All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 9 posts ] 
Author Message
 Post subject: Data recovery from encrypted SSD. I know the password!
PostPosted: September 9th, 2017, 8:10 
Offline

Joined: September 9th, 2017, 8:09
Posts: 5
Location: Europe
I am trying to access my encrypted samsung evo 840 SSD
I had battery charging issues on my old laptop but the hard drive WAS WORKING until laptop battery discharged completely.

1. Drive is working now.
2. It was encrypted by setting ATA drive password in BIOS.
3. I know the password, I entered it many times on my old laptop.

After moving hard drive few months later to my new laptop I was not able to access it.

Drive is detected by the computer.
I enter ATA password.
It acts like the password is wrong.

From what I learned so far the issue is that my old laptop used different way
to set/unlock ATA password. It was 2013 laptop samsung 370r5e.
I found topics where people describe similar issues
and resolved them by plugging the hard drive to the old laptop.
So I can unlock it in an older machine.

My old laptop (samsung 370r5e) had 8 char ATA password and my new laptop uses 16 (or 32; not sure) password. And thats the main issue. There are different way ATA passwords are set and read?

Solutions:
1. Useing MHDD is probably not posible.
My new laptop (lenovo 700-15isk) demands I enter drives ATA password before booting into MHDD, cant go past it.
Can I install some unofficial moded BIOS to boot MHDD and skip BIOS password prompt?
Maybe some moded BIOS that will use some old ATA password scheme?
Do mods like this exist and where would I find them?
Maybe running older BIOS version on my laptop that used 8 char passwords? Not sure where could I find them.
I can boot MHDD and than plug in my SSD after to skip password requirement but I dont know how risky it is to plug in drives while system is running. Is there a safe way to do it? SATA is plug and play right ;)
2. Repairing my old laptop.
The issue is that is does not charge the battery. I checked the charger and it works OK. Laptop worked fine until battery went to 0%. I would have to replace motherboard to fix it. Its expensive ;)
3. Connecting drive using USB adapter.
Are there ways to send ATA commands to the drive connected via USB adapter?
Is there a software that could do it and turn off the ATA password? I have 100% the right password.
4. Trying different PC
If you tell me that MHDD definitely had the different ATA password schemes worked out I could buy some 30 euro used desktop PC to run it.
Would still be cheaper than sending drive to data recovery center to unlock it.
I know that people where able to run MHDD by skiping BIOS ATA password prompt in desktops.


Top
 Profile  
 
 Post subject: Re: Data recovery from encrypted SSD. I know the password!
PostPosted: September 10th, 2017, 13:28 
Offline

Joined: August 13th, 2016, 17:10
Posts: 48
Location: Vienna, Austria
When you want to buy an USB adapter, make sure you buy an USB adapter that supports the UASP protocol, with it you can send all commands to it (and it shouldn't be far more expensive than normal USB adapters)
I don't think that BIOS-modding is a viable way.
I don't know much about how the BIOS passwords interact with the EVO840 yet, because I didn't used BIOS passwords with mine yet, but I could research it if it's really necessary. Something I stumbled across when I tried the OPAL interface of the EVO840 was that the EVO840 reported "MaxAuthentications = 5" with sedutil. I am not sure what this really means, but I guess that it might mean that you have 5 tries to enter the password in a wrong way. I don't know whether that relates to the BIOS password as well or only to the OPAL password.
At the moment I assume that your EVO840 is still working, and that the problem with the password entering is on the BIOS side. But if it doesn't work out, you might want to use my diagnostics tool https://github.com/thesourcerer8/SSDdiag in the future.
SATA is designed for plug&play. I experienced one laptop where the designers turned off the plug&play to save some power, so it didn't detected the SSD when it was not attached during booting later on. But this was reconfigurable.

Can you run the old laptop with a power supply? Try to remove the battery. If it works, then remove the password from that old laptop.

