Unlocking ATA Password for Western Digital

[SKYPPI]

Hi,

I've go a HDD WD : WDC WD3200BEKT-75PVM
Locked with a password, I need to unlock it.

I tried every scripts I found here but nothing work on mhdd with my HDD.

When I used script I've got in retunr : ERROR : No DRQ
(the disk is on the right port, en ID said the HDD is the good but locked)

Can help me please ?

Thanks a lot.

[SKC]

HI there trying to get the master password fo WD1600BEVT-22ZCTO..Tried MHDD ata terminal and get the 22.bin file but there is no way I can get the password.....so would anybody help me?? PLEASE!!

Attachments

[networks]

What is the history behind the password ? Bios password ? sometimes they lock for other reasons firmware related etc. The default WDC is not present in your post so thats one clue. How much time have you spent reading the 547 posts before yours ? I can tell you its been explained in detail many times. Homework !

[fzabkar]

@SKC, the password consists of eight decimal digits and needs to be entered when the drive is installed in the laptop. Does that jog your memory?

[solarpowered]

When trying to make a script file, I opened a plain text editor, copied and pasted the below data and saved it as a txt file and changed the extension to .mba

Needless to say I was unable to use the script since it errored saying it needs to be v1.1.
So I downloaded HxD seeing someone said a hex editor could create the batch file and I cannot figure out how to create such a file in that program.

Please help.


[quote];script name: read md
;reads md 02 on WD marwell drives
;
reset
waitnbsy

regs = $45 $0b $00 $44 $57 $a0 $80
waitnbsy

regs = $d6 $01 $be $4f $c2 $a0 $b0
waitnbsy
checkdrq
sectorsfrom = cs.bin

regs = $d5 $01 $bf $4f $c2 $a0 $b0
waitnbsy
checkdrq
sectorsto = 21.bin

regs = $d5 $01 $bf $4f $c2 $a0 $b0
waitnbsy
checkdrq
sectorsto = 22.bin

; end


[/quote

[Samantha_14]

Hello all, this has been quite the thread to read.

I have a WD WD1600BEVS-22RST0.

My BIOS password has always been randy. My Acer 5610z has also been very flaky for quite some time, a tech told me a while ago that I may have had a bad graphics board or a bad solder connection because when I touched the corner of my laptop, it would sometimes instantly turn the machine off.

The other day, my laptop turned off, and would not turn back on. I tried the HDD in a different machine, and it told me it had security on it. I took this message to be different than the BIOS password, but from what I'm reading, a BIOS password and the User Password may be 1 in the same? I had thought maybe in my mobo's last dying breath, it put an additional lock on my HDD.

I used MHDD and followed the instructions here, and my 22.bin showed what I decoded as randy as well. The master password appears to just be 'lt'.

Neither of these passwords are unlocking the HDD using MHDD 4.5 or 4.6. I've tried many variations for both randy and lt, including the spaces in between chars, padding out to 32, etc.

A PC Tech is suggesting we try a similar or the exact same MOBO, but after reading this, that may not work either?

"Yes, it depends on the BIOS. Some (particularly laptops) will do some hash function from your passsword and system ID's, so it won't be visible in plain ASCII form. If your motherboard is dead, you can't see your data on other one. It is one of the reason it is generally a bad idea to protect your data by system password. And false sence of security too."

It also sounds like even with the correct pwd, MHDD might not perform the unlock, and I may need to try some of the others mentioned?

Lastly, I saw where someone tried AFF and at first it didn't work, complaining about firmware, then later it did. Did he apply more recent firmware, if so, can I do that from a different laptop? I ran AFF Diagnostics to make sure purchasing the license would work, ie, my drive wasn't dead/hopeless corrupted, and it finished saying: "The hard drive is locked. If you need to remove the password, you can proceed with unlocking. The data stored on the drive will remain intact."

Thanks everyone for taking the time to view my post.

Attachments

22_bin

[fzabkar]

@Samantha_14, try entering the full 32-byte string using the hexadecimal data in MOD 02 rather than the equivalent ASCII strings.

[Samantha_14]

Thanks fzabkar.

By MOD 02, do you mean the User Password Section? If so, do you mean to actually use each 2 digit hex that I translated into 1 char using the Keyboar Scan Codes, ie, instead of using R use 13? Example 13001E0031002000150000000000000000000000000000000000000000000000?

