Project Kryoflux – Part 4: The Hidden Secrets

The previous part made a passing mention about hidden data from duplicators nested in Track 80 (the 81st track) – so in this segment, I’ll be focusing on just what other things can be unearthed. This will look at data on the disks – whether it could be recovered with or without the Kryoflux.

Lets start with an innocent blank disk, one of my favourites, the Verbatim Teflon Coated 3.5″ HD. Straight from the factory, blank with factory formatting.

80.5t

I’ve given this sort of image a nickname – the 80 “and a half” tracks image. There’s some data on side 0 of track 80 – but none on the other side. Track 80 shows a full 18 sectors on one side and noise on the other. This results in a slightly larger disk image than you’d expect due to the extra track.

Time for some hex editing fun – in this case I’m using WinHex but anything will do really. Inspecting the first sector gives us an interesting insight already. The boot sector has the information suggesting this “preformatted” disk was actually duplicated in a Trace/ST duplicator.

TraceST Boot Sector

Big woop – so we could see this if we just imaged the disk regularly – but I’m not so sure we can see that “half” track with a regular disk imaging software. This is what’s in that last half track …

TraceST Mark

The rest of the sectors on that track were filled with F6h’s, but I spot human readable text. Now that’s interesting. It has a date – 15th June 2005 at 1:46 am (presumably). CMC – maybe this implies CMC Magnetics Corporation had something to do with it, and KL2 may represent the plant. CL1, KL3 has been seen in place of KL2. VA_144 probably denotes the type of drive or media? The number 144 stands out as being related to 1.44Mb but this could be a coincidence. In place of VA_144, CMCMACC has been seen as well.

This was found in a Verbatim DatalifePlus Black, Apple Formatted disk

Verbatim Datalife HD Apple Format Black

In this case, the pattern of 2Eh continues for the end of the sector, and the mark rest of the track is padded out with E5h. Interestingly, both sides of Track 80 were written with the full 18 sectors in this format. Disk Type 101 may be an internal use, the Disk # may represent the number of disks written by the loader. Interestingly, the time stamp on the first sector says 20:00:00 and the time stamp on the second sector says 20:00:01. Very accurate timekeeping there! Also interesting the plain text readable DISK ACCEPTED ! message.

I went and found another one, and the numbers are different, so this isn’t just being lazily replicated from one master disk to another!

Verbatim Datalife HD Apple Format Black2

It has been spotted with a different M/C ID and DISK TYPE as well, despite also being an Apple Format disk. This machine here actually has a proper date setup – and I’d probably believe it too.

Verbatim Datalife HD Apple Format Black3

It would probably be these types of marks, amongst others, which analyzation software tries to make sense of to identify and authenticate disks. But it’s interesting to look at this information which I never knew existed on floppy disks!

This one comes an Imation Translucent IBM formatted disk. The dates are nonsensical – I’ve seen ones from 1903 and 1904 as well. Interestingly, the equipment must have still been configured for 3M when it was acquired by Imation. The IBM represents the formatting type.

3M Mark

And this one is for the Mac preformatted disks …

Imation Translucent Apple

And there are ones from them which were configured correctly. Interestingly, this one is slightly different from an Imation Black HD IBM formatted disk that says says No Error but it also seems to have logged RESH TRACK 35, SIDE 1 which implies something happened …

3M Mark with Error

This was spotted at the end of the Verbatim DatalifePlus HD Black. This one uses @ symbols to fill the rest of the track, only one side of Track 80 is written. It’s got a sensible date and time, with some numbers which are likely to represent the machine and a serial.

Verbatim DatalifePlus HD Black

Other examples include, amongst many others …

Verbatim DatalifePlus HD Black2

Verbatim DatalifePlus HD Black3

This one even has a letter where the other examples have numbers.

Verbatim DatalifePlus HD Black4

This one was from a Verbatim DatalifePlus HD Black with Gold Shutter. From the looks of it, Verbatim probably had many OEMs supplying disks or different plant equipment for each line. Rather amazing to think of. This one has a sensible date and time, and seems to be aligned for a 16 character wide view (funnily enough – they may have forseen my use of a hex editor in this configuration).

Verbatim DatalifePlus HD Black with Gold Shutter

A similar mark was spotted on a Verbatim HD disk with Black Plastic Shutter with Beige Plastic Body. I wonder if those are settings or parameters encoded in there too …

Verbatim HD Black Shutter Beige Plastic

One was spotted with just nulls filling up track 80, side 0.

Note

Going hunting for these marks on HD disks is generally easy since they will be mastered typically MFM which would format match with the main data. If you see a Mismatch, it may be because of the sector size. By changing the sector size, you might have a chance of decoding it into an image file for analysis. The default size is 512 bytes, so try all other options and see if it works (but it’s unlikely).