Otherwise I would suggest to try to buy a UASP capable USB adapter, and try to attach it to an already running Linux system, and use hdparm to enter the password. But if you do not feel comfortable with that, better ask for help.


Top
 Profile  
 
 Post subject: Re: Data recovery from encrypted SSD. I know the password!
PostPosted: September 10th, 2017, 14:42 
Offline

Joined: September 9th, 2017, 8:09
Posts: 5
Location: Europe
Thanks for the response, got a lot of help here and on different forum and have few ideas how I can try to unlock it.
On my lenovo 700-15isk I can try to enter password 3 times and power to the drive have to be cut to try again.
I enter same password I always did and its wrong. Old laptop had 8char max password, new one has 16 char password. I tryed following my 8 char password with 8 zeros "0" and it still fails.

There is some kind of diference with the way my old and my new laptops send those passwords to the drive.
Found here a topic where the problem is exacly this same. (https://forum.hddguru.com/viewtopic.php ... le=desktop)

About fixing old PC. Tested it with multimeter and power adapter is properly connected. The issue is with the circuitry that deals with voltage from power adapter. Laptop gets that 19V in (or whatever it is) but seams like components don't get power, battery does not charge, cant turn laptop on.
I tryed it with battery unplugged, no power.
The laptop was working fine on battery so was thinking about using power supply connected in place of the battery. I don't have a power supply that I could use for this.

And I don't know so much about laptops that I could find broken component. Its probobly one of the voltage regulators or supporting circuitry (resistor/capacitor).

For now I got an old lenovo T60 for 20 euro and I will try to use it to:
1. unlock during normal bootup (its an old laptop with hopefully an old ATA implementation, I don't expect passwords to be longer than 8 char).
2. Trying to run MHDD or Vicotria or that linux tool
3. if on T60 I wont be able to skip password prompt during bootup I will use one of the moded BIOSes for T60. Hopefully I can boot some system while this drive is connected.
For some reason laptops stop bootup if you dont type correct password. So booting MHDD or linux is imposible. (tested on my lenovo 700-15isk and a dell that i have access to)
Running MHDD would not be a problem if I had a desktop PC, they usually allow skipping ATA password and booting from one off the other drives.
-----
(4. Hotplugging encrypted drive while laptop is running and trying Victoria.)
5/6 Buying (and selling/returning) laptop just like the one I had to unlock the drive.
5/6 Getting USB - sata adapter

edit:
My lenovo has very minimal BIOS, The advanced menu is blocked and I need special hardware to rewrite the chip to unlock it.
The only thing I can do in my BIOS is changing the order for boot list. Even if I put USB as 1st boot device, it is trying to initialize the hard drives and shows the password prompt, cant skip this. Cant stop BIOS from displaying the prompt.
I dont think desktop PC's have this problem, they allow skipping the prompt. That's why I want to use moded BIOS.


Top
 Profile  
 
 Post subject: Re: Data recovery from encrypted SSD. I know the password!
PostPosted: September 10th, 2017, 15:51 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 9749
Location: Australia
Can you boot from a Linux CD? If so,then place your SSD inside a USB enclosure and run the following "ata_security_remove_password" HDDSuperTool script:

http://www.sdcomputingservice.com/hddsupertool
http://www.sdcomputingservice.com/hddlivecd
http://www.sdcomputingservice.com/hddsupertool/scripts/ata_security_remove_password?attredirects=0&d=1

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Data recovery from encrypted SSD. I know the password!
PostPosted: September 10th, 2017, 17:51 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 9749
Location: Australia
@haczet, if you would like to troubleshoot your old laptop, I could try to help you. Just upload detailed photos of both sides of the PCB to the HDD Oracle forum (this forum is probably not the best place for such threads). Alternatively, you could post to badcaps.net. Many good component level techs hang out there.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Data recovery from encrypted SSD. I know the password!
PostPosted: September 10th, 2017, 19:09 
Offline

