Re-Use Toshiba SSDs with ATA-lock

[UnknownLink54]

Hi,

I am trying to re-use some older SSDs from an enterprise SAN system. The system was decommissioned, but I still have the SSDs. After stripping them from the case/carrier, I attached them directly via SATA (no USB adapter or whatsoever) to a small test-system of mine.

HDparm gets me the following information:

Code:

sudo hdparm -I /dev/sda

/dev/sda:

ATA device, with non-removable media
        Model Number:       TOSHIBA THNSNJ1T02CSY
        Serial Number:      ************* (blurred)
        Firmware Revision:  JYPS4101
        Transport:          Serial, ATA8-AST, SATA 1.0a, SATA II Extensions, SATA Rev 2.5, SATA Rev 2.6, SATA Rev 3.0
Standards:
        Supported: 9 8 7 6 5
        Likely used: 9
Configuration:
        Logical         max     current
        cylinders       16383   16383
        heads           16      16
        sectors/track   63      63
        --
        CHS current addressable sectors:    16514064
        LBA    user addressable sectors:   268435455
        LBA48  user addressable sectors:  2000409264
        Logical  Sector size:                   512 bytes
        Physical Sector size:                   512 bytes
        Logical Sector-0 offset:                  0 bytes
        device size with M = 1024*1024:      976762 MBytes
        device size with M = 1000*1000:     1024209 MBytes (1024 GB)
        cache/buffer size  = unknown
        Form Factor: 2.5 inch
        Nominal Media Rotation Rate: Solid State Device
Capabilities:
        LBA, IORDY(can be disabled)
        Queue depth: 32
        Standby timer values: spec'd by Standard, no device specific minimum
        R/W multiple sector transfer: Max = 16  Current = 16
        Advanced power management level: 254
        DMA: mdma0 mdma1 mdma2 udma0 udma1 udma2 udma3 udma4 *udma5
             Cycle time: min=120ns recommended=120ns
        PIO: pio0 pio1 pio2 pio3 pio4
             Cycle time: no flow control=120ns  IORDY flow control=120ns
Commands/features:
        Enabled Supported:
           *    SMART feature set
           *    Security Mode feature set
           *    Power Management feature set
           *    Write cache
           *    Look-ahead
           *    Host Protected Area feature set
           *    WRITE_BUFFER command
           *    READ_BUFFER command
           *    NOP cmd
           *    DOWNLOAD_MICROCODE
           *    Advanced Power Management feature set
                SET_MAX security extension
           *    48-bit Address feature set
           *    Device Configuration Overlay feature set
           *    Mandatory FLUSH_CACHE
           *    FLUSH_CACHE_EXT
           *    SMART error logging
           *    SMART self-test
           *    General Purpose Logging feature set
           *    WRITE_{DMA|MULTIPLE}_FUA_EXT
           *    64-bit World wide name
           *    WRITE_UNCORRECTABLE_EXT command
           *    {READ,WRITE}_DMA_EXT_GPL commands
           *    Segmented DOWNLOAD_MICROCODE
           *    Gen1 signaling speed (1.5Gb/s)
           *    Gen2 signaling speed (3.0Gb/s)
           *    Gen3 signaling speed (6.0Gb/s)
           *    Native Command Queueing (NCQ)
           *    Host-initiated interface power management
           *    Phy event counters
           *    Host automatic Partial to Slumber transitions
           *    Device automatic Partial to Slumber transitions
           *    READ_LOG_DMA_EXT equivalent to READ_LOG_EXT
           *    DMA Setup Auto-Activate optimization
                Device-initiated interface power management
           *    Software settings preservation
           *    SMART Command Transport (SCT) feature set
           *    SCT Write Same (AC2)
           *    SCT Error Recovery Control (AC3)
           *    SCT Features Control (AC4)
           *    SCT Data Tables (AC5)
           *    SANITIZE feature set
           *    BLOCK_ERASE_EXT command
           *    DOWNLOAD MICROCODE DMA command
           *    SET MAX SETPASSWORD/UNLOCK DMA commands
           *    WRITE BUFFER DMA command
           *    READ BUFFER DMA command
           *    DEVICE CONFIGURATION SET/IDENTIFY DMA commands
           *    Data Set Management TRIM supported (limit 8 blocks)
           *    Deterministic read ZEROs after TRIM
Security:
        Master password revision code = 65534
                supported
                enabled
                locked
        not     frozen
        not     expired: security count
                supported: enhanced erase
        Security level maximum
        2min for SECURITY ERASE UNIT. 2min for ENHANCED SECURITY ERASE UNIT.
Logical Unit WWN Device Identifier: 500080d910c09e3e
        NAA             : 5
        IEEE OUI        : 00080d
        Unique ID       : 910c09e3e
Checksum: correct

• So we have an ATA-Lock here. This makes sense, because it was an enterprise system beforehand
• The security level is "maximum". Therefor i can not use the master password to unlock the drive -> but i should be able to use the secure erase function
• The "Master password revision code" is 65534. This means the factory default master password has not been changed. (would be "1" otherwise)

I am not interested in any of the data on the SSD, because I want to re-use them. So I tried to Secure Erase them with the "default" master password I found online for Toshiba Drives: " " (=32 Spaces)

Code:

sudo hdparm --user-master m --security-erase "                                " /dev/sda
security_password: "                                "

/dev/sda:
Issuing SECURITY_ERASE command, password="                                ", user=master
SG_IO: bad/missing sense data, sb[]:  70 00 05 00 00 00 00 0a 04 51 40 01 21 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

This is where I am stuck now. I have no idea how to analyze this error or how to solve it.

I do not think the password is currently the problem: If I run the command a few times and it would only fail because of a wrong password, there should be a security mechanism be activated. After entering the wrong password 5-times, the security option "expired: security count" would be enabled. This means you have to reboot the disc to get 5 new tries. But even after running the command several times with wrong passwords on purpose, the security option is not enabled. So I think he is not even getting to check the password.

In addition I tried a few things:

• Use another SSD to be sure it is not a broken one
• Use another internal SATA connector/chipset
• Use another mainboard (non-UEFI)

It is no SED disc, i checked that with SEDutil:

Code:

sedutil-cli --scan
Scanning for Opal 2.0 compliant disks
/dev/sda  No  TOSHIBA THNSNJ1T02CSY            JYPS4101
/dev/sdb  No
No more disks present ending scan

sedutil-cli --query /dev/sda
Invalid or unsupported disk /dev/sda

Any of you have an idea to solve this?

And yeah i know: It would be much easier, cheaper to just get new SSDs, but i have those and want them to work

[fzabkar]

Can you show us detailed photos of each side of the PCB (so that we can identify the markings on the ICs)?

[Arch Stanton]

Maker of txbench also made a utility called "removepwd.exe" for SATA SSD, I have never used it personally but may be worth a try. If you can not find it let me know, I can share it.

[fzabkar]

Is this it?

https://www.texim.jp/dl/RemovePwd.zip

[Arch Stanton]

Is this it?

https://www.texim.jp/dl/RemovePwd.zip

Yes.