ST1000LM048

[fzabkar]

This is the "permanently unlocked" version of sys file 0x1D2. I don't know what that means, but I saw it in this thread:

https://forum.hddguru.com/viewtopic.php?f=1&t=43339

[unknown]

This is the "permanently unlocked" version of sys file 0x1D2. I don't know what that means, but I saw it in this thread:

https://forum.hddguru.com/viewtopic.php?f=1&t=43339

Permanent ROM unlock without sending handshake.
This is not relevant to ATA password.

[fzabkar]

Maybe 0x1D1 is a container which stores all the security related information for the drive. If individual security modules are damaged, they could be restored from the backups in the container. I still think the solution could involve replacing the unknown user password data with known master password data.

You could test the master password on your donor by setting what you think is the real master password and then comparing the before-and-after dumps of 0x30A. If you have guessed the correct master password, then I would think that the two dumps would be identical.

[gps31]

Upload sysfiles 1D0 1D1 1D2 227 30A

[unknown]

Upload sysfiles 1D0 1D1 1D2 227 30A

From donor drive.
Here we go :
Before and after :

Attachments

After.rar

(1.12 MiB) Downloaded 55 times

Before.rar

(1.12 MiB) Downloaded 40 times

[unknown]

You could test the master password on your donor by setting what you think is the real master password and then comparing the before-and-after dumps of 0x30A. If you have guessed the correct master password, then I would think that the two dumps would be identical.

Testing in progress

[fzabkar]

0x1D2 can be carved out of 0x227 at 0x1C5000 - 0x1DBFFF.
0x1D2 can be carved out of 0x1D1 at 0x22000 - 0x38FFF.
0x30A can be carved out of 0x227 at 0x2F1000 - 0x2F1FFF.

The master and user ATA passwords are stored in 0x30A. They can also be carved out of 0x1D1 at 0x39000 - 0x3910F.

I believe that the master password in older Seagate drives was "Seagate" plus 25 spaces (0x20).

[unknown]

0x1D2 can be carved out of 0x227 at 0x1C5000 - 0x1DBFFF.
0x1D2 can be carved out of 0x1D1 at 0x22000 - 0x38FFF.
0x30A can be carved out of 0x227 at 0x2F1000 - 0x2F1FFF.

The master and user ATA passwords are stored in 0x30A. They can also be carved out of 0x1D1 at 0x39000 - 0x3910F.

I believe that the master password in older Seagate drives was "Seagate" plus 25 spaces (0x20).

I tried this master password already but the two dumps after wasn't matched. So it's not the older master password.

Has anyone have this drive FW backed up ?
FW revision : 0001
Family : Janus R1

Thanks in advance

[fzabkar]

Could the master password be blank? That is, what about 32 spaces (0x20) or 32 zeros (0x00)?

[michael chiklis]

0x1D2 can be carved out of 0x227 at 0x1C5000 - 0x1DBFFF.
0x1D2 can be carved out of 0x1D1 at 0x22000 - 0x38FFF.
0x30A can be carved out of 0x227 at 0x2F1000 - 0x2F1FFF.

The master and user ATA passwords are stored in 0x30A. They can also be carved out of 0x1D1 at 0x39000 - 0x3910F.

I believe that the master password in older Seagate drives was "Seagate" plus 25 spaces (0x20).

I tried this master password already but the two dumps after wasn't matched. So it's not the older master password.

Has anyone have this drive FW backed up ?
FW revision : 0001
Family : Janus R1

Thanks in advance

MRT backup

Attachments

ST1000LM035-1RK172-0001-WL1xxxxx.rar

(17.55 KiB) Downloaded 29 times

Last edited by michael chiklis on September 5th, 2025, 12:18, edited 1 time in total.

[michael chiklis]

PC3k backup

ST1000LM048-2E7172-0001-WQ9xxxxx

Attachments

ST1000LM048-2E7172-0001-WQ9xxxxx.rar

(17.63 KiB) Downloaded 33 times

[unknown]

Could the master password be blank? That is, what about 32 spaces (0x20) or 32 zeros (0x00)?

Tested but didn't work.

0x1D2 can be carved out of 0x227 at 0x1C5000 - 0x1DBFFF.
0x1D2 can be carved out of 0x1D1 at 0x22000 - 0x38FFF.
0x30A can be carved out of 0x227 at 0x2F1000 - 0x2F1FFF.

The master and user ATA passwords are stored in 0x30A. They can also be carved out of 0x1D1 at 0x39000 - 0x3910F.

I believe that the master password in older Seagate drives was "Seagate" plus 25 spaces (0x20).

I tried this master password already but the two dumps after wasn't matched. So it's not the older master password.

Has anyone have this drive FW backed up ?
FW revision : 0001
Family : Janus R1

Thanks in advance

MRT backup

PC3k backup

ST1000LM048-2E7172-0001-WQ9xxxxx

Thanks a lot.
Writing sysfiles from same FW version didn't work too.

Unfortunately, I have exceeded the recovery time and the customer will come today to collect the drive.

Case not solved and I gave up.


Thanks for anyone trying to help.