Unlocking ATA Password for Western Digital

[dick]

He says he's forgotten them. I grilled him today and he gave me a few to try, to no avail. Said he was drunk when he did it.

Well,
i Do Not Believe This even 1 Percent

Why not? Seems plausable to me though I would refer to my last sentence.

@Carmievg...... You have dumped the bin file and are nearly there. What I would do is go back and read every post in this thread as all the info is here.

A couple of things to mention are:

The drive is from a Dell with both bios and hard drive security on, so if you want to use the drive in the Dell there would be more work to be done. Not only drive unlocking.

Also you said:

He said that if he cannot get this information, the IRS is going to try and nail him for $53,000 in back taxes.

So if that is the case then spending 100$ with a pro would seem to be a worthwhile investment.

[BlackST]

Who made the commercial "Find us before we find you" ?

[loki]

He says he's forgotten them. I grilled him today and he gave me a few to try, to no avail. Said he was drunk when he did it.

Well,
i Do Not Believe This even 1 Percent

Why not? Seems plausable to me though I would refer to my last sentence.

@Carmievg...... You have dumped the bin file and are nearly there. What I would do is go back and read every post in this thread as all the info is here.

A couple of things to mention are:

The drive is from a Dell with both bios and hard drive security on, so if you want to use the drive in the Dell there would be more work to be done. Not only drive unlocking.

Also you said:

He said that if he cannot get this information, the IRS is going to try and nail him for $53,000 in back taxes.

So if that is the case then spending 100$ with a pro would seem to be a worthwhile investment.

Agreed. Have also PM them mentioning http://hdd-tools.com/products/rrs/ as another possibility.

Loki

[wirus]

Hello

I have a hard drive that has ata wd5000avvs password

Czytałem side of this topic, but I do not know English so well that I understood that.

I read in the password file, you can check 22.bin

Could someone explain step by step to me as I do and run this script?

MHDD on a bootable USB drive I already have.

How to make a script and turn it on - then search for the same hex.

Thank you and sorry for the duplication topic
translated by google translator

Plsss.... help

I'm reall please.
I need help.

[fzabkar]

He says he's forgotten them. I grilled him today and he gave me a few to try, to no avail. Said he was drunk when he did it.

Well,
i Do Not Believe This even 1 Percent

Why not? Seems plausable to me though I would refer to my last sentence.

If I'm reading the user password correctly, then I can't see how a human being could enter such a combination at BIOS level, even as keyboard scan codes, unless the BIOS does something funny with the password afterwards.

[Carmievg]

If I'm reading the user password correctly, then I can't see how a human being could enter such a combination at BIOS level, even as keyboard scan codes, unless the BIOS does something funny with the password afterwards.

I'll be honest, that is what I thought too, after trying to crack the code, hence my comment that something was still eluding me. My next step is going to be to put a quick password on MY drive, and compare the two. The drives are very similar, and it shouldn't be too difficult to see those minor differences.

And yes, the link Loki sent to me will be very strongly considered as a next alternative. Many thanks for the good faith replies. The disbelievers are irrelevant.

[Carmievg]

Well well well, the mystery continues. I followed Loki's link to A-FF, and proceeded to pay them the $50 for the unlocking service. The reply? That the device is damaged and cannot be unlocked. So, I try their firmware recovery routine, which tells me all is well, and I can proceed to unlocking. Then it tells me (again) that it cannot be unlocked. Next step? A-FF's HDD Unlock Wizard, which says that it is a destructive unlock, but it will unlock the drive. I have several recovery programs which have salvaged more than a few files (like tens of thousands), so it just adds another step to the process. THAT program tells me that this device has an unsupported firmware to it. It also seems that the .bin files I uploaded earlier were not from this device. I have no idea where they came from, but the model numbers and serial numbers were way off. Perhaps I downloaded a used copy? One with the 22.bin file already in place? Hard to say, but I did think it odd that a 160gb Scorpio would have a model number starting in WD2500BEVT.. I've already scoured WDC.com looking for a firmware update, and have found none. This is depressing.

[Vulcan]

Next step? A-FF's HDD Unlock Wizard, which says that it is a destructive unlock, but it will unlock the drive. I have several recovery programs which have salvaged more than a few files (like tens of thousands), so it just adds another step to the process.

I'm trying to understand this comment. Are you're planning to try software-based recovery (the type which [partially] works after a Windows "quick format"), after a "destructive unlock", if you can get that unlock process to work?

