's branding for an implementation of the ATA Streaming Command Set published in the ATA-8 ACS specification. The underlying commands are READ STREAM EXT, WRITE STREAM EXT, and CONFIGURE STREAM. The streaming feature set imposes a strict time budget on the firmware error-recovery state machine so the NVR write buffer never overflows while the drive is retrying a marginal sector.

The deliberate trade-off: when a write error occurs, the firmware skips the deeper ECC retry passes that a desktop WD Blue, Black, or Red drive would perform. A surveillance stream cannot afford a sector retry that lasts longer than the ring buffer can hold, so the firmware moves on. The side effect of that trade-off is that SMART attribute 5 (Reallocated Sectors Count) and SMART attribute 197 (Current Pending Sector Count) stay artificially clean while the platter degrades. By the time SMART 197 ticks up on a Purple, the underlying platter damage is usually well beyond the early-warning point a desktop drive would have surfaced.

The practical consequence for NVR operators: SMART status on a WD Purple is a lagging indicator, not a leading one. Audible clicking, dropped channels, or footage that stutters at fixed playback positions are usually the first real warnings that the drive needs to come out of service.

Workload Rate Limit and Head Wear Acceleration

Standard WD Purple is rated 180 TB/year and Purple Pro is rated 550 TB/year. These figures appear on the WD Purple datasheet and are not arbitrary marketing. They are statistical engineering thresholds tied to MTBF and AFR projections at the design workload. WRL is not a hard firmware lockout. The drive does not throttle, does not refuse writes, and does not log a "WRL exceeded" SMART attribute when the limit is crossed. Nothing in the firmware tells the operator the threshold has been passed.

What WRL exhaustion does cause is mechanical: continuous write current produces thermal fatigue on the magneto-resistive write elements; sustained write throughput elevates operating temperatures and continuous localized heating from the write element can accelerate depletion of the perfluoropolyether lubricant layer on the platters; rotational vibration in multi-bay enclosures compounds the effect by pushing the actuator into corrective oscillation. The combination of suppressed SMART surfacing through AllFrame and silent WRL exhaustion through the absence of any firmware warning is why surveillance Purples often arrive at the lab with several heads already degraded but no SMART flags raised.

DM-SMR WD Variants and the Module 190 T2 Translator

DM-SMR (Drive-Managed Shingled Magnetic Recording) variants of WD's 3.5-inch drives sit on platforms such as VeniceR and CarmelR, and store the indirect logical-to-physical mapping in Module 190, the T2 Translator. SMR drives group writes into shingled bands, and modifying any sector inside a band requires a read-modify-write of the entire band via the media-cache flush. If wall power drops during a flush, Module 190 loses synchronization between the LBA-to-PBA map and the actual platter state. The drive identifies normally and reports correct capacity, but read attempts return UNC or the drive holds the SATA bus in BSY.

The PC-3000 Express and Portable III workflow for a corrupted Module 190 follows a specific order. Apply a RAM patch to unlock the Service Area. Back up every accessible firmware module, with Module 190 prioritized so any usable copy is preserved before any modification. Engage the "Lock User Area writing" feature to freeze the corrupted translator and prevent the drive's background garbage collection from rewriting bands during diagnostics. Run the "Repair Module 190" function to reconstruct corrupted entries from band metadata. Load the rebuilt Module 190 into RAM so the patient operates from RAM rather than the corrupted on-platter copy. Image the drive via Physical Block Access (PBA), bypassing logical addressing entirely.

One non-obvious risk on PBA imaging of a partially flushed band: the dump can recover stale data the application thought it had committed, because the LBA-to-PBA map was mid-update when power dropped. NVR proprietary filesystems that distribute multiplexed video frames non-linearly across the disk benefit from a PBA dump followed by frame carving; HIKBTREE and DHFS index reconstruction is performed against the PBA image after the fact, never against the live drive.