I also tried to convert the hex to decimal, and then used Alt, but for 13 hex, it's 019 decimal, and Alt 019 for some reason in MHDD did not move the cursor, the other 4 did, and it failed as well. Alt 019 in a Dos window brings up ^S.

Thanks again for the speedy reply, I feel like I'm so close to getting my data back to accessible.

[fzabkar]

@Samantha_14, you may find it easier to use HDAT2:
http://www.hdat2.com/download.html

See the "Unlock the device" section on page 26 of the CookBook:
http://www.hdat2.com/files/cookbook_v11.pdf

You can switch between ASCII and hexadecimal modes (Alt-H), and you can specify the fill character (0x00).

[Samantha_14]

I've had to re-locate my locked HDD to another location and it hasn't been hooked back up to try HDAT2 (found on UBCD) as of yet, could take several days.

While I'm waiting, I noticed a few points you made in another thread:

"The way to answer the password challenge depends on whether you are talking to the laptop BIOS, or to a software application. Furthermore, it is evident from the laptop example in this thread, and from all similar examples in that other thread, that laptop BIOSes opt for 0x00 as the fill character."

From this, I gather the manner in which I enter the password randy into MHDD or HDAT2 might be different than when I place the HDD in a different laptop (which also fails using that password), or are you talking about a user password generated from a software application like WD Smartware, etc?

I read that in cases where the bios password and the user password are the same (appears to be my case), to try unlocking using one space after the last password char, haven't tried that yet.

From you make break code list, I also noticed my master password hex value of A6 is made not by the make of L, but rather the break, how is that done?

If all else fails, do you think AFF Repair Station would work, have you heard of instances when the diag portion does not report an error but the Unlock simply doesn't work?

Lastly, I found a list of Award BIOS master passwords, which I believe my Acer had, and HLT was on it, curiously close to LT from mine above.

[superloadedcat]

HOW I UNLOCKED MY DRIVE ( it took me 2 days of trying)

http://lagunabeachcomputer.com/?p=178


How To UNLOCK a Password Protected Western Digital WD SATA Hard Drive Without Knowing the Master or User Password
Posted on November 1, 2012
How To UNLOCK a Password Protected Western Digital WD SATA Hard Drive Without Knowing the Master or User Password

So, you have a WD hard drive that has been password locked on the drives own bios, and you can’t format or partition it at all….

WHAT YOU NEED:

Hirem’s Boot CD (i used a combo of v9.2 and 14)

a program DOS called ZU.EXE. Google ZU Betta to find it.

your locked SATA drive hooked up to a computer with a compatible controller chipset.

The motherboard bios must be set to SATA NATIVE. It Cannot be set to AHCI, RAID modes. So play around with setting your sata controllers to NATIVE. We want no IDE controllers! Just Sata.

A FEW KEY POINTS:

This tutorial is only for IF YOU DO NOT HAVE THE MASTER, USERhi or USERmax hard drive lock password.

This is not the computers bios password.

This is not the bios password set on the motherboard bios, this is the Password locking the drive from IO read/writes from below the computer’s bios level.

The HEX dump / MHDD 4.5 method did not work on my drive. The scripts would error out and not dump the hex 22.bin file. But i was still able to unlock the drive…….

The SATA controller on the motherboard matters. I tried two modern computers with no avail (Lenovo thinkstation s20 and Dell T3500). I only got it to work when hooked up to an older P4 based computer with IDE and SATA plugs. I tried for 2 whole days on the new systems before i moved to an older chipset and got it to work.

ALL THE CRAP I READ THAT DOESN’T REALLY MATTER IF YOU DON”T HAVE THE PASSWORD:

unlocking-ata-password-for-western-digital-t8374-360.html

http://elettrofreak.blogspot.com/2011/0 ... -hard.html

http://www.tomshardware.com/forum/280346-32-lock-bios

wd5000avvs-problem-pls-help-t22667.html

unlocking-ata-password-for-western-digital-t8374-20.html

unlocking-ata-password-for-western-digital-t8374-80.html

http://www.rohitab.com/discuss/topic/35 ... -password/

http://ipv5.wordpress.com/2008/04/10/4/

http://ipv5.wordpress.com/2008/04/14/li ... passwords/

ata-password-bypassing-t12257-20.html

http://linux.die.net/man/8/hdparm

http://mackonsti.wordpress.com/2011/11/ ... a-command/

http://participant.mykonicaminolta.com/ ... 50_200.pdf

ALL THE CRAP YOU CAN SKIP AND NOT EVEN BOTHER TRYING IF YOU DONT HAVE THE PASSWORD or MFG MASTER PASSWORD:

HDDUNLOCKER = its $50 im not paying

A-FF Repair Station = again, its $50 and im not paying

hdparm linux commands = Secure Erase and all those commands are worthless without a password

HDDERASE.exe = still need the password

HDDHACKR.exe = wouldn’t dump sectors 16-21 for me due to NO DRQ error. i suspect this is related to hooking up to a motherboard drive controller that isnt compatible.

