Is the code located on the drive (if so, any idea where it might be?) or on the control board?
Also, what backup program do you recommend? The WD Smartware software does not appear to be very flexible.

in order to bypass the password verification process altogether?

....seems to me in hindsight, a key bit of research would be that if you do not intend to encrypt your data, don't buy a HDD that encrypts.
This sort of info is getting more and more abstracted from the user, and general population is losing the ability to understand the tech they are using.
...

And BlackST.. I bet there is interest in other areas as well, which I think you are alluding to... Wouldnt a Snowden expose on hard drive encryption breaking be very interesting!

Sorry if I reply to this very old thread... but since the only correct answer wasn't given yet, let me catch that up for you.

If we have a look at the research paper titled "got HW crypto? On the (in)security of a Self-Encrypting Drive series" from the researchers Gunnar Alendal, Christian Kison, modg et al. (i.e. the paper all of the WD decryption solutions are using for these type of drives), we quickly find out that the correct user set password for the locked drive mentioned here (by the OP): <!-- m --><a class="postlink" href="https://forum.hddguru.com/viewtopic.php?p=131488#p131488">https://forum.hddguru.com/viewtopic.php ... 88#p131488</a><!-- m --> is "chooseapassword" (without quotes). This can be done by just hashing all candidate passwords (and in this case it is really an easy password that is present in every normal word list a password cracker uses) with sha256 for 1000 times (first iteration is using the utf-16le password salted with a *constant* salt "WDC." - without quotes -). The constant salt, by the way, makes this attack even more easy because the attacker can precompute the whole password list (e.g. a mapping from pass(+constant salt)->KEK can be pre-computed... but as already mentioned, with an easy password like this one it isn't even worth the trouble, disk space, precomputation time etc,... it can be done on-the-fly even with an old CPU).

This means that the KEK in this case is determined by 1000 times sha256 () of the utf-16le form of "WDC." concatened with "chooseapassword" which is:
4e583ccf1052ec67c89c09750440b45a80f3ba81c355c3b22432c1acae00e20b
instead of the default KEK (if no user password was set):
03141592653589793238462643383279fcebea6d9aca7686cdc7b9d9bcc7cd86

Therefore, given this edek (encrypted DEK blob from <!-- m --><a class="postlink" href="https://forum.hddguru.com/viewtopic.php?p=131488#p131488">https://forum.hddguru.com/viewtopic.php ... 88#p131488</a><!-- m -->, image was named "VCD sector locked"):



we can decrypt it with the user password "chooseapassword" (without quotes) and therefore KEK 4e583ccf1052ec67c89c09750440b45a80f3ba81c355c3b22432c1acae00e20b to:



(actually the output needs to be byte-swapped after the decryption, as also automatically done by tools like reallymine, but I stick here to this format because also the paper "got HW crypto?" uses this form of output)

This decrypted eDEK shows us that the DEK is:
6759a4cbf745fef979de587bd1bf80505fd2db95e5d52008ce990bbf1688b2be

and that the AES key is therefore (just rearrange the bytes, as tools like reallymine also automatically do):
5080bfd17b58de79f9fe45f7cba45967beb28816bf0b99ce0820d5e595dbd25f

Therefore the only correct answer (in my opinion) is that the password is "chooseapassword" (without quotes) and the AES key is 5080bfd17b58de79f9fe45f7cba45967beb28816bf0b99ce0820d5e595dbd25f (hexadecimal version of it).
I'm not sure why this wasn't mentioned in the previous posts, it was kind of confusing to me that several forum users are mentioning the DEK (and AES key) of the already unlocked disk (for which the OP already knew the keys).

Hope these facts help others in the future and that this answer helps to get rid of the confusion within this thread (about the AES key which was already known to the poster from the beginning and that he/she only posted to show the difference between edeks from locked and unlocked drives).