Marvell Donor Matching Beyond the Family Code

Most published donor-matching guides stop at family code, capacity, and head count. For modern Marvell V2 Purple drives that is not enough. Four additional axes determine whether a donor will calibrate against the patient at all. Preamp vendor and revision must match exactly: Renesas, Broadcom, and Texas Instruments parts each ship with revision IDs that the read channel coefficients in the patient's adaptive tables are bound to. The microjog calibration values stored in Module 47 must fall within roughly 200 to 300 points of the patient's microjogs, or the read channel will not lock once the donor heads are installed. The Drive Configuration Matrix (DCM) character codes must align on the chassis and spindle markers, with the 5th character (typically a J or a 2) indicating the head stack vendor and serving as a critical mismatch flag. Firmware revision band compatibility determines whether the donor's Service Area module formats can be paired with the patient at all without a deeper firmware migration.

ROM adaptives are stored in the U12 SPI flash on the PCB and contain unique servo calibration and voltage settings for the original head stack. A donor PCB will not initialize the heads even if all four axes above match, because the servo coefficients and voltage offsets are bound to the patient. ROM extraction and rewrite is performed on a dedicated SPI programmer with the chip in a stable thermal state; it is never done by reflowing or hot-swapping the chip. The full donor-matching axis set is documented on how donor drives are matched in modern hard drive recovery, and the underlying recording-layer differences that drive the Module 190 workflow are covered on CMR vs SMR hard drives and translator implications.

When WD Purple PCB Damage Is the Real Failure

Not every dead WD Purple is a head problem. A subset of intake drives arrive after a surge event or a faulty NVR power supply, and the heads inside are still healthy. The preamplifier sits on the head stack flex cable, but its power rail is generated on the PCB. When the PCB-side driver for that rail fails, the symptom looks like a head problem: the drive may click once, fail to ready, or hold the SATA bus in BSY. The heads themselves are intact. Distinguishing the two cases before opening the drive is the difference between a firmware/electronics tier recovery and a full head-swap with platter cleaning.

Preamp Power-Rail Diagnostics with FLIR Thermal Imaging

The bench workflow begins with the patient PCB on an isolated lab supply, current limited so a downstream short cannot cascade further damage. The PCB is powered for ramp-up only, no SATA link. The FLIR thermal camera surveys the board for hot spots within the first few seconds. A failed preamp power driver produces a localized thermal signature at the regulator that sources the head-stack flex; a shorted decoupling cap on the same rail produces a slower-rising broad hot spot near the connector. A drive whose PCB power rails come up clean and whose ROM reads correctly but which still fails to ready is treated as a mechanical case and moved to the clean bench.

The PCB rail map is verified against the head-stack flex connector pinout before any rework is attempted. The U12 SPI ROM is read with the external programmer before power is applied to a rework candidate, so the adaptive parameters are captured even if the rework step destroys the donor PCB.

Board-Level Rework on the PCB Power Stage

When the thermal survey identifies a failed driver IC or a shorted passive on the PCB power stage, the failed component is removed at the bench using the Hakko FM-2032 soldering iron on the FM-203 base station, paired with hot air rework where the package geometry requires it. This is a PCB-only repair: the rework station never touches the head stack assembly, the platters, or the actuator. Soldering on the drive mechanism itself is not part of HDD recovery and is not performed here. The PCB repair exception applies strictly to the surface-mount components on the controller board.

After the failed component is replaced, the ROM adaptives captured earlier are written back to the U12 SPI on the repaired board through the external programmer. The drive is then re-mated to its original head stack and read on PC-3000 Express or DeepSpar Disk Imager through a controlled spin-up.

Why This Is the Optimistic Case

PCB damage with intact heads is the cheaper end of the WD Purple recovery spectrum. No donor head stack is sourced, no clean-bench head swap is performed, and no platter cleaning is needed. The work stays inside the firmware and electronics tier of HDD recovery rather than the head-swap tier. Pricing reflects that: PCB and firmware-tier work falls in the $600–$900 band, against $1,200–$1,500 for a full head stack assembly replacement and $2,000 when platter cleaning is required after a head crash. The deeper background on what PC-3000 does during the post-rework verification pass is on what PC-3000 actually does, and the broader workflow context lives on hard drive data recovery.

Donor Matching for WD Purple Head Stacks

A WD Purple head swap requires a donor drive whose head stack assembly matches the patient on multiple axes, not just capacity. Buying the same model number off a marketplace is the starting point, not the end of the search. The fields below are checked against the patient drive's ROM and Service Area data before any donor is opened.