Victoria = still need the password

MHDD 4.6 = You need the mhdd.exe scripts anyways. download and find dump, dump2 and dump48 scripts in the zip file called “mhdd.zip”. google it. it also contains a perfect 512byte cs.bin file. I tried for 2 days to get the scripts to dump my hex password 22.bin file but they wouldn’t. I could never get past the NO DRQ or DRIVE ERROR msg in the last line of the dump scripts. READ ON BRAVE UNLOCKER! there is a way!

MFG MASTER PASSWORDs: Didnt work for me. I suspect this is because this drive came from a secure bizhub konica minolta copier and the MASTER pw was changed from default. ’WDCWDCWDCWDCWDCWDCWDCWDCWDCWDCWD’, ‘h20insyde’ and all the rest did not work BUT YOU SHOULD PROBABLY TRY THEM IN MHDD FIRST! here is a list:

SEAGATE -> “Seagate” +25 spaces

MAXTOR
series N40P -> “Maxtor INIT SECURITY TEST STEP ” +1 or +2 spaces
series N40P -> “Maxtor INIT SECURITY TEST STEP F”
series 541DX -> “Maxtor” +24 spaces
series Athena (D541X model 2B) and diamondmax80 -> “Maxtor”

WESTERN DIGITAL -> “WDCWDCWDCWDCWDCWDCWDCWDCWDCWDCWD”

FUJITSU -> 32 spaces

SAMSUNG -> “ttttttttttttttttttttttttttttttttt” (32 times t)

IBM
series DTTA -> “CED79IJUFNATIT” +18 spaces
series DJNA -> “VON89IJUFSUNAJ” +18 spaces
series DPTA -> “VON89IJUFSUNAJ” +18 spaces
series DTLA -> “RAM00IJUFOTSELET” +16 spaces
series DADA-26480 (6,4gb) -> “BEF89IJUF__AIDACA” +15 spaces

HITACHI series DK23AA, DK23BA and DK23CA -> 32 spaces

TOSHIBA -> 32 spaces

For xbox hdds try “XBOXSCENE” or “TEAMASSEMBLY” too

SOFTWARE YOU DO NEED!:

MHDD 4.5 = still need the password to UNLOCK, but it tells you everything you need to know about the state of the locked drive. Run from a bootable ISO cd or USB key. DONT USE VERSION 4.6 that is in Hirem’s Boot CD. GOOGLE AND FIND VERSION 4.5. Google the file mhdd32ver4.5.iso, and create a bootable cd or usb out of it.

ZU.EXE = THIS IS THE MAGIC program. I found it in a file called _zu.betta.050911.rar. google _zu.betta.050911.rar and download it.

BASICALLY HERE ARE THE STEPS:

1. plug the drive into an older sata motherboard computer.

2. set your BIOS sata controllers to the most NATIVE and non AHCI or RAID mode you can.

3. Boot to your mhdd iso cd that you created. This sets the DOS environment and memory manager and stuff.

4. MHDD -> press Shift+F3 and choose your drive. if its not listed then either edit \mhdd\cfg\mhdd.cfg to enable the controllers or use another computer/motherboard/controller.

5. MHDD -> Press Shift+F2 to view the drive properties, it should say LOCKED (Note: it may also tell you the SECURE ERASE time in minutes. Mine was ’80 Minutes’. this is important to note)

6. Exit MHDD with ALT+X. You should now drop to dos.

7. Run ZU.EXE. you will obviously have to copy the file over, this is why i use a USB drive to boot my ISO, i can copy the file to the USB drive, Boot my ISO using YUMI Bootloader, Exit MHDD, change dos path to ‘C:\’ and then run my C:\ZU.exe program

try them all ‘ZU /P’ or ZU /S or ZU /A, one of them should start and not error.

