Unlocking ATA Password for Western Digital

[cwindsor]

Im sorry I set it in the bios.... Is that what you mean?

[Vulcan]

Im sorry I set it in the bios.... Is that what you mean?

Thanks, yes, that explains where you set it. I was asking because the format of the password doesn't match the usual BIOS encoding of the password that I've seen before, although I can guess how this one is different. Unfortunately I can't see a 5-character password in the data you've supplied

[dick]

What do you think the password was when you set it?

[ArdenEdition]

Try = abc

Arden

Here is what I get when I do the dump.... I noticed my 22.bin file seems to be short?

I did the dump and then dump2... On the dump2 I am getting error: No DRQ

[Vulcan]

@ArdenEdition:

Indeed - but by not knowing the length of the password (wrong by almost 2x) I deliberately didn't release that info about the password, on the basis that the OP failed my criteria for being the likely owner, until better evidence was given. You do realise you could be helping a thief, don't you? (Please don't be offended cwindsor - I'm not accusing you personally, just that we have no evidence that you are the legitimate owner of that hard disk. The password is supposed to be used for security, so in your case, you must have wanted to prevent people accessing your disk too.)

Although it's rare to see a case here where the poster gives enough info that makes it very likely that they set the password, I've seen some where that applied (and some other examples where the poster gave obviously wrong information, and therefore was clearly not the person who set the password). Therefore I don't agree with just believing everyone who posts in this thread, claiming to have lost "their" password.

Just my £0.02

[cwindsor]

How how not to be..

I am not a thief for one... for two I was going by what my daughter said.

Believe me I make a a decent living and was just trying to get back her files that she wanted (being a good dad and not a thief)

If you don't believe me call me, how's that! [phone number deleted]

I can only go by what my daughter said and tell the inof that was given to me.

Also the password didn't work for your .02

Sorry if I come across as a butt... But I am completely different then what I am called...

I do Security systems (Camera's and Alarm systems here in Augusta,GA trying to keep thiefs out)

I STAND CORRECTED THE PASSOWRD WORK IN the BIOS Screen.... Thank you so much and your trust.

[Vulcan]

*sigh*...

I did say: "Please don't be offended cwindsor - I'm not accusing you personally, just that we have no evidence that you are the legitimate owner of that hard disk."

You have now explained that, in fact, you did not set the password and have therefore confirmed my concerns were valid. That proves my point exactly.

Calling you would serve no value - I'm sure you're a nice guy, but it would just proves that there is someone on the end of a phone. There is nothing you could say on the phone to confirm ownership, that someone who had stolen your daughter's laptop couldn't also say. This is the whole risk with giving passwords to people remotely. You say that you work in security, so surely you already see this problem - you wouldn't just give me passwords if I called you, I'm sure...

If someone had stolen your daughter's laptop, look how easily they have been able to gain access to what is on her hard disk, despite not being the person who set the password. Makes you think, doesn't it!

[I'll ask for the moderator to remove your phone number from your posting, as I'm sure you don't want random readers of the board to call or pass it on to telemarketers.]

[guru]

Vulcan

QUote"You have now explained that, in fact, you did not set the password and have therefore confirmed my concerns were valid. That proves my point exactly."

100% agree with you on this.


However, being in "security" and leaving your cell number is crazy , I can pin point your exact location ;o)

[ArdenEdition]

sorry guys i understand i could be helping a theif and will think twice next time. was just tryin to help out because i actually locked myself out my own hd and had sentimental pictures and videos on there of my sons birth ect and was devistated when i couldnt remember it ,

ALL THAT SAID if you guys read this topic start to finish and have a little computer knowledge you will know how to get your password back no problem, every post points you in the right direction this is how i learned

my apologies

Arden

[beep]

Here is my dump file. Please help me.
Thank you!

Attachments

22.zip

(389 Bytes) Downloaded 710 times

[networks]

Beep seriously you went to the trouble to figure out how to generate the .22 bin file the rest of the solution is already in the posts within this thread many examples of other .22bin files with the password recovered and displayed won't take you a few min with a hex editor to find the values and discover the password. Most people try the WD defaults first which are widely known via Google.

[beep]

Sorry bro. I've got a trouble when generate the .bin files. I already try on many PC/lapyop but always get error: No DRQ. What should I do now?

[beep]

Here is log file

Attachments

MHDD.zip

(678 Bytes) Downloaded 734 times

[DeeJay74]

Hi @ all.
I tried to follow the instructions of Arden.
But I receive an error:

MHDD>.dump
MHDD ATA/SCSI TERMINAL v2.1
Script: DUMP
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
LINE 1: RESET
LINE 2: WAITNBSY
LINE 3: REGS = $45 $0B $00 $44 $57 $A0 $80
LINE 4: WAITNBSY
LINE 5: REGS = $D6 $01 $BE $4F $C2 $A0 $B0
LINE 6: WAITNBSY
LINE 7: CHECKDRQ
LINE 8: SECTORSFROM = CS.BIN
ERROR: drive reports error

What does it mean?

Greetinx and thanx 4 help

DeeJay74

[networks]

DeeJay74 run the WD diagnostics on the drive it appears it may be bad. Seriously you really need to post the make model of the drive your working with.

[DeeJay74]

It is a WD Scorpio Blue Hard Disk Drive with 160Go.
WD Diagnostic can´t find the drive.