• Family code (PURX vs PURZ): the legacy PURX series and the current PURZ series use different head architectures. A PURZ head stack physically fits a PURX chassis and reads, but the firmware adaptive tables addressed by ROM are different and the drive will not exit calibration cleanly.
• Capacity code and head count: a 4TB Purple may ship with two or three platters depending on the production run. The patient's head count is read from the Service Area first, then the donor is selected to match. A four-head donor for a three-head patient introduces an extra head into a position that has no calibrated parking slot on the ramp.
• Preamp revision: the head preamplifier IC sits on the head stack flex cable. Purple revisions ship with multiple preamp variants over a model's lifetime. A donor with a different preamp will pass head-to-head continuity but the read channel coefficients in the patient's adaptive tables will be wrong, so the drive returns BSY or unreadable sectors after head swap.
• Micro-jog and write current tolerances: each head is calibrated to its own platter at the factory; the calibration is stored in the patient ROM. The donor heads must fall inside the same micro-jog and write current band for the patient's adaptives to drive them correctly.
• Manufacturing site code and firmware revision band: WD heads built at different sites use different supplier components. A donor outside the patient's firmware revision band typically lacks compatible Service Area module formats and cannot be paired without a deeper firmware migration.

A WD Blue, Red, or Black drive is not a valid donor for a Purple, even at the same capacity. The Purple line uses different head suspension geometry, a higher-tolerance preamp tuned for sustained sequential writes, and different firmware adaptive tables. Installing a Blue or Red head stack into a Purple chassis produces a tracking but non-decoding drive: the actuator moves, the heads read raw signal, and the firmware cannot map the encoded bit pattern back to logical sectors. The full donor-matching workflow is documented on how donor drives are matched. For Purple capacities at 8TB and above, the difference between CMR and SMR layouts also affects donor selection; see CMR vs SMR hard drives for the underlying recording-layer details.

Donor drives are matching drives used for parts. Typical donor cost: $50–$150 for common drives, $200–$400 for rare or high-capacity models. We source the cheapest compatible donor available. The donor cost is itemized separately from the head-swap labor tier ($1,200–$1,500) so customers can see exactly where the spend is going.

ATA Streaming Command Set and ROYL Firmware Behavior on WD Purple

Most of the WD Purple sections above explain what the firmware does at the platter and head level. This section covers the host-side command path, the Service Area module layout that PC-3000 operates on, the PCB matching axes that sit one level below the family-code check, and the wear patterns that 24/7 duty cycle leaves on a Purple by the time it reaches the recovery bench. None of this is duplicate procedural content; it sits between the donor-matching framework above and the shipping logistics below.

ATA-8 ACS Streaming Commands During DVR Writes

A WD Purple in an NVR or DVR is driven through the ATA-8 ACS Streaming Feature Set rather than the standard read and write opcodes used by desktop hosts. The host issues CONFIGURE STREAM (opcode 0x51) at session setup to allocate the drive's internal time budget for error recovery, then WRITE STREAM DMA EXT (opcode 0x3A) for ring-buffer flushes and READ STREAM EXT (opcode 0x2B) for playback. Each streaming command carries a Command Completion Time Limit, which tells the drive that delivery deadline outranks sector integrity. Standard desktop drives running READ DMA EXT (0x25) and WRITE DMA EXT (0x35) have no such deadline; the drive is free to spend several seconds on a marginal sector. The streaming command path is what allows a Purple to ingest dozens of concurrent camera streams without dropping multiplexed video frames.

The recovery-time consequence of this command path is that the drive arrives with a firmware state machine that has been tuned for the opposite of what an imager wants. When a degraded Purple is connected to a standard SATA port issuing READ DMA EXT, the firmware reverts to the deep ECC retry loop it had been suppressing under streaming operation. The drive locks the SATA bus in a busy state and drops offline as soon as the host hits a weak track. On the bench, the DeepSpar Disk Imager and PC-3000 Data Extractor are configured with aggressive short timeouts in the 100 to 300 millisecond range to approximate the original CCTL behavior, with worn sectors queued for a second pass instead of stalling the link.

