New Drive Security Features Make Data Recovery Much Harder

[jono-ats]

New Drive Security Features Make Data Recovery Much Harder


Hard drive manufacturers continually strive to make their products more "secure." The bad news is that it often complicates data recovery, and sometimes prevents it altogether.

Data recovery engineers have to be able to work with a drive's "firmware" – a drive’s “operating system.” It's a cat and mouse game -- as manufacturers figure out new ways to try to keep us out, we have to try to figure out ways to get in.

The importance of the ability to work with a drive’s operating system can’t be overstated. One of the first things we try to do is to copy or back it up. If it corrupts later on, we can restore it. If we can’t copy it from or the drive, the recovery will be incomplete, and the client will lose data.

If some drives require head replacement, the inability to work with the firmware means that the data will be unrecoverable. Period.

Depending upon the type and severity of a drive’s failure, some models will be recoverable in some instances, and partially or totally unrecoverable in others.

While a lot of security features have been cracked for data recovery in the past, the drive manufacturers are getting better at protecting their products, and making them essentially unrecoverable – by anyone, including the drive manufacturers themselves.

Any drive can fail, and so this is a bad trend for data recovery clients.

The best defense it a good offense: make multiple copies of important data and drives, and avoid the need for data recovery altogether.

[fzabkar]

New Drive Security Features Make Data Recovery Much Harder

Hard drive manufacturers continually strive to make their products more "secure." The bad news is that it often complicates data recovery, and sometimes prevents it altogether.

Data recovery engineers have to be able to work with a drive's "firmware" – a drive’s “operating system.” It's a cat and mouse game -- as manufacturers figure out new ways to try to keep us out, we have to try to figure out ways to get in.

The irony is that American "engineers" understand the least about their own gear. When you say "we", you actually mean Russian and Chinese hackers, and some hackers from the former the Eastern Bloc. Almost no tools are developed in the US.

[jono-ats]

New Drive Security Features Make Data Recovery Much Harder

The irony is that American "engineers" understand the least about their own gear. When you say "we", you actually mean Russian and Chinese hackers, and some hackers from the former the Eastern Bloc. Almost no tools are developed in the US.

So what?

"We" is a collective term that would include the folks you list as well. I aimed to convey general info to a general audience.

Thanks. I'll ring you up when it's time to edit my next white paper.

[diybit]

The best attack is to not buy their junk drives.
Computer hardware and software and also internet have really become a shame from those past 10 years...
I'm completely disgusted from that turn...

[fzabkar]

Your post reads like a thinly veiled promotional blog. I took it upon myself to demystify the work and "figuring out" that you and your peers actually do. Let's face it, all but a handful of data recovery "engineers" are sitting back and waiting for Ace's Russian developers to "figure out" the new firmware architectures, or for secret internal information to leak out. You are a tool user, that's all.

[jono-ats]

Your post reads like a thinly veiled promotional blog. I took it upon myself to demystify the work and "figuring out" that you and your peers actually do. Let's face it, all but a handful of data recovery "engineers" are sitting back and waiting for Ace's Russian developers to "figure out" the new firmware architectures, or for secret internal information to leak out. You are a tool user, that's all.

Actually, "we" do more than "use" tools.

Here are two pics -- a WD zenith alignment jig and ultrasonic power amp for driving a multi-frequency ultrasonic bath. Both conceived and made here. There are others.

Don't BE a tool, dude.

Attachments

[pepe]

jono, leave it, we can't win
everybody is a pile of junk except one.

pepe

[jono-ats]

jono, leave it, we can't win
everybody is a pile of junk except one.

pepe

LOL!

[fzabkar]

Jono, mechanical solutions are just that, mechanical. They have nothing to do with the misleading claims in your "blog". You are waiting for a firmware solution from Ace, just like everyone else.

[pepe]

we didn't have to wait long.....

[jono-ats]

Jono, mechanical solutions are just that, mechanical. They have nothing to do with the misleading claims in your "blog". You are waiting for a firmware solution from Ace, just like everyone else.