If you want to find them on Apple GCR coded disks – they might be there as well, but I’ve had little to no luck with it showing Mismatch. Their presence is easily detected by the appearance of the Scatter Plot.

Mismatch Apple Format

Unfortunately, as I’ve found, all cases of mismatch on my disks cannot be resolved from tweaking the sector settings or modes in sane ways, so I’ll give up on those. But there’s definitely data there!

One of the interesting things is that if it was present at the manufacture, this data will linger with the disk for its life unless it’s been formatted by a utility utilizing more than the standard 80 tracks – i.e. special “extra capacity” programs. This means that there may be a forensic way to verify the age of the floppy, or the source of the floppy, or even the machine which formatted the floppy and the batch it was produced in.

In the next part, I’ll look at making some use for the images of the disks we’ve gotten so far. Stay tuned …

About lui_gough

I'm a bit of a nut for electronics, computing, photography, radio, satellite and other technical hobbies. Click for more about me!
This entry was posted in Computing and tagged , , , . Bookmark the permalink.

6 Responses to Project Kryoflux – Part 4: The Hidden Secrets

  1. Pingback: Project Kryoflux – Part 3: Recovery in Practise | Gough's Tech Zone

  2. Steve says:

    Wow! I never realised there is often ‘secret text’ stored on inaccessible tracks of disks. I’ve never heard of such a thing being alluded to elsewhere. How curious. Thank you for sharing this information. I’ve enjoyed reading your Kryoflux articles.

    • Steve says:

      I have a question about the Kryoflux, and you seem like the right person to ask. I’ve read that it’s able to read any kind of disk, with pretty much any standard 3.5″ disk drive attached. Is the Kryoflux doing anything differently to what a standard computer can do with these drives?

      The reason I ask is that I always assumed the drives used in Amigas were ‘different’ to those used in IBM PCs, because nobody was ever able to write software to ‘read’ Amiga formatted disks on an IBM PC. I assumed the incompatibilities of different systems was down to hardware differences within the drives themselves.

      Also, is Kryoflux able to ‘read’ more from a disk that something like X-Copy Pro set to read up to track 84? I am assuming copyright protection generally does something novel which means a disk cannot be copied in this way, yet Kryoflux has no problem with it.

      Is the issue here something to do with how the computer hardware itself on each platform ‘reads’ the data off the disk and then passes it to the host OS? Is this ‘read’ mechanism fixed and unalterable by software on the OS? If so, how is copy protection possible?

      Sorry if I’m asking too many difficult or unanswerable questions, but I’m genuinel curious about such thing, and how Kryoflux works, without getting bogged down with impenetrable phrases like ‘magnetic flux transition timings’.

      Many thanks!

      • lui_gough says:

        I think the Kryoflux FAQs and various documents on the Software Preservation Society’s webpage can give you a fairly good answer – but I’ll try to give you a more in-depth answer at multiple levels.

        A standard computer (say, an IBM compatible PC) relies on a Floppy Drive Controller chip which interprets the signals from a floppy disk drive and interfaces with the software. Unfortunately, these FDCs are usually very inflexible, and are hard-coded to detect only certain types of encodings (MFM) and at certain data rates (250kbit/s, 300kbit/s, 500kbit/s) with certain other limitations. While this is sufficient for working with the floppies normally intended to work with the native system, it’s hopeless for working with floppies which contain encodings which are not supported by the system.

        Some (now considered vintage) computers, such as the Amigas, may not actually have a hardware FDC and instead perform floppy drive control functions in software. This is part of the reason that software such as X-Copy Pro could exist, as those computers were not saddled with the limitations that the IBM were. They merely hooked up the raw data output from the floppy drive to the CPU, and all the interpreting formats, encodings and data rates was down to software running on the CPU. This was CPU intensive, and was a limiting factor in terms of performance with some of those computers especially during writes to avoid data corruption.

        While X-Copy Pro is able to grab more data from a floppy disk and essentially record the raw data from the drive, it’s not an ideal solution. The reason the Kryoflux was developed is predominantly for software preservation. To do this, there were a few key points that were important. For example, access to Amigas are getting relatively limited, so they wanted hardware that could operate with a modern computer and relatively common commodity floppy drives. Secondly, it was known that preserving software using Amigas is highly sensitive to timing variations between machines, which can be influenced by the addition of expansion modules. The proposed device had to be able to record the signal at a low enough level that it can capture malformed, blank unformatted and specially formatted copy protection tracks precisely enough to allow for this to be archived before the media failed and possibly emulated in the future.

