Hello,

My apologize for my English :

I come to you to explain my problem.
I try to take different passwords present on HDDs in order to regain access.
Datas inside are not important.


I am currently testing on the following drives:

HTS721060G9SA00 : FFFEh → Master Password is not changed Maximum
HTS 721060G9SA00 : FFFEh → Master Password is not changed High

HTS 721010G9SA00 : FFFEh → Master Password is not changed High
HTS 721060G9SA00 : FFFEh → Master Password is not changed Maximum

HTS 723216L9SA60 : 4001h → Master Password is changed Maximum
HTS 541612J9SA00 3H : 4001h → Master Password is changed High

WDC WD1200BEVS-08UST0 : 4001h → Master Password is changed Maximum

I use a PC where i put HDDs in and where I boot through LiveUSB and LiveCD.
And a laptop, where each disk shows me :

http://img845.imageshack.us/img845/5483/lockc.jpg

(in this configuration, no BIOS access with hard disk inside. But if i don't put it, access to the BIOS is feasible, boot choice, launch LiveCD etc ... so the problem comes from the HDD)



So, I plug HDDs on the desktop computer.
Here, no problem with access to the BIOS, HDDs are detected, I can change the boot order and parameters that seem important for tests :

http://img41.imageshack.us/img41/399/sataconfig.jpg



Here differents tests :

MHDD :
- I tried different Master Password found on the net (32 spaces, WDCWDC... etc) with UNLOCK (then 1), but none of them was accepted. Even on disks where passwords are not changed.

- I tried different scripts : .dump ; .dump2 ; .dump48

I get this error : « NO DRQ » or « driver report error »...

Script works. -> on unprotected HDD, 21.bin and 22.bin files are generated.


ZU BETTA :

I set the BIOS configuration like this :
SATA Configuration: Compatible
Configure SATA as : IDE

I put a hard drive on each SATA 1 and SATA 2.

I use the following functions :

ZU.EXE /P
ZU.EXE /S
ZU.EXE /A =>never ends, just show a timer...

Some HDDs : « Unrecognized disk »
For others : « UNLOCK NOT DONE »

I also tested :

ZU.EXE /P. → UNLOCK NOT DONE

ZU.EXE /P8 → ask for the screw... but not very understandable on what to do exactly

I tried on functional disks => NO PWD or NOT SUPPORTED

The program seems to work...


Linux, HDPARM :

I tried hdparm commands :
sudo hdparm --user-master u --security-erase NULL /dev/sda
sudo hdparm --user-master poopie --security-set-pass Eins /dev/sda

With adding « sudo » before each command(to prevent access denied)
→ Input/Ouput Error



Partition Magic:
=> Error Output/Input


I tried everything I could find on Hiren's Tool and UBCD :
Darik's Boot And Nuke : ERROR /dev/sda (process crash)
PartedMagic : Disk Eraser → Error
Gparted : Input/Output error during read on /dev/sda
...

MHD3.EXE :
Sending Security_Erase_Prepare
Sending Securiy_Erase_Unit
Sending master password
.
Unknown error, if drive is locked try again


or


Sending Security_Erase_Prepare
Sending Securiy_Erase_Unit
Timeout waiting for drive (Security_Erase_Unit)


EaseUS Partition Master :
There are some error occurred while writing partition chains on disk.


- I can't find and I don't know how to update the firmware of a disk. Maybe it could be remove the password, but I doubt of it.


I also interchanged PCB card between two hard drives with the same reference : disks are not recognized (by giving their respective card, they are still functionnal)

Many others tests are done, which are always in relation to the input / output error.

I hope I can find advices, these methods seem to work on various forums(French, English,Russian...) although some people have errors too.






Other test :

I apply, by the BIOS, an User and Master Password on a hard drive unlocked.
I get the same password request screen on the laptop.
I check in MHDD if I have the same ATA PASSWORD LOCKED, which is the case.

The hard disk is now locked like the others, expect for this one, i know the user and master password and i know that the HDD is OK.

Now, I want to see if my previous tests work on this one :

Script DUMP : Always « No DRQ » error. Confirm that these scripts are probably only for Western Digital HDD.