Joined: September 9th, 2017, 8:09
Posts: 5
Location: Europe
fzabkar wrote:
Can you boot from a Linux CD? If so,then place your SSD inside a USB enclosure and run the following "ata_security_remove_password" HDDSuperTool script:

Can boot anything, just not with the drive connected to the PC ;)
I will get that T60 lenovo on Tuesday and will try to unlock the drive. It is an self encrypting drive, so simply removing the password would mean data loss.
The data is not encrypted with my password, its encrypted with an encryption key (stored on a chip?). And that encryption key itself is encrypted with the ATA password. That's my understanding of things.
And I know the freaking password, I have it even written down in my SafeInCloud password manager.
First will try on board connectors on T60, MHDD and normal stuff, and than I will look into USB adapters and scripts.

fzabkar wrote:
@haczet, if you would like to troubleshoot your old laptop, I could try to help you. Just upload detailed photos of both sides of the PCB to the HDD Oracle forum (this forum is probably not the best place for such threads). Alternatively, you could post to badcaps.net. Many good component level techs hang out there.

First I want to deal with my old system drive, and hopefully retrieve the data and copy my windows set up.
I spend a lot of time "tuning" windows and apps and all the settings to my needs and that's probably the biggest loss if I don't recover that data.
I have most of the important stuff on other drives. On 120GB SSD most of it was just games, emails, windows and mp3 collection. But I want to import setting from all the aps and copy my windows set up.
Will definitely look into repairing that old motherboard later on, it is still quite powerful and slim laptop with i3 on board.


Top
 Profile  
 
 Post subject: Re: Data recovery from encrypted SSD. I know the password!
PostPosted: September 10th, 2017, 20:05 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 9749
Location: Australia
haczet wrote:
fzabkar wrote:
Can you boot from a Linux CD? If so,then place your SSD inside a USB enclosure and run the following "ata_security_remove_password" HDDSuperTool script:

Can boot anything, just not with the drive connected to the PC ;)
I will get that T60 lenovo on Tuesday and will try to unlock the drive. It is an self encrypting drive, so simply removing the password would mean data loss.

AIUI, there is no difference in the way that the password is set or removed as far as ATA commands are concerned. The difference between SEDs and non-SEDs is transparent to the BIOS. The way that a SED handles the password internally is different, as you have described, but removing the password (via the SECURITY DISABLE PASSWORD ATA command) should simply restore the unencrypted key. It is not data destructive.

If the SECURITY DISABLE PASSWORD command concerns you, then use the SECURITY UNLOCK (F2h) command instead.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Data recovery from encrypted SSD. I know the password!
PostPosted: September 11th, 2017, 9:03 
Offline

Joined: January 8th, 2008, 5:21
Posts: 801
Location: uk
Maybe the old samsung 370r5e laptop bios will hash the Ata password when input by the keyboard so the password you type in will be different to that stored on the drive? Maybe somebody here knows?

You could easily test this out by using an older type WD sata drive and setting an Ata password. Then read the mammoth thread by Rockhound and use the info to view the password as stored on the drive.

Of course if the old laptop works you could simply unlock the drive and the job is done.

also....
Quote:
Can boot anything, just not with the drive connected to the PC

Usually you can disconnect the drive and power on the laptop, and when the system boots you can very carefully connect the drive to the sata port. There is a good chance Mhdd or the like can then see the drive.


Top
 Profile  
 
 Post subject: Re: Data recovery from encrypted SSD. I know the password!
PostPosted: November 7th, 2017, 16:40 
Offline

Joined: September 9th, 2017, 8:09
Posts: 5
Location: Europe
Didn't have the time to unlock the drive till now.

Got a 50 euro Dell optiplex380 desktop PC.
Connected the drive to sata.
Unlocked the drive in BIOS on first run with this same password that I always used.
All data recovered.

F*** laptop BIOS man

edit: Also talked to low level Samsung support, they told me its not possible to recover data


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 9 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 5 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
cron
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group