If you get an error or ‘Drive still locked’ msg then try a different command ie ZU /A

If you get something that says ‘ELAPSED TIME xxxxxxx’ then LET IT RUN FOR AS MANY MINUTES AS DENOTED IN step 5. I let mine run for over 80 minutes.

So, after 80 minutes nothing happeded. I hit CTRL+C and exited out of ZU.

Then I ran MHDD again, picked the drive using Shift+F3, then checked the status with Shift F2. Then I exited MHDD

FINALLY, i ran ZU.exe /P as my drive was on the primary controller. This time it worked! ZU reported ‘DRIVE UNLOCKED’ and i was able to now format, partition and otherwise use the drive as normal!

SUCCESS! WD SATA HARD DRIVE UNLOCKED!

[johanlast]

Hello

Could someone please tell me the password for my Western Digital Drive. I attached a screenshot of the bin file.

Attachments

[Samantha_14]

johanlast, I'm having a hard time following your editor, could you try a different one and repost, like Ultra Edit or Hex Editor 6.1?

[loki]

Hello

Could someone please tell me the password for my Western Digital Drive. I attached a screenshot of the bin file.

Your WD master password is shown ie the WDC bit

If you look at the previous page you'll see the walkthrough I posted

Repost:

Are you accepting the risks involved with DIY?

Your dump has the master password in plain text you just need to know what to do with it:

1) Download "MHDD v4.5" http://hddguru.com/download/software/mh ... 4.5iso.zip
2) Burn boot cd from the ISO image
3) Boot to the MHDD CD
4) You will see a list of harddisk, select a harddisk you want to unlock
5) Type "unlock" and reply "1" for master password

6) Enter the master password. “WDCWDCWDCWDCWDCWDCWDCWDCWDCWDCW” without the quotes
(If it is wrong, ERR will turns red on the top of the screen, and You have 4 more tries before it powercycle the disk)

7) If it is correct, type "DISPWD" and reply "1"
(There will be a warning if your disk is still locked)

Retype the master password again and your disk is unlocked!
(ERR will turn red if the password wrong)

9) Type exit and press "ctrl + alt+ del" to reboot

Loki

[Samantha_14]

Loki, what do you think my issue is, I'm just not inputting it correctly? I'm setting up another computer in a different location to try out fzabkar suggestion of using fill chars in HDAT2, etc.

[fzabkar]

@Samantha_14, AISI your drive needs to receive a string of 32 bytes beginning with "13 00 1E 00". How you go about this depends on whether you are using the original laptop BIOS, or a software application such as HDAT2.

In the case of HDAT2 you would select hexadecimal input mode and type the abovementioned sequence as is, with HDAT2 providing the 0x00 fill characters (unless you feel inclined to enter them by hand).

If you are using the BIOS, then you would input the original keystrokes. The BIOS then converts these keystrokes to PC keyboard scan codes and provides the additional fill characters. The resulting 32 bytes should match the abovementioned sequence. However, notice that your BIOS assigns two bytes to each keystroke (the scan code plus 0x00), whereas the BIOS in that other thread uses single bytes for each scan code. Perhaps that's the difference between your new laptop and your old one.

As for your question regarding the "A6" break code, I confess that I don't have an explanation. I'm just as puzzled as you.

[solarpowered]

Hello

Could someone please tell me the password for my Western Digital Drive. I attached a screenshot of the bin file.

Your WD master password is shown ie the WDC bit

If you look at the previous page you'll see the walkthrough I posted

Repost:

Are you accepting the risks involved with DIY?

Your dump has the master password in plain text you just need to know what to do with it:

1) Download "MHDD v4.5" http://hddguru.com/download/software/mh ... 4.5iso.zip
2) Burn boot cd from the ISO image
3) Boot to the MHDD CD
4) You will see a list of harddisk, select a harddisk you want to unlock
5) Type "unlock" and reply "1" for master password

6) Enter the master password. “WDCWDCWDCWDCWDCWDCWDCWDCWDCWDCW” without the quotes
(If it is wrong, ERR will turns red on the top of the screen, and You have 4 more tries before it powercycle the disk)

7) If it is correct, type "DISPWD" and reply "1"
(There will be a warning if your disk is still locked)

Retype the master password again and your disk is unlocked!
(ERR will turn red if the password wrong)

9) Type exit and press "ctrl + alt+ del" to reboot

Loki

Loki, Thank you. I need to express how absolutly clear and how step by step this was laid out. The order by which I was attempting to put in the pass word was my bane in my entire process to get those blasted WD drives finally unlocked. The Default Master Password was the one. I was lucky.