ZU Betta :
zu.exe /s =>
ELAPSED 00:00:01
MCZOC10HHitachi HTS721010G9SA00
NOT SUPPORTED

zu.exe /s. => UNLOCK NOT DONE

MHD3.EXE :
Unknown error, if drive is locked try again

HDDHACKR :
dump Sectors 16-22 : Reading HDD sectors failed !
DRQ Error:0x0802

HDPARM Commands:
Input/output error

Master password revision code = 16384

supported
enabled
locked
not frozen
not expired:security count
Security level high


Gparted :
Input/Output error during read on /dev/sda


TestDisk :
Partition : Read error



Others tests give exactly the same results as the others drives.

Disks which are locked probably work without problems. So, I have a problem somewhere ? … because these methods work for some people.

I hope to get some help or news ideas , thank you

And again.... My apologize for my English.

Although you English language skills are better than my French there are some unclear parts of your story. As far as I can see, you have made some assumptions which make your testing (in some parts) a waste of time. Here are some brief comments; of course other readers may have different opinions:

a)
From your comment, it seems that you do not know this (i.e. you don't know that the disks work OK, and are only locked). This is bad news for you, because other problems can also cause a disk to appear to be locked, when the real problem is elsewhere.

b) Some of your techniques / utilities are specific to some disk families, and so some of your tests are expected to fail.

c) You have assumed that Master Password value = FFFEh means that the Master Password is unchanged. This is an incorrect assumption. It is easy to change a disk's Master Password, so that it will still report that value. Changing that reported value to be different from FFFEh, when changing the Master Password itself, is optional.

If you really want to play with disk passwords, I suggest that you start with definitely working (but unimportant) unlocked disks, then apply known ATA passwords (preferably not using the BIOS and preferably not using a laptop, due to the extra complications with those can add). Then play.

You can run SMART extended tests on password locked drives

_________________
All went well until I plugged the drive in.

I only work on a disk which is operating. I have put the password(master/user)on it to find a way to solve the problem.

SMART (and others) :

HD Tune :
http://imageshack.us/photo/my-images/59 ... 60501.jpg/

(HD Tune benchmark)
http://imageshack.us/photo/my-images/51 ... 65602.jpg/

Informations (Victoria) :
http://imageshack.us/photo/my-images/29 ... 85103.jpg/

SMART :
http://imageshack.us/photo/my-images/84 ... 22501.jpg/
http://imageshack.us/photo/my-images/19 ... 24702.jpg/

I tried : smartctl -t long /dev/sda but no more noise after 15 seconds
I have to try it on other version of Ubuntu.

Unfortunately your story is not clear enough for me to understand. I will try to ask some questions to clarify the parts of your story which are missing / unclear. Please try to be clear, exact and unambiguous in your answers, otherwise readers may not be able to help you, if you cannot be understood clearly.

You now say that "I only work on a disk which is operating." Do you mean that you are now only testing one specific drive, instead of the many drives which you listed originally?

Am I correct in guessing (from the images) that all your testing is now with one specific Hitachi HTS721010G9SA00 drive?

Assuming your answer to the previous question is "yes" then, to be clear - did you set the user & master passwords on this drive, or were the user & master passwords set by someone else?

If you set the user & master passwords, how exactly did you set them? Please specify the exact commands which you used.

What exactly is the "problem" which you are trying to solve? For example, some of the unlock techniques which you listed originally, will not work on that Hitachi drive, and so some of your original results are expected and so are not a problem (as I said in my first reply, point (b)). Some of the other programs which you ran, with a password-protected drive (e.g. GParted) will also fail (as expected) when the drive is locked. This is also not a problem.

Therefore you must be very clear about exactly what "problem" you are trying to solve - perhaps your "problem" is actually just your misunderstanding about what should happen?

If you answer all the above questions clearly then perhaps someone will help you, if they have enough time to reply...

Yes, I am only testing one specific drive now (Hitachi HTS 721010G9SA00)
I set myself the user and master passwords on this drive.
Lenovo T400 : BIOS → Security → Password → Hard Disk1 Password → User+Master
User and Master passwords : « bb »


I am trying to remove this User and Master passwords without knowing them.

So, i used different methods that I put in my first post.

I wish to avoid or remove these passwords to get access to the hard drive. (datas in the hard drive are not important at all)

I don't want to use a specific method of my first post, just want a method that can work.

