Unlocking ATA Password for Western Digital

[beatniche]

First of all thank you to all the replies on this post, it gave me a jumping off point for recovery of this HDD. On to the business, it was never my intention to post for help with the issue however I am stuck. I've tried various segments of the Hex file with no luck to unlock the drive. I've seen forum members help others after they've posted there dump so here I am.

Thanks in advance for any help with the situation.

Attachments

22.bin file

[sean.duncan]

So I have my own drive (WDC WD2500BEVT-22A23T0) that I am just trying to learn to do this on. I have set the password to be 'money' (without the quotes) but I can't seem to find the sequence of hex characters that match that password anywhere in the files generated by mhdd (I ran '.script' in mhdd and it gave me 21.bin and 22.bin(included)). Mhdd was run from a floppy drive on my laptop.(using what I suppose to be the last usb floppy drive in at least my zip code ) according to the ascii table at: http://flint.cs.yale.edu/cs422/doc/art- ... APNDXC.PDF the sequence of hex I should be looking for is : 32 18 31 12 15 (m-o-n-e-y). Am I missing some kind of conversion that I have to do to the hex in order to be looking for the right thing? Or is the MHDD script not giving me the right stuff? Thanks in advance for any words of wisdom on this.

-Sean

Attachments

22.zip

21.bin and 22.bin files

(836 Bytes) Downloaded 1394 times

[sean.duncan]

Ok, so it looks like the reason that i am not finding the right string of hex numbers in my output is because the script I am using is not using the right offset. I say this because it seems like everyone else here gets their password from the part that comes after the model number of the hdd. unfortunately my dumps are ending just almost exactly after the part where the hard drive model is shown. If I can find which register to change in the script so that the offset is correct, then I should be able to find the password I'm looking for. Can someone here please tell me if I'm on the right track? Can you tell me where to go to read up on how the regs= commands (in the mhdd scripts) work in relation to offsets. I can't seem to find documentation of it any of the ATA specs I've found. any help is appreciated.

[BlackST]

No it's because the 'script' doesn't work on ALL drives.

[sean.duncan]

I understand that, so will changing the 'regs= $50 $otherStuff' commands ( in 'script') correctly allow me to change the offset such that the .bin output will show me the hex containing my password? I'm pretty sure that 'script' will work as beatniche (above my post) has been able to get the right output (with correct offset) with the same drive model I have. for some reason, my 22.bin output is only going to about the middle of where beatniche's goes. thanks for your reply.

[guru]

Your drive WD2500BEVT-(22A23T0) is not the same as beatniche

[fzabkar]

The OP has informed me that he has successfully retrieved his password by fetching the next sector, as follows:

Code:

;script name: read md
;reads md 02 on WD marwell drives
;
reset
waitnbsy

regs = $45 $0b $00 $44 $57 $a0 $80
waitnbsy

regs = $d6 $01 $be $4f $c2 $a0 $b0
waitnbsy
checkdrq
sectorsfrom = cs.bin

regs = $d5 $01 $bf $4f $c2 $a0 $b0
waitnbsy
checkdrq
sectorsto = 21.bin

regs = $d5 $01 $bf $4f $c2 $a0 $b0
waitnbsy
checkdrq
sectorsto = 22.bin

regs = $d5 $01 $bf $4f $c2 $a0 $b0
waitnbsy
checkdrq
sectorsto = next.bin

; end

[sean.duncan]

Yes, Thanks fzabkar. I did intend to post that soon but looks like you beat me to it. Looks like WD must be moving the location of the password depending on the iteration of the particular hard drive model. Either that or the exact location of the password for a given model depends on what state or country the drive is sold in. At any rate, thanks for the help!

[guru]

Interesting password "money" ;o)

[sean.duncan]

Interesting password "money" ;o)

thanks, just the first one that came to mind when I was setting it.

As a side question, where is the HPA physically located? is it in firmware, or physically on the platters in a special section of the drive? I'm wondering if the drive would still be protected with the same password if I were to take a dd image of it and transfer it to either a identical physical drive or to a "identical" virtual drive.

[fzabkar]

You appear to be confusing HPA with SA.

