Toshiba SSD THNSN8960PCSE

[JayKay]

Hey peeps, Any way to unlock a Toshiba SSD THNSN8960PCSE on maximum security. Just inherited 2 of these that were being chucked out at my work place but no one knows any of the passwords. Any help would be much appreciated.

[labtech]

There is a command table at the end of this doc: http://www.hammer-drive.com/assets/uplo ... r/HK4R.pdf
May help you.

[fzabkar]

The ATA Sanitize Device command (B4h) may work under certain conditions.

ATA Command Set - 4 (ACS-4):
http://t13.org/Documents/UploadedDocuments/docs2017/di529r18-ATAATAPI_Command_Set_-_4.pdf

Seagate's SeaChest Utilities support the Sanitize command. I expect that non-Seagate drives would be supported as well.

[JayKay]

The ATA Sanitize Device command (B4h) may work under certain conditions.

ATA Command Set - 4 (ACS-4):
http://t13.org/Documents/UploadedDocuments/docs2017/di529r18-ATAATAPI_Command_Set_-_4.pdf

Seagate's SeaChest Utilities support the Sanitize command. I expect that non-Seagate drives would be supported as well.

DO you know where I can get hold of SeaChest Utilities? It's proving a bit hard hard to find.

Many thanks for your help.

[fzabkar]

http://www.hddoracle.com/viewtopic.php?f=122&t=2021

[JayKay]

http://www.hddoracle.com/viewtopic.php?f=122&t=2021

Many thanks for that. I managed to download it. I've been trying to unlock the drives all morning without success. Many of the commands come up with "Erase functions are only allowed on Seagate products".

Is there another way to send the sanitize commands?

Thanks again

[RhinoRLS]

Have there been any updates to this issue? I have about 40 of these that I am unable to unlock. Any data on them doesn't matter, I just need to make them useable again.

I've tried some hdparm commands as well as sg_opcodes commands along with Op Codes from the HK4R manual. I also tried SeaChest with no luck.

[fzabkar]

I have some ideas. Can you show us a detailed photo of the PCB?

[RhinoRLS]

Thanks for the reply! I hope these will work.

Attachments

[fzabkar]

My plan is to force the SSD to power up in error mode, or switch to error mode after it has powered on. Hopefully in this mode the security will be disabled, and we could then run a secure erase command which would unlock the SSD. This approach was used successful in a recent thread involving a Samsung enterprise SSD.

As in that other case, I propose to defeat the power loss data protection circuitry. Hopefully this will cause the firmware to panic and enter "safe mode" or "error mode". To this end there are two ICs of interest.

LTC4425, Linear Technology, Linear SuperCap Charger with Current-Limited Ideal Diode and V/I Monitor, marking LFMQ, DFN-12:
https://www.analog.com/media/en/technical-documentation/data-sheets/4425fa.pdf

TPS61030, Texas Instruments, Synchronous Boost Converter, 1.8V - 5.5V in, QFN-16:
https://www.ti.com/lit/gpn/TPS61030

The LTC4425 IC charges the Murata supercapacitor, while the TPS61030 IC boosts the capacitor voltage to 5V. This 5V supply is the backup supply that powers the SSD when power is lost.

The Sync pin of the TPS61030 appears to be grounded. Therefore, shorting the En and Sync pins should disable the 5V output. Alternatively, shorting the LBI and Sync pins should prevent the IC from detecting the supercapacitor, in which case LBO (low battery output) would be driven low. If the LBO signal is detected by the flash controller, the hopefully it will go into panic mode.

You can try shorting these pins before power-on, and then release the short once the SSD has POSTed, or you could try shorting them after the SSD has powered up. Both the En and LBI pins are connected to resistors which will limit the current, so there is no risk of electrical damage, unless you slip up.

Attachments

TPS61030_pinout.gif (14.89 KiB) Viewed 2056 times