A Failing Head is Not a Failed Drive. Why Head Depopulation Belongs in the Filesystem

Turning recertified HDDs from a data-loss liability into a sustainable storage tier.

Head depopulation lets you drop a single bad recording head and keep the drive running at about 95% capacity. Here is why it is the missing piece for running recertified HDDs at scale, why it belongs in the filesystem — and what we can do for CMR today.

Every large HDD fleet quietly throws away good capacity. A modern enterprise drive has several recording heads — one per platter surface. When a single head starts to fail, the whole drive is usually declared dead: pulled, RMA’d, or shredded. But that one head is only about 5% of the drive’s capacity, and a single failing head is behind roughly 40% of real-world drive rejections. We routinely scrap 95%-good hardware because of a 5% fault. 

That waste is expensive everywhere, but it is acute for recertified and used drives — precisely the drives the industry most wants to keep in service, and precisely where the data-loss risk is highest. 

• .~5% of a drive’s capacity is all a single failing head cost. 
•  Yet one bad head drives ~40% of real-world rejections — and today it usually means throwing away 100% of the drive. 

The economics no one wants to eat 

Recertified enterprise HDDs are one of the best deals in storage: repaired factory-return and second-life drives, sold at a fraction of new-drive cost, with a circular-economy story that keeps working hardware out of landfill. Demand already outstrips supply. The catch is in the fine print — a short warranty, often around six months, and a higher rate of single-head wear than a fresh drive. 

So operators face a dilemma. The drives are cheap and plentiful, but the software they run on treats every drive as all-or-nothing. In Ceph and most software-defined storage a drive is binary: healthy or failed. One bad head and the whole OSD is marked out, and the cluster rebuilds 100% of that drive from parity across every peer — a rebuild storm that hammers performance exactly when you least want it. On a short-warranty drive that outcome arrives sooner, and more often. It is why many teams will not touch used drives at scale: the blast radius of one head is the entire drive. 

Head depopulation flips that math. 

What head depopulation actually does — and why it is ready for CMR 

“Depop” is a standards-based capability already present in modern drives. When a head drifts outside its operating limits, the drive can report that failing physical element, and the host can instruct the drive to remove it. The drive comes back online with that head’s platter surface subtracted — typically returning about 95% of its original capacity — and keeps running. No RMA, no shredder. 

On Seagate drives the flow runs through their openSeaChest tooling: enumerate the physical elements and their per-element health, issue the physical-element removal for the bad head, poll until the drive reports it depopulated, then reformat and remount at the new, smaller capacity. One caveat matters above all: depop is destructive. On CMR the operation removes the element and reformats the whole drive, so every byte has to be evacuated safely first. Get that wrong and you do not lose 5% — you lose everything on the drive. 

That single caveat is the whole reason head depop belongs in the filesystem — and it is why we can offer it for CMR today. Leil FS already does rate-limited, workload-aware rebalancing, so wrapping a safe depop procedure around it is a natural extension, not a moonshot. For recertified CMR drives this is available now, and I would argue it is essential: it is the difference between a used drive being a data-loss liability and being a safe, durable tier. 

Why it belongs in the filesystem 

Doing depop safely means doing it early. The interesting move is not reacting to a dead head — by then data may already be unreadable and you are reconstructing from parity. The move is to watch the drive’s own physical-element health and per-head telemetry (SMART attributes with strong failure correlation — reallocated and pending sectors, uncorrectable and command-timeout counts — alongside FARM per-head metrics such as flying height and per-head error rates), and to act while the head still reads perfectly. 

When the health model flags a degrading head, Leil FS stops targeting that drive for new writes and drains its data in the background, rate-limited against live workload so archive SLAs stay untouched. Because the source is still readable, this is a clean copy — zero parity reconstruction, no rebuild storm. Only then do we depopulate the head and reintegrate the drive at its new capacity, with the cluster’s capacity model treating “same drive, slightly smaller” as perfectly normal. 

The result is a different failure economics: recovery touches roughly 5% of the drive instead of 100% — about a 20× smaller recovery surface — and the drive stays in the fleet instead of leaving it. This is the part you cannot bolt onto a system that only sees drives as up or down. Coupling per-head physical health to filesystem-level data placement is only possible when the filesystem owns both. That coupling is the point. 

SMR is where it gets interesting 

Everything above applies to CMR today. The bigger prize is SMR — and this is where the architecture really pays off. 

On CMR, depop always means a full reformat, so you evacuate the entire drive first. On host-managed SMR the data is already organized into zones, and emerging drive support for modifying zones will let us remove only the zones mapped to the failing head — no full-drive wipe, no lengthy reformat. Leil FS is already zone-aware, so this is a natural extension of what the filesystem does every day. 

The advantage over the CMR path is significant. Instead of evacuating and rebalancing a whole drive, we evacuate only the surface served by the bad head — a small fraction of the drive — and the rest of the data is preserved in place. No full reformat, no whole-drive rebalance, dramatically less data in motion. Our target is a depop that moves less than 10% of a whole drive’s data. At that point head depop stops being a heavy maintenance event and becomes a quiet, routine, near-instant operation. 

That is the direction we are building toward, and we are saying so early on purpose. If you run SMR at scale, we want to design this with you. 

Open by design, not locked in 

One deliberate choice underpins all of this: we build on open, standards-based tooling — the physical-element commands exposed through SeaChest and openSeaChest — rather than any proprietary, vendor-locked regeneration black box. The depop lifecycle lands in Leil FS, which is open source under GPL-3. You run it on your own hardware, and you are never dependent on a single vendor’s closed firmware feature to keep your drives alive. What you would pay us for is the operational layer on top — the predictive health models, policy, dashboards and support that make this safe to run unattended across a large fleet. 

Come build this with us 

We are opening this to early adopters now. If you run large HDD fleets — especially recertified or used CMR drives — and turning a dead drive into a 5% capacity trim rather than a 100% loss sounds like your kind of problem, we want to work with you. Run the CMR depop loop on your hardware with us, help us harden the predictive models against a real fleet, and be first in line for zone-scoped SMR depop as it lands. 

Reach out at contact@leil.io. Bring your ugliest drive-failure statistics — those are exactly the ones we want to fix. 

Author: David Gerstein
David Gerstein is the CTO and Co-Founder of Leil, an Estonia-based storage infrastructure company building HDD-native software for the exabyte era. Leil is in active co-engineering partnership with Western Digital, validated across the WD, Seagate, and Toshiba drive ecosystems.