I was responding to your claim that I was a tool user, nothing more. So I showed you some tools I made. Ace makes hardware tools too. They don't offer these . . .

I'm not a "software guy." I do minor mods to FW but that's it. Not everyone can be a hardware & software guru, polymath and diplomat like you.

However, I do know contributors on this forum who have developed their own software solutions for SSDs, hard drives, and the like. Some pretty sophisticated stuff. But don't let facts and corrections deter you, OK?

[fzabkar]

I'm not a "software guy." I do minor mods to FW but that's it.

So when you said "we", you didn't really mean "we". That's all I'm saying.

[jono-ats]

So when you said "we", you didn't really mean "we". That's all I'm saying.

No, that's not "all you are saying." And you are mistaken about "everyone else," as I explained to you.

I said "we" and I meant "we."

My statement from the initial post was, "we have to try to figure out ways to get in." That is factually correct and true, and not misleading as you claim. I do try a lot of interventions with every new drive that is locked, to overcome the security features. Usually the security is robust and I'm unsuccessful. You are right, I largely depend upon others like Ace for a solution.

I guess I should feel honored that you take time away from your projects to dump a bit of opprobrium in my direction. But it also makes me wonder . . . did someone lick the red off of your candy, or maybe you forgot the prune juice this A.M.?

In any case, I've wasted enough time and I'm done.

Have a nice day.

[lcoughey]

When my car mechanic fixes my car, he doesn't give credit to the software interface, the tool manufacturers, the lift manufacturers or the ones who wrote the manuals. They used the resources they have to find my issues and fix my car.

It also seems presumptuous that members of this forum don't work with the developers to find solutions to problems.

[rec]

Hello jono-ats,

thank you for describing the current trends with drive manufacturers!

I am wondering why the manufacturers are doing it as I think this kind of locking practice does not necessarily create a higher demand for new drives.

[einstein9]

While a lot of security features have been cracked for data recovery in the past, the drive manufacturers are getting better at protecting their products

I believe you have a point here, many companies invest & invent new technologies protecting their right & assets but at the same time There will be someone curious to break those rights to make a point...
this will never end heheh

[jono-ats]

Hello jono-ats,

I am wondering why the manufacturers are doing it as I think this kind of locking practice does not necessarily create a higher demand for new drives.

The purported reason is to prevent the counterfeiting of drives by changing firmware. For example, an unscrupulous seller could change the firmware of a 1 TB drive to report a 4 TB capacity; print a counterfeit label; and resell it. However, in the many years that we've been doing this work, we haven't seen these cases.

Another possibility is that manufacturers want to make it harder for people to decompile their firmware, in order to protect trade secrets.

A third reason is that sometimes bad actors hide data in the firmware area. It's inaccessible to the casual user, but not to them. Locking them out prevents this.

[rec]

Another possibility is that manufacturers want to make it harder for people to decompile their firmware, in order to protect trade secrets.

With only so few manufacturers left I doubt there are secrets in place.

A third reason is that sometimes bad actors hide data in the firmware area. It's inaccessible to the casual user, but not to them. Locking them out prevents this.

I agree on your third reason but would assume that manufacturers have to comply with their government. So I guess some three letter organisations want their hidden storage being well protected against curious looks of us users.

[Doomer]

The purported reason is to prevent the counterfeiting of drives by changing firmware. For example, an unscrupulous seller could change the firmware of a 1 TB drive to report a 4 TB capacity; print a counterfeit label; and resell it. However, in the many years that we've been doing this work, we haven't seen these cases.

This problem does exist and on a large scale(millions of drives are counterfeited every year). It just does not exists in the US.

Another possibility is that manufacturers want to make it harder for people to decompile their firmware, in order to protect trade secrets.

That too

A third reason is that sometimes bad actors hide data in the firmware area. It's inaccessible to the casual user, but not to them. Locking them out prevents this.

Likely not

Another reason is a demand from the customers (I'm talking about big guys, like Dell). There is feature called Secure Boot, that has been cooking for many years. And that feature requires hard drives and SSDs to be a little more secure. And not just storage but BIOSes of computers, operating systems, and many other things.
We live in the age of data security now