        As a result, the Kryoflux does some things differently. For one, it has a Write Block jumper, which can be used to ensure no possibility of accidentally writing or corrupting your floppies. Secondly, it samples at a much finer rate – 24Mhz, compared to the (roughly) 4Mhz of an Amiga, thus allowing for a better capture of data and better handling of questionable/poor disks. It features a histogram/graph of the flux transition timings, so you can troubleshoot (to some extent) poorly reading floppies. It also features “decoders” for many different formats, thus allowing you to create image files and extract the recorded binary data from the recorded raw flux data.

        At the moment, it is capable of writing only a limited number of formats. It’s not designed as a copier, nor for use as a regular floppy disk drive or a writer. It was designed to read the raw signal from a floppy disk, first and foremost. If you had a mystery floppy with an unknown format, you could read the raw signal into a STREAM file, and then analyze it to determine its encoding and decode it many years into the future as STREAM is a documented format. This is especially important for floppies with copy protection where it may not be clear if an error was a real error, or an intentional error in the format by design. If it’s of a known format, applying the existing decoders will allow you to extract the data into an image, which will make it usable for emulation or mounting and extraction of files.

        The thing to realize is that the drives themselves don’t have any real interpreting logic within them. They merely outputted a high or low signal representing the state of magnetization of that particular spot of the disk. In fact, IBM drives were suitable for re-use in some other systems by merely re-jumpering as they used their Drive Select signals differently (Jumpered for B: rather than A:). Other formats, such as Apple GCR, required variable spindle speeds so the regular floppy drive can’t be used in an Apple, but that doesn’t stop you from using a Kryoflux and a regular floppy drive to read the disks because the Kryoflux understands the encoding. The drive is merely a mechanism for converting the disk flux patterns (magnetic recording) into a voltage, which then gets further decoded into data by the FDC. Choose an FDC which can understand the format (e.g. Kryoflux, or before that, the CatWeasel) and any drive can be used to read a given disk. If you really want, even having a high rate data acquisition card or oscilloscope hooked up to the data output of a floppy drive pulled high will give you the signals on the disk, but the real genius is turning that raw signal back into data. This is why I favour the Kryoflux – it has one of the widest libraries of decoders available.

        Copy protection works by doing things which cannot be normally replicated by the floppy disk controller, for example, laying down a “noise” track which is completely unformatted and thus produces a random “noise” signal on every readback that changes. It can also make things difficult for copying by introducing intentional errors in the format which makes sectors which are unreadable, which must be present to start the software. They have also altered the spacing between sectors, or the actual data rate of the sectors, and some have used half-tracks as well, squeezing in data between regularly used tracks which cannot be read or replicated unless carefully imaged. Other things include short sectors, sectors of a “mixed” size within a track.

        Reproducing the raw signal allows you to analyze these phenomena in high detail, and capturing multiple revolutions (by default, 5 for an archival STREAM file) allows you to discern intentional errors and noise tracks from soft-read errors. Once there is an understanding, there is the hope that the software can be saved in a workable form, before the floppy media “rots” away due to binder failure or other maladies.

        Hope this explains it all.

        – Gough

        • Steve says:

          Gough:

          That was a lot more thorough a response than I would’ve expected! THANK YOU for taking the time to write all that, it’s very informative 🙂

          The explanation of the FDC is very helpful. That does indeed why the PC was always unable to ‘read’ custom formats like the Amiga’s whilst the KryoFlux is able to use the exact same drive successfully for the exact same purpose.

          The varying track length and intentional errors etc. you refer to, perhaps begins to explain why the KryoFlux is able to read off data on a protected disk whilst evenX-Copy, presumably, would’ve been unable to do so. The ‘stream’ format captures every imperfection precisely, and isn’t simply attempting to copy the data ‘read’ off a track as, I presume, XCP is doing?

          BTW, in case you’re wondering, my interest in the copy protection element isn’t from some desire to engage in any naughtiness on my part 😉 I was curious from a technical aspect, as to how KF is able to presumably beat 100% of all protection, whereas this technique failed in software. It’s a testament to how powerful and sophisticated this device is.

          I regret that I dumped most of my old collection years ago. I knew the disks were starting to die off, so I copied off any ‘unique’ disks I would ‘t be able to DL elsewhere, and chucked the real away (including, as it so happens, a few corrupt disk and ‘protected’ disks KF may’ve been able to replicate for me… I wish I’d had access to a KF and your article all those years ago… :-))

          KryoFlux, for me, falls in that rare category of “device I probably won’t have an immediate use for, but I feel compelled to buy because it’s very nifty and novel, and might prove useful in the future…. and it might not be available in a few years’ time!”)

          Thanks again for such a detailed and thorough review of this gizmo and the helpful reply,

          Steve

Error: Comment is Missing!