I hope I have been a little more clearer.
Anyway, thank you for taking time to answer me and do not hesitate to ask me others questions.

then



uhm....

Anyway you won't get out of the "problem" with the stuff you are using. Assuming also there is no other problem that make the drive appear locked.

That's why I use a functional disk. I locked it myself in order to be certain that my problem is only the password.
There's a lot to unlock, so I prefer to test methods on a disk that has no other problems.

The WD1200BEVS-08UST0 may have firmware that locks you out of the System Area (SA) when a password is set. There are ways to get in, though.

See viewtopic.php?f=1&t=25895&start=40

BTW, even when you know the password, your response to a password challenge may still fail if you use a different system than the one that generated the password. For example, a laptop's BIOS may record a password in the form of keyboard scan codes rather than ASCII characters, so if you use a desktop application to enter the password as ASCII, then you won't get in.

As for ZU, see http://malthus.zapto.org/viewtopic.php?f=95&t=166

_________________
A backup a day keeps DR away.

Hitachi are not exactly the right drive to experiment on and many other (esp. newer) are still extremely difficult to handle about security issues even with very expensive tools, so be careful or you will likely end up with bricked drives. Just this.

@scad06,

Since you've replied to my questions (thanks for that), I just wanted to comment on what you've said, so that you don't think I've ignored your reply.

a) It is now clear that the results you were getting with this locked Hitachi drive, were normal for the tests you were doing.

b) Although I work in another part of the data storage industry, not in DR (so I don't claim to know the latest developments), I am not aware of a software-only unlock utility for those Hitachi drives. In other words, you have set yourself a challenge where you may not be successful, as BlackST highlighted.

c) Earlier you said that: "these methods work for some people". Success depends on the specific disk (as well as the techniques and software used). That's why you have read about some successes (with disk X), even when you are having problems (with disk Y) - you had wrong expectations of success, due to differences between your situation and the successful ones.

d) As I said earlier on this thread (and on previous threads), using a laptop typically introduces some extra challenges when "playing with disk passwords"- fzabkar explained one of them, and there is at least one more that I've seen.

In short - if you want to play (as it seems that you do), then I hope you have fun but personally I doubt you'll be successful unlocking that drive any other way. Although ATA passwords are sometimes just "security through obscurity" (due to information which is now public) this is still a sensitive area, as these unlocking techniques can allow criminals to either (i) access the owner's personal data on laptops / disk drives which they have stolen, or (ii) sell stolen laptops etc. more easily, when they appear (to a potential buyer) to be working (i.e. unlocked), instead of locked.

As an analogy: Would you want to have lots of public disclosure of how to bypass your front door locks & your alarm system, knowing that the more this information is publicly distributed, the greater the chances of criminals reading those techniques (even though such techniques are already known to locksmiths in private)? Therefore don't be surprised if some people are understandably reluctant to add to the public disclosure of such password unlocking information. Have fun!

As a consequence of too much talking in the wrong way in the wrong places, drive vendors are changing FW and policy. The most evident result is the impossibility of self repair on new drives and in an increasing number of case impossibility of unlocking them even with expensive tools.

HOW TO REMOVE HITACHI 2.5 PASSWORD / UNLOCK (Salvation Data)
Step 1. REMOVE PCB FROM THE HARD DRIVE and connect to the HD Doctor HITACHI and go to NVRAM EDIT and CHANGE 0501 to 0500 and WRITE and click LOAD to confirm if value has been changed to 0500
Note: sometimes it shows 0401 instead of 0501 (follow the same procedure)
Step 2. Return the PCB to the Hard drive and select SA-C and go to READ FIRMWARE and select 16 ICES And click on READ to save the firmware copy in database folder
Step 3. Go to Load management choose SA-A then update firmware Select 16 ICES and select SA-C (folder) which was saved previously in step 2 and update 16ICES
Last Step: Go in NAVRAM and change 0500 to 0501 click on WRITE and click on load to confirm then power off and power on
((((Congratulations)))) drive is uncloked now and you can confirm by viewing sectors

_________________
Azzan Shahid
No one is master in this world but only His Almighty
www.datarecoverytanzania.co.tz