Partition Recovery: PS3 Internal HDD {NEED HELP}

[AcuraKidd]

I need your help guys, this is gonna require lots of knowledge about Partition Recovery and how the Sony PS3 system works.

Here's what happened,

I took out my internal PS3 HDD and used a sata connector to hook it up to my pc via usb. My computer didn't recognize it. I later learned it's because Sony uses some kind of proprietary format that Windows will not recognize. Not knowing this, I went into the Disk Management utility on my Windows 7 pc, and up came a pop up asking if I want to apply MBR or GPT.

Not knowing what this meant, I selected MBR, thinking it was gonna make this hard drive readable so I could copy my data off it. Well, the setting quickly applied, and the drive is still not readable. I did nothing further except for closing the utility and disconnecting the drive.

Now I placed it back into my PS3 and it gives me an option to format it before it boots up the system, if selecting no, it says "Cannot Start, the correct hard disk was not found"

I've asked around for advice on [url="http://psx-scene.com/forums/f177/need-help-ps3-internal-hdd-corrupted-102686/"]PSX-Scene[/url]

From my understanding, the data on the drive is still there, it's just something wrong with the partition. Does anybody know of a method to fix this?

[jim]

If the data is important for you let a professional do it for you.
If you think you have sufficient skills first make a clone. Always work on a clone.
testdisk can do the job.

Success

[hddguy]

I later learned it's because Sony uses some kind of proprietary format that Windows will not recognize.

The file system is proprietary and I believe it is based on a JFS2 system. Also the unit uses 256 bit AES encryption for which the hardware key is linked to the individual console itself rendering it impossible to access both on another PS3 system and as an external disk to your windows PC.

Even a professional service will have difficulty in retrieving this for you. There are solutions available that can use the console to decrypt it, but I have never tried. Even fi it is decrypted, you would still need to gain access to the proprietary file system which is a job in itself.

[warnerr]

HdGuy is correct. Due to the encryption its virtually game over. Hopefully you used Sonys back up service. Drive can be salvaged and reinstalled to system. The P.S. forum has the procedure to 'add a larger drive' .

[fzabkar]

AISI, the OP's problem may have a potentially simple solution.

It appears that Windows 7 has overwritten sector 0 of the PS3 drive. Assuming that is all that was done, then it may be possible to use the PS3 to recreate sector 0 on another drive, and then copy sector 0 from this second drive back to the original drive. Of course this assumes that the PS3's HDD formatting is consistent for any drive installed in a particular console. Furthermore, my research would suggest that LBAs 0-20 are Sony's security sectors.

Therefore, my suggestion would be for the OP to install a spare HDD in the PS3, format it, and then transfer it to a PC and use a disc editor (eg HxD or DMDE) to save a copy of LBAs 0-20.

I would then do this again for the same drive. If the sector dumps are identical, then this would suggest that the encryption key is not randomly generated.

I would then do this a third time, using still another drive. This will tell us whether the drive's own parameters (eg model number, serial number, firmware version) are used in the encryption process.

If the sector dumps are identical in all cases, then I would copy sector 0 to the original drive and hope for the best. Otherwise, if the contents of sector 0 are in some way dependent on the drive, then I would suggest that the original drive be cloned, sector by sector, and then reformatted by the PS3. Then save the newly formatted copy of sector 0, recreate the original drive from the clone, and replace sector 0 with the newly saved copy.

[jim]

If only the MBR has been changed then you only have have to change the first sector like it was.

[fzabkar]

If only the MBR has been changed then you only have have to change the first sector like it was.

How would you go about doing that?

[hddguy]

I would suggest that the original drive be cloned, sector by sector, and then reformatted by the PS3. Then save the newly formatted copy of sector 0, recreate the original drive from the clone, and replace sector 0 with the newly saved copy.

There is a 'hidden' option that can be accessed from the console that can be used to repair bad filesystem. Maybe it will work, maybe not i dont know. But you should take the advice from Frank, seems totally plausible to me.

[jim]

My guess is that the encrypted file system is on a partition. So only the partition-table has been changed.
Let testdisk find the partition and write it the to the MBR. After making a clone.

[hddguy]

Let testdisk find the partition and write it the to the MBR. After making a clone.

How do you propose to do this when partition table (and everything else) is encrypted??

What exactly do you write? How do you know it is even valid?

[jim]

I dont think the whole hdd is encrypted :

http://www.google.nl/url?sa=t&rct=j&q=& ... VX8UQKcdQg

quote: Although the Game OS partition is encrypted, the PS3 does not encrypt the Other OS
partition (as described below)

[jim]

quote :What exactly do you write? How do you know it is even valid?

You write a new partition table to the MBR

quote : How do you know it is even valid?
You don't

That's recovery

[shahij]

If I would be there - I would use a spare HDD with the PS3, then would Clone the sector 0.

AISI, the OP's problem may have a potentially simple solution.

It appears that Windows 7 has overwritten sector 0 of the PS3 drive. Assuming that is all that was done, then it may be possible to use the PS3 to recreate sector 0 on another drive, and then copy sector 0 from this second drive back to the original drive. Of course this assumes that the PS3's HDD formatting is consistent for any drive installed in a particular console. Furthermore, my research would suggest that LBAs 0-20 are Sony's security sectors.

Therefore, my suggestion would be for the OP to install a spare HDD in the PS3, format it, and then transfer it to a PC and use a disc editor (eg HxD or DMDE) to save a copy of LBAs 0-20.

I would then do this again for the same drive. If the sector dumps are identical, then this would suggest that the encryption key is not randomly generated.

I would then do this a third time, using still another drive. This will tell us whether the drive's own parameters (eg model number, serial number, firmware version) are used in the encryption process.

If the sector dumps are identical in all cases, then I would copy sector 0 to the original drive and hope for the best. Otherwise, if the contents of sector 0 are in some way dependent on the drive, then I would suggest that the original drive be cloned, sector by sector, and then reformatted by the PS3. Then save the newly formatted copy of sector 0, recreate the original drive from the clone, and replace sector 0 with the newly saved copy.

Everything is explained clearly...

[fzabkar]

I dont think the whole hdd is encrypted :

http%3A%2F%2Fwww.computerforensicexaminer.com%2Fcomputer-forensics-expert-florida-miami-palm-beach-lauderdale-dave-kleiman-forensic-training-files%2FForensic_Analysis_of_a_Sony_Play_Station_3_PS3_Gaming_Console.pdf

quote: Although the Game OS partition is encrypted, the PS3 does not encrypt the Other OS
partition (as described below)

But surely sector 0 is in the encrypted section at the beginning of the drive?

In any case page 15 of the document suggests that a cloned HDD will function just like the original, so the security information appears to be specific to the console hardware, not to the drive. This would tend to confirm that one could copy sector 0 from a functioning drive to the original HDD, although one should probably choose a drive of identical capacity (or cut a larger drive to the original size) when formatting it.

That said, the document also states that the OS updates various sectors throughout the drive at every power-on.

"We found were numerous differences occurred in block-sized chunks randomly throughout the hard drive. The differences, however, were much more numerous in the beginning of the hard drive and became much more sparse farther down the hard drive. This test suggests that the console writes some kind of time stamp and/or random data to the hard drive every time it is powered on."

Hopefully sector 0 is not touched.