It also seems that the .bin files I uploaded earlier were not from this device. I have no idea where they came from, but the model numbers and serial numbers were way off. Perhaps I downloaded a used copy? One with the 22.bin file already in place? Hard to say, but I did think it odd that a 160gb Scorpio would have a model number starting in WD2500BEVT

Yes, you're certainly going to need to review how you collected your output file(s) from MHDD, if you expect to have any hope of success yourself. It's possible that this disk has been "tinkered with" and is indeed reporting that it's a WD2500BEVT, when it's a different model. You're just going to have to check.

I've already scoured WDC.com looking for a firmware update, and have found none.

That's normal - few retail disks have f/w upgrades made available to end-users by the manufacturers (recent Seagate bugs being a notable exception), and if the drive is locked, it should reject any attempt at a f/w upgrade anyway, and there are other risks attempting a f/w change on a disk in an abnormal state. In short, I think you're wasting your time searching for a f/w update. If this drive really is reporting that it's a different model, IMHO your problem is bigger / different than the one you described at the beginning.

P.S. If I was the laptop owner, I'd go to a pro with some proof of ownership and have them work on this, given the $$$ which you said is at stake... Just my $0.02

[Carmievg]

When I referred to HDD Unlock as "next step", that was essentially documenting what I'd already done. HDDU told me that the drive has a "rare" firmware revision. The data recovery would be a shot in the dark. The point is moot, however, unless and until I can get the thing unlocked. I'm (clearly) a novice when it comes to hardware manipulation (dare I say hacking?), but I have had some pretty good luck with data recovery. I had a 1tb drive in my own desktop which failed, and was able to use a live Knoppix CD on my laptop and some trickery of that OS to get all my stuff back.. after a few weeks of fighting with it.

And yes, I may just end up giving it back to him in its current state. But damn, I hate being defeated, ya know?

[fzabkar]

Carmievg, what model number and capacity in LBAs are disc utilities (eg HD Sentinel, HDDScan, CrystalDiskInfo) reporting for your drive? How does BIOS identify it?

Has your friend attempted to use this drive, or a genuine WD2500BEVT, in an Xbox, and has he used HDDHackr on it??? Did he perhaps use the wrong UNDO.BIN file???

BTW, my understanding is that a "destructive unlock" will perform a secure erase of the entire drive. That's not something that you would want to do.

[Carmievg]

A-FF Repair Station shows the drive as having a model number of WDC WD1600BEVT-75ZCT0. It gives the firmware version as 11.01A11.

I highly doubt he's used it in anything but the Dell; I doubt he even knows where the thing goes in the laptop, let alone having tried to install it in something else. However, he did have someone else "look at it", but I do not know the extent of that person's depth; how deep they got with it.


A destructive unlock would be a secure erase, not just a quick format? I kinda thought it would be. No, that is not something I want to do.

[Carmievg]

I'm in!! WOO HOO!! I tried A-FF again, and it completed the unlock! As we speak I'm taking ownership of the C:/Users/Owner folder. It's nice to hear the damn thing clicking, and to see the HDD indicator flickering on the tower. There. Completed. Top of the world right now, folks!! Thanks to all who offered genuine assistance. It would seem I have a lot of things to learn, and I think I also have a good place to learn it from.

Hmmm.. My AVG has already found two files it didn't like.. First things first.. I need to clean it. That's the fun part. I LOVE eradicating malware.

[loki]

I'm in!! WOO HOO!! I tried A-FF again, and it completed the unlock! As we speak I'm taking ownership of the C:/Users/Owner folder. It's nice to hear the damn thing clicking, and to see the HDD indicator flickering on the tower. There. Completed. Top of the world right now, folks!! Thanks to all who offered genuine assistance. It would seem I have a lot of things to learn, and I think I also have a good place to learn it from.

Hmmm.. My AVG has already found two files it didn't like.. First things first.. I need to clean it. That's the fun part. I LOVE eradicating malware.

Well done glad it worked out well

Loki

[Vulcan]

A destructive unlock would be a secure erase, not just a quick format?

Yes, as fzabkar said and as I was going to explain depending on what you replied to my question - that's why I asked you to clarify your comment about planning to run software recovery after a cheap-but-destructive version of unlock, as that would have no chance of success.

I don't agree with running anti-virus tools on a disk from which someone needs data files - at the very least, you need to be running any utilities on a backup or clone of the now-unlocked disk, but it's your choice if you want to take these risks. Just remember that luck won't necessarily always be on your side

[Carmievg]

I don't agree with running anti-virus tools on a disk from which someone needs data files - at the very least, you need to be running any utilities on a backup or clone of the now-unlocked disk, but it's your choice if you want to take these risks. Just remember that luck won't necessarily always be on your side

Thanks for the kind words, folks.

Ya know, I hadn't even thought of that, the danger of running a scan on that drive.. I could (and should) just as easily have cloned it. I will keep that in mind for future reference.
However, I just burned the $53,000 CD, and now it's time to burn the music and picture files. That'll be three DVDs. Should have this job wrapped up in the next hour or so.