Even better, Samantha_14 was fantastically instrumental in pointing out key issues with my initial starting process. It seems I was doing the right things, again, out of order and I did it all from the bootable floppy disk. Without Samantha_14 's help I never would have got started. Thank you both.

I'll like to write out some steps that make help a lot.

[Samantha_14]

Solar, I'm glad everything worked out for you and that I could be of help.

I'm re-reading my older posts and knowing what I tried, I'm kicking myself. "I've tried many variations for both randy and lt, including the spaces in between chars, padding out to 32, etc." Doh. Spaces are not hex 00, they are hex 20. Facepalm.

I should have tried in MHDD r0a0n0d0y0, perhaps with 0's all the way out to 32.

My new environment setup is not working out quite as nice, as the desktop is a Dell, and Dell doesn't seem to like having a locked sata 02 HDD in the equation. Problem there is that's all we have at work are Dells.

From what fzabkar just replied with, things are really starting to make more sense with respect to how different bios's write the password to the HDD. Sounds like mine had the make code and a 00 after each letter.

As I'm waiting for a new environment, I'm wondering if after the final letter, a y, would the BIOS have written a final 00, then another 22 00's or are those just written the last 00? Iow, in the newer laptop bios, if it's not writing the filler yet it only takes 14 chars, could I simply try r0a0n0d0y0 or r0a0n0d0y00000 (14 chars for the max amount the bios will accept)?

Feels like I'm getting closer, definitely learning alot!

[tomfanta]

Hi all,

After spending a few hours to read this topic from page 1, I succesfuly unlocked a WD320BEVT drive.
I did run .dump script on MHDD 4.5, then I got my 22.bin. There were 32 bytes (without 00 pads) followed the header 01 07 00 - it was the USER password.
No need to convert to ASCII or decimal (and it didn't work for me, either), just use HDAT2 v4.7 or above, and you can input your HEX bytes to the password field.
Unlock, disable password with HDAT2, and it's done: drive unlocked.

Thank you for everyone, keep up the good work.

[Samantha_14]

A very relieved update:

The Dell I was using didn't like the locked HDD in Sata 02, so b4 I abandoned using a Dell at all, I tried putting the locked HDD in Sata 00 (master), and at that point, HDAT2 4.5.3 was able to see it, before all it saw was the other sata 00 but not my locked drive in sata 02, although it still did not see the slave I put in Sata 02.

First, turns out 0 is not hex 00 in keyboard scan codes or the ascii equivalent. Whereas R was hex 13 in scancode world, in non-scancode world, R is hex 52 while r is hex 72. I found this out using Hdat2 4.5.3. Although it would show me the Hex equivalent, I couldn't actually input in hex in that version, from what I read, I needed 4.7 or higher. I was going to need a higher version since some of the hex I needed were not going to be available using the keyboard as far as I could tell, especially 00 and DC3, etc.

I dl'ed HDAT2 4.9.x and burned the iso to a CD, and booted from that. HDAT2 4.9.x was diff right away in that it saw both my locked drive in Sata 00 but also the other drive in Sata 02. There I found the Hex mode, it was a little kludgy as far as inputting them went, you couldn't just input them all at once, you had to input 1, have it accept, go back into hex mode, remove the previous value using backspace, right arrow, backspace, then re-enter another, have it accept, etc. If you wanted to update the Hex string, you had to hit enter. Once you verified your string was building correctly, when you went back into the password, it would throw you to the end of the string, so you had to space back over, etc.

At any rate, I got my string inputed exactly as the 22.bin file showed, hit enter, and rather anti-climatically, it told me that the command was successful! Since I did Unlock vs Unlock Device, I also had to Disable Password, and that was just a Y/N challenge response. It worked.

Next thing was to change the HDD's back to their original order so I could boot using my unlocked laptop HDD as a slave for easy copying purposes, and then to change the bios boot options sequence to SATA 1st as opposed to CD/DVD first.

Once booted, I went into Disk management, and my drive was being read and my drive letters were assigned. I went out to one of the drive letters of the unlocked HDD and opened a file. What a relief!

I've since hooked up my External USB HDD, and I'm copying my data to it as a backup.

I'm so thrilled to have my data of over 5 years back and being backed up. I'm definitely going to be purchasing some form of NAS with Raid 2 and begin backing up my home drives periodically.

Thanks to everyone!

sam