AllFrame Behavior During Motion-Event Write Spikes

AllFrame is WD's branding for the firmware-level implementation of the streaming command set extensions, tuned for sustained sequential writes from camera ring buffers. On a typical NVR workload, the ingest rate is steady while ambient frame deltas are low, then spikes when motion detection raises the bitrate on the affected channel. During the spike the drive sees a burst of sequential writes from the channel ring buffer hitting the cache, with the firmware required to keep the cache from filling. Under AllFrame, deep ECC retry passes are truncated against the CCTL budget so the head moves on rather than spending the time budget on a marginal sector. The background sector relocation path that a desktop drive runs during idle windows is suppressed, because surveillance firmware does not assume an idle window will arrive.

The downstream effect on diagnostics is that SMART attribute 5 (Reallocated Sectors Count) and SMART attribute 197 (Current Pending Sector Count) stay artificially clean against the real physical degradation of the platter. A Purple that reads as healthy on a host SMART query can already be carrying weak tracks the firmware refused to retry against during motion-event ingest. SMART status on a WD Purple is a lagging indicator, not a leading one, and the bench treats it as such. Imaging strategy starts from a per-head bitmap and ATA timeout posture, not from the SMART table.

ROYL Service Area Module Map and PC-3000 Access

Modern WD Purple drives run the ROYL firmware architecture on Marvell controllers. The firmware loader sits in the U12 SPI ROM on the PCB; the working firmware modules sit magnetically on the platters in the negative-cylinder Service Area. On a Service Area corruption case the resident firmware cannot complete its boot handoff, and the drive returns a generic ROM-model identifier or holds the SATA bus in a permanent busy state. Recovery access goes through the PC-3000 WD Marvell utility, which interrupts the boot sequence over the diagnostic UART and pushes a utility-family loader into the controller's SRAM. From that loader the bench reads and rewrites Service Area modules over the SATA PHY using vendor-specific commands.

• Module 01 (Directory): the offset and length map for every other module in the Service Area. Module 01 is read first because the rest of the access plan is keyed off the directory.
• Module 02 (Configuration flags): operational flags including background relocation and self-test behavior. The bench patches Module 02 in RAM during imaging so the drive does not attempt background reallocation against the weak sectors being imaged.
• Module 0A (Head map): the physical head configuration. A degraded head is logically disabled here so the drive can initialize past head identification and the surviving surfaces can be imaged.
• Module 32 (G-list): the grown defect list. On CMR Purple drives an overfilled Module 32 produces the slow-responding bug, where read throughput collapses into kilobytes per second as the firmware loops on the defect parse. The recovery workflow clears Module 32 and disables background relocation for the imaging window.
• Module 33 (P-list): the factory primary defect list, read-only at the bench and used as a sanity check against the head map.
• Module 47 (Adaptive parameters): the head-stack calibration table. Micro-jog offsets, preamplifier gain, and thermal fly-height control voltages live here. The Module 47 contents are what the U12 ROM transfer is protecting on a PCB swap; a donor Module 47 will not drive the patient heads correctly.
• Module 190 (T2 Translator): the indirect logical-to-physical translator on the DM-SMR Purple variants. The dedicated Module 190 rebuild workflow for SMR translator corruption is documented in the earlier section on this page.
• Modules 102 through 109 (ROM shadows): magnetic backups of the U12 ROM image. If the original PCB is destroyed by overvoltage and the SPI flash is unreadable, the ROM shadow modules are read off the platters and reassembled into a valid image for the donor PCB.

The high-capacity Purple Pro family (12TB and above) uses the HGST Command Code Based firmware architecture inherited from the Hitachi platform, not the standard ROYL module structure. The Service Area access protocol, NVRAM handling, and PC-3000 entry sequence on those drives match the Ultrastar enterprise branch and are covered in the Helium Purple Pro sections earlier on this page rather than here.

