March 29th, 2015, 4:33
March 29th, 2015, 12:38
March 29th, 2015, 13:06
March 29th, 2015, 13:10
March 29th, 2015, 16:36
March 29th, 2015, 16:43
March 30th, 2015, 2:19
Doomer wrote:The password is correct for the key sector you have shown, so "bad password" message does not belong to the password but maybe to incorrect key sector location or something else
March 30th, 2015, 2:22
data-medics wrote:Are you working with the original drive or an image of it? If it's the original drive, you may want to clone to another as I've seen drives with bad sectors show as locked simply because they stop responding when you put the password in.
If you're working from an image of the original, make sure that you have set the LBA to be the same as the original drive is as shown when SATA connected (not as shown when USB connected).
March 30th, 2015, 2:49
March 30th, 2015, 3:30
Aug 12 15:50:58 Tower kernel: ata5.00: HPA detected: current 1953523055, native 1953525168
Aug 12 15:50:58 Tower kernel: ata5.00: ATA-8: WDC WD1001FALS-00E8B0, 05.00K05, max UDMA/133
Aug 12 15:50:58 Tower kernel: ata5.00: 1953523055 sectors, multi 0: LBA48 NCQ (depth 31/32)
March 30th, 2015, 8:45
fennec wrote:If you give me the AES key, or procedure I could make a program to decode the block from my drive?
March 30th, 2015, 14:20
fzabkar wrote:You can retrieve the drive's SA modules using SeDiv:
http://sediv2008.narod.ru/Easy3.9Passwo ... 567890.rar
http://sediv2008.narod.ru/Settings.rar
SeDiv WD Read ROM & Modules:
https://www.youtube.com/watch?v=9UgFfhkkAwY
March 30th, 2015, 14:25
fzabkar wrote:@fennec, your DMDE screenshot is showing a max LBA of 1953523054. That's a strange number.
In fact the same number (+ 1) appears in the following thread:
http://lime-technology.com/forum/index. ... 618.5;wap2Aug 12 15:50:58 Tower kernel: ata5.00: HPA detected: current 1953523055, native 1953525168
Aug 12 15:50:58 Tower kernel: ata5.00: ATA-8: WDC WD1001FALS-00E8B0, 05.00K05, max UDMA/133
Aug 12 15:50:58 Tower kernel: ata5.00: 1953523055 sectors, multi 0: LBA48 NCQ (depth 31/32)
The full native capacity of the drive should be 1953525168 sectors, so it appears that your drive may have a HPA with a size of around 2000 sectors. I suspect that you, or your friend, may have attached your drive to the SATA port of a GigaByte motherboard (or perhaps Asus). GigaByte's Xpress Recovery BIOS grabs approximately 2000 sectors from the end of the drive and hides a backup copy of itself inside a Host Protected Area (HPA).
Your can use tools such as HDAT2, hdparm, MHDD to remove the HPA.
March 30th, 2015, 14:27
Doomer wrote:fennec wrote:If you give me the AES key, or procedure I could make a program to decode the block from my drive?
I have the key but the decoding procedure is not straight forward, it is unlikely that you would be able to decrypt the drive with no knowledge of the procedure
But anyway, here is the key
A538A1B8F73104A6C19EB63E5CFAD9C3F227328016C84FF69776CA01F1E6596A
March 30th, 2015, 15:31
March 30th, 2015, 17:30
March 30th, 2015, 17:55
March 31st, 2015, 14:06
March 31st, 2015, 14:28
April 1st, 2015, 3:22
fennec wrote:Doomer wrote:The password is correct for the key sector you have shown, so "bad password" message does not belong to the password but maybe to incorrect key sector location or something else
Thanks a lot, that's a good info, I was afraid the password was bad or changed. Are you able to extract the AES key from the sector I provided, or just verified the hashing of the password? If you give me the AES key, or procedure I could make a program to decode the block from my drive?
Powered by phpBB © phpBB Group.