[networks]

If WD Diags cant see the drive then it appears to have failed.

[HNA]

Hello everybody,

I also need help with my two dump files.
The user password I used before my Fujitsu-Siemens tablet (Phoenix BIOS) crashed was "9009".
But I can't find anything similar to that in the HEX-Editor.
The HDD is a Western Digital Scorpio Black (WD3200BJKT).

It would be great, if someone could help me.

Thanks in advance.

Code:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  00 00 00 01 64 00 00 4E 00 00 7E 00 00 07 01 78  ....d..N..~....x
00000010  03 00 64 00 00 00 03 84 7C D0 00 0A 00 14 3C 40  ..d....„|Ð....<@
00000020  00 01 04 0A FA 00 00 01 0E 00 00 00 02 02 00 0F  ....ú...........
00000030  32 0C CA FA 0A 32 0A 01 3C 55 00 D7 00 00 20 00  2.Êú.2..<U.×.. .
00000040  64 00 00 BA 00 19 01 00 00 00 00 00 00 00 01 60  d..º...........`
00000050  02 12 00 22 00 0A 00 00 00 00 00 00 01 01 00 00  ..."............
00000060  01 E0 01 0F 0F 01 02 02 0A 01 02 00 02 02 08 01  .à..............
00000070  00 FF FF 02 03 50 01 1E 00 01 01 04 40 0B 02 00  .ÿÿ..P......@...
00000080  01 00 00 00 00 05 00 00 00 00 00 FF FF 00 00 00  ...........ÿÿ...
00000090  00 12 0A 12 00 00 00 05 00 00 00 00 00 1E 00 00  ................
000000A0  00 00 00 00 00 00 00 4D 00 29 00 07 00 12 2E 00  .......M.)......
000000B0  00 00 0E 00 00 00 00 05 00 01 00 00 00 00 00 00  ................
000000C0  07 00 01 02 0D 00 01 03 00 03 01 00 01 00 00 00  ................
000000D0  00 00 00 00 01 57 44 43 20 57 44 33 32 30 30 42  .....WDC WD3200B
000000E0  4A 4B 54 2D 30 30 46 34 54 30 20 20 20 20 20 20  JKT-00F4T0     
000000F0  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                 
00000100  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                 
00000110  20 20 20 20 20 00 01 53 7C 42 7C 4C 7C 50 5A 4D       ..S|B|L|PZM
00000120  53 48 55 43 4A 52 48 56 5A 4B 41 55 41 00 20 20  SHUCJRHVZKAUA. 
00000130  20 20 20 20 20 20 20 20 20 20 20 31 31 2D 30 32             11-02
00000140  2D 32 30 30 38 00 00 00 00 00 00 00 00 00 00 00  -2008...........
00000150  00 00 00 00 00 00 00 00 00 00 00 00 01 07 00 80  ...............€
00000160  B2 9D 9F 8C 8B DF 8A 01 65 3B 3F 19 17 BF 15 02  ².ŸŒ‹ßŠ.e;?..¿..
00000170  CA 76 7E 32 2E 7E 2B 05 94 EC FC 64 5C FC 56 8A  Êv~2.~+.”ìüd\üVŠ
00000180  B9 96 95 8C 8B DF 8A 15 73 2D 2B 19 17 BF 15 2A  ¹–•Œ‹ßŠ.s-+..¿.*
00000190  E6 5A 56 32 2E 7E 2B 55 CC B4 AC 64 5C FC 56 08  æZV2.~+UÌ´¬d\üV.
000001A0  40 00 80 00 01 30 00 00 05 00 64 00 14 20 32 00  @.€..0....d.. 2.
000001B0  00 00 0F 00 01 02 00 00 01 78 00 32 00 20 00 55  .........x.2. .U
000001C0  FF 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00  ÿ...............
000001D0  00 00 00 00 00 00 00 00 00 00 00 58 58 58 58 58  ...........XXXXX
000001E0  58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58  XXXXXXXXXXXXXXXX
000001F0  58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58  XXXXXXXXXXXXXXXX


Attachments

22_BIN.rar

(409 Bytes) Downloaded 666 times

[networks]

If you entered it via the keyboard and its a bios password then its going to be the keyboard scan codes that need to be used. go back to the beginning of this thread and re-read the posts you will find many links to get the codes and how to enter them. All the info you need is already posted in this thread.

[HNA]

Thank you for your quick reply, networks.
I have read the entire thread now and learned a lot about "reading" the passwords.
But my Bin-file seems to be different.
I tried decoding my password with these two scan code tables:
http://flint.cs.yale.edu/cs422/doc/art- ... APNDXC.PDF
http://www.users.on.net/~fzabkar/MSKeyLog.TXT

It must be somewhere in this block: 01 07 00 80 B2 9D 9F 8C 8B DF 8A 01 65 3B 3F 19 17 BF 15 02 CA 76 7E 32 2E 7E 2B 05 94 EC FC 64 5C FC 56 8A B9 96 95 8C 8B DF 8A 15 73 2D 2B 19 17 BF 15 2A
but why are there no -- 00 -- blocks in between?
Probably I'm just to stupid or my English is too bad to understand everything written here. Maybe my dump file is corrupted.

Please help me.
Thank you