PCB Matching Beyond the Family Code

The donor-matching section above lists the head-stack axes that determine whether a donor body will read against the patient adaptives. The PCB itself has a separate set of matching axes, used when the failure is electrical rather than mechanical. A WD PCB carries a silkscreened identifier in the form 2060-xxxxxx-yyy REV with a trailing revision code. The six-digit number following 2060- is the board generation, and it determines the main controller IC, the motor combo IC, and the SPI ROM footprint. The three-digit code following it varies with sub-revision; the REV letter or P-code is generally cross-compatible inside the same six-digit base.

• 2060- six-digit base: a board with a different six-digit base will carry a different Marvell controller or a different motor combo IC and is not a valid donor regardless of which Purple model the marketplace listing claims it fits.
• Motor driver IC family: a board generation may ship with more than one motor combo IC across its production run. The patient and donor must carry the same combo IC family because the firmware drives the VCM and spindle through that specific part's register map.
• U12 SPI flash footprint: the SPI ROM package and density must accept the patient's adaptive blob during the U12 transfer. Newer board revisions on the same generation occasionally swap the SPI part, which breaks the direct transfer without an intermediate read and reflash.
• Diode and TVS protection footprint: a board that was destroyed by overvoltage may have damaged TVS diodes still in place. The donor is checked for equivalent protection components before the U12 ROM is moved, so the rebuilt drive is not handed back to the same power rail that killed the original.

The U12 ROM itself is desoldered from the patient board using the Atten 862 hot-air rework station with a low-profile nozzle, read out on an external SPI programmer, then reflowed onto the matched donor PCB. The transfer is verified by checking the adaptive table contents against the read-back image before the rebuilt PCB is mounted on the patient body. The general donor and PCB matching framework is on how donor drives are matched.

24/7 Duty-Cycle Wear at Recovery Time

A WD Purple deployed in a security closet or a tightly packed NVR rack spends years at an elevated steady-state temperature with a write-heavy duty cycle. The wear pattern at recovery time is different from a desktop WD Blue or Black drive at the same age, and the bench plans the imaging strategy around it. The phrasing below is conditional, not anecdotal; it describes what the bench treats as a working hypothesis when a Purple arrives with the listed symptoms, not specific recoveries.

• Fluid dynamic bearing lubricant migration: the spindle motor uses a fluid dynamic bearing with an oil film pumped into a herringbone groove and contained by a capillary seal. Sustained operation above the bearing's designed thermal window accelerates oil migration past the seal. A Purple that arrives with non-repeatable run-out, spindle wobble during the spin-up phase, or audible bearing noise is treated as a candidate for an imaging-only window before the bearing degrades further, with no expectation that the original spindle will survive long enough for a multi-pass image.
• Preamp thermal aging: the head preamplifier IC on the flex cable sees continuous current at elevated temperature for the full deployment lifetime. Drives that arrive after long surveillance runs sometimes present with a head channel whose read amplitude has drifted outside the patient ROM's adaptive window. The bench reads channel margin per head before committing to an imaging order, and a marginal head is bypassed in the first pass rather than allowed to stall the extraction of pristine bands served by the other heads.
• Voice coil bearing and ramp wear: the VCM pivot bearing and the ramp-load parking surface accumulate wear from the continuous seek pattern of NVR ingest, which never lets the actuator rest in a stable parked state for long. A Purple with retract clicks at power-on, ramp residue visible under the stereo microscope, or audible roughness during seek is treated as a mechanical-tier case even when the firmware will still respond.
• Micro-jog drift: the per-head micro-jog offsets stored in Module 47 are factory-calibrated for the original mechanical tolerances. After years of thermal cycling and continuous head usage, the read element can shift inside its adaptive window. The drive may still pass identification but return uncorrectable errors on tracks it previously read cleanly. The bench treats this pattern as a candidate for a per-head re-read with relaxed channel parameters before any mechanical work is authorized, since the heads themselves are not yet failed.

Firmware-tier work on the standard WD Purple family is priced at $600–$900 ($600 CMR, $900 SMR), with mechanical-tier work at $1,200–$1,500. Helium-sealed Purple Pro drives that require opening the sealed chamber for head work are priced from the helium head-swap tier at $3,000–$4,500. Donor drives are matching drives used for parts. Typical donor cost: $50–$150 for common drives, $200–$400 for rare or high-capacity models. We source the cheapest compatible donor available.