I am so relieved to have been able to get in there. I'm one of those who just does not quit when it comes to stuff like this. Just a few hours ago a friend asked at what point I would just have given up on it, and I replied "When I succeed". She shook her head.

[wirus]

Can someone send the file to the server cs.bin lun on email?
I mean this file to the script;

Code:

http://forum.hddguru.com/unlocking-ata-password-for-western-digital-t8374-20.html

Code:

[b]mkwirusek82@gmail.com[/b]

[BeefeaterNZ]

Hi, did you manage to sort out the Password-you said Is0-mick solution didnt work
I have looked at it and see that he has missed out two groups of coding
02 Hex is 002 Dec from little I know about this, I have spent a lot of time on HDD
Guru Western Digital Forum researching a problem on a WD1600BB locked with
ATA PASSWORD set. The WD HDD security is set High & not Maximum & I believe
I have finally determined the Password-the time spent in researching this worth a
lot more than the value of this WD Blue 160GB Caviar Experience is a wonderful
teacher and nothing comes without effort.

Now, from the 02 00 00 01 78 00 32 00 20 00 55 FF 00 01 [HEX]
I believe this is what he should have given you he obviously meant well but
sometimes we cant see the mistakes for the 'trees'

002 000 000 001 120 000 050 000 032 000 085 255 000 001 [DEC]

as you can see there are 14 groups of three, not 12 as posted earlier.
I do realise this was quite some time ago but thought this might help.

BeefeaterNZ

The use of the Alt-GR key was interesting-we all can learn from this
excellent Forum/Website.

[BeefeaterNZ]

Hi, I read your posting-thanks for that. I had difficulty with the step 3 as
the download I received was a file.php rather than the MHDD.zip which I have just
downloaded via your link above. I have run these scripts & managed to get the
three *.bin files but have yet to apply what I think is the ATA PASSWORD that
has been locking this WD1600BB IDE Drive. I didnt set the Password-can you
explain where the line of code in your Drive was found, bit 82 on my Drive is set
as 78 [hex] MHDD shows the Drive is locked 'high' & not Maximum.
Where I think the Password resides appears to be different from any of the postings
I have seen in this Forum-most Passwords appear to be shown in line 130 01 07 [HEX]
The instruction you post 1-set Bios to Boot from CDROM with MHDD Iso V4.6 is
fine-keystroke F5 during Boot with USB inserted does work fine and gives access to
the USB Pen-drive. Running the scripts, eg .dump .dump2 .dump48 .test .idescan all
work from the Command line once MHDD is running. Using 2GB USB Pen-drive
does allow for plenty of Data to be written to this unit.

One question I have, the Zip file from line3 includes your various bin files including the
cs.bin-should these be removed? I havent tried your Zipped version to see if these *.bin
files are overwritten.

Your thoughts,

Beefeater@xtra.co.nz is my email

Thanks,

Warren

[Eve83]

Hi,

Can someone help me here? This might be a tricky one I looked already into most of the postings but how do I know how long the password is?? In MHDD the max. lenth is 32 characters afaik...

Thanks!

Attachments

22.zip

(455 Bytes) Downloaded 931 times

[guru]

Your co worker must be VERY rich

Hello again. New to this forum, and to hardware manipulation in general. I made a post yesterday with a .bin snip, and another with the .bin file itself. Overnight I received a PM from an apparent regular to this board, so I am taking that advice in this subsequent post.

The drive I'm trying to unlock does not belong to me. It is a co-worker's drive, who had been having some blue screen issues with his Vista installation. Instead of seeking help right away, he tried to fix it himself (I'm sure we've all been there..). In the process he was poking around in the BIOS of his Dell, and proceeded to password both the BIOS and the hard drive. He's not too concerned about the laptop, but he needs some data from the drive itself, namely his 2009 taxes. He said that if he cannot get this information, the IRS is going to try and nail him for $53,000 in back taxes.
That's the background. Now to the present. After realizing that the most likely and safest way to bypass the BIOS password would entail replacing the motherboard, I decided I'd take the drive out and connect it as an external to my desktop. A hundred hours of scanning with ZAR produced nothing. I then removed the HDD from my laptop, and set his in its place. It was then that I realized the HDD itself was passworded as well. After three tries it locks the drive out.. Does this prevent MHDD from seeing it correctly? That lead me to this forum and this thread. It would appear that all the information I need is somewhere in the first four pages or so, and I have tried like everything to follow the instructions, but something is still eluding me. Here again is the .bin snip. I hope I've given enough information, and any and all help is greatly appreciated.
Thanks!!!

Chris