A HPA (Host Protected Area) is created when you truncate your drive. It occupies those sectors between the end of the truncated user area and the end of the original user area.

http://en.wikipedia.org/wiki/Host_protected_area

The ATA password lives in a "ROM module" in the SA (System Area) of the drive, not in a HPA.

See this thread:
newbie-info-from-and-for-newbies-about-firmware-etc-t6562-20.html

[erreterr]

Hi all wonderful community
I just found this community, and I have sitting here a WD HDD 160GB for a year or more. I have changed a customers IBM laptop HDD as this one was locked, and he gave me the locked one as he said that he don't need it. Now I was searching in Google for a way to unlock this Harddrive and found this community. My problem is that I cannot unlock or find the password for this drive at all with all the tools mentioned in this thread (I read the whole thread). I have also paid hddunlock.com service as they say that this model is supported WD1600BEVS, but when I tried it it displayed an error code saying that this model is supported, but the current firmware version on the HDD is not supported. The exact model is: WD1600BEVS-08VAT1 na dthis harddrive was on a IBM notebook. I don't need any data from this harddrive, nor I am in need for any amount of money that this HDD has, but I am just curious to unlock it..

I have tried MHDD from Hirens Boot USB flash drive, but it always says Error using .dump and .dump2 scripts. I have also tried the MAVR_R program as this HDD has Marvell chipset but even MAVR_R doesn't create any .MOD file from this HDD. ZU doesn't work at all, while ZU and using an unlocked WD250BEVT drive reads the drive successfully and says that No Locks Found.


Any advice?

Thanks

[erreterr]

I have a WD160BEVS hdd locked sitting here for months or years and I am curious to unlock it, but none of the tools in this thread are working. MHDD using .dump and dump2 scripts report errorr, and ZU doesn't work also. Even MAVR_R doesn't read my HDD. Furthermore I have also paid for hddunlock.com service and after connecting the HDD they say that this specific firmware version is unsupported. Does anybody have an idea, or is it a strong security drive as it was coming from IBM laprtop. I don't need any data, I just am curios how to unlock it.

Thanks in advance for your ideas

[PapashaBeppe]

try ZU betta 1.1 http://www.ihdd.ru/forum/pomogite-sovet ... 74-60.html
alex_37

[mpgxsvcd]

I have an external WD laptop USB hard drive(Model WDBABM0010BBK-00). Is there anyway to unlock those drives? Will all local computer shops be able to unlock the drive? I need to unlock this without loosing the data. Is that possible?

[fzabkar]

Model # WDBABM0010BBK belongs to a 1TB My Passport Essential. Is the USB-SATA bridge integrated onto the drive's PCB, or is there a separate bridge board inside the enclosure?

[mpgxsvcd]

Model # WDBABM0010BBK belongs to a 1TB My Passport Essential. Is the USB-SATA bridge integrated onto the drive's PCB, or is there a separate bridge board inside the enclosure?

Unfortuneatly, there is just a single usb connection on a board that appears to be part of the hard drive itself. There is no SATA connection at all. I guess that means I can't recover the data then right?

I am thinking about just formatting the drive and then trying to recover some of the deleted data. Would that work? It should unlock the drive and not overwrite everything. That is the only last ditch effort I can think of.

Would creating an ISO image of the drive work or will that still have the security on there?

[fzabkar]

I am thinking about just formatting the drive and then trying to recover some of the deleted data.

I don't know where the password is stored, but if it is a standard ATA password, then it will be written to a reserved System Area on the platters. Unfortunately, to gain SATA access to the drive, you will need to do some microsurgery.

http://www.datarecoverytools.co.uk/2010 ... tor-suite/

[Reptilewing]

Hello guys! I understand youŗe pretty fed up with annoying "check my bin.22" But I have no choices left to ask you, could you, please, check my 22?:(( I have WD1600BEVS with security:high I have tried everything I had found here: ZU, MAVR_R, HDA2, WDC of 32 symbols. None of the methods worked out for me. Finally, I've managed to dump bin.22, but it seems very strange, cause I have no Alt Gr on my keyboard, so I've tried some hex to ASCII converters on the internet, but the result didn't make any sense, cause of its "illogical" matter. Could you check it, and help me with psw, or, at least just point at the right hex in my .bin. I appreciate in advance!

Attachments

[Reptilewing]

The psw is retrieved! Thank you for such a great thread!:)