Unlocking ATA Password for Western Digital

[loki]

Could you give step-by-step instructions on how to bypass the WD Smartware password using Windows or the links to the info you found??
I have a 3tb external hard-drive and I forgot the password. Only reason I don't want to format as there is pictures I don't have stored anywhere else.
I've tried everything. Any help would be much appreciated.

As you mention its a 3tb im asuming its a My Book Essential & not in a raid?
You also mention you've tried everything? Thats a very generic description.
What have you tried? You might have already ruined any chances of recovery depending on what have tried. The more info you can give the better.

Info on how to bypass the WD Smartware password is not in the general public domain & for good reason. And I wont be posting it either.
Specialist tools are needed to read the system area & knowledge of how it works & where the encryption key is stored etc. Sorry to tell you but this is not a DIY fix.

Your options are:

1, to try random things & ruin your chances of recovery (if you have'nt already)
2, send it to a dr pro with the correct know how & show some proof of ownership
3, put it somewhere safe until you can afford a recovery if money is an issue at the moment
4, lose the data & move on

Loki

It's a mybook essential. I know what the password is per say.. I used a combination of words and numbers I know the words and in the correct order its the numbers I have forgotten the order. I've been trying different combinations of the password but so far haven't been successful.
I have tried bypassing the password in BIOS also using Hierns boot CD. I have tried to take the harddrive out of the case but couldn't get the case off. My theory was to connect the drive using a sata to see if that would work but as I said I couldn't get the clips to open to get the drive out.
I'm still hoping I'll get the password. I don't mind sending it to someone who knows how to do it but I don't know anyone. I'm in Ireland. If I did find a pro how much do you think it would be?

PM sent

Loki

[prawny12009]

Hello all, I have trying for a day or two to unlock a western digital hdd from a bt vision pvr box, My subscription is up and the drive would be handy as an internal drive in my htpc for extra storage.

The bios and windows device manager can see the drive but I can only access it and format it if I hot swap from the pvr to the pc (power up pvr and wait for the o/s to load then remove data cable and attach to pc motherboard/usb convertor, windows will then format the disc but on reboot the disc is not recognised again because of the hdd lock, refitting the drive to the bt vision box restores partitions to it's own layout again.

I have used the mavr_r program to read the modules and have assertained that the password is infact "PACE FRANCE Master Security PWD2" without quotations as found elsewhere online, I have spent ages trying to confirm 100% if this password applied to the western digital drive too and apparently it does (all other topics are concerning the seagate pipeline hdd range).

The issue I am having is entering the pw to unlock the drive so that the pw can be permanently disabled, under hdat2 (bootable cd version v4.93) the options for unlocking/removing the password all state in red under each menu that action will be aborted or something similar and sure enough after setting input mode to master and typing the pw I hit enter and s (or s and enter?) and I get an aborted message.

Under mhdd v4.6 once I enter the pw It just says failed.

Am I missing something here? am I suppossed to be entering the password as text or some other format?

I am at the last step now that I know the password, I am just unsure how to unlock the drive.

On a side note the drive (caviar green wd50000avcs) shows under properties that it is running udma5 and is udma6 compatible, I thought sata drive ran much faster than this, or is this a bios thing? would I need to disable the ide channels to get full operating speed from the sata ports?

Thanks in advance

sean

[prawny12009]

forgot to mention security is set to maximum, also just tried zu.exe and and drive was not unlocked succesfully.

retried hdat2 and was confronted with the same command will be aborted error.

Attachments

02_0004.txt

renamed mavr_r.com output file, contains pace password which seems like default pw for bt vision

(2 KiB) Downloaded 870 times

[prawny12009]

O.k. so this morning I decided to try again with this drive.

I tried vitoria to see what it was all about, (is an english language version available I only found russian?)

With the drive hot swapped from the pvr box it showed as security on/frozen status unlocked, this made me think that perhaps the frozen status was the issue as once the drive is unlocked the frozen option stops any tampering with passwords etc right?

any way I power cycled the drive and redetected as security on/frozen status locked, I them tried zu again (all on same flash drive for easy switching) and it said unlock succesful

hdat and mhdd still show failure when trying to permanently disable the password system though so I guess I should never enable a user password right? as that will re-enable the master password.

coincidently i could not erase the disk with hdat either even after it was unlocked I'm still not sure why but at least I can use this drive now, and have a rough idea how to unlock any more bt vision/pvr hdd that come my way.


A 500GB caviar green seems to go for about £50-60 on ebay u.k. so I think I've done well getting one for free.

I think the main reason for the security lock on the pvr drives is to try prevent piracy so you can't copy rip the movies to a pc but it is a pain when it comes to recycling them.

I will still check in to see if anyone can offer any wisdom on the subject so that I can do this with out all the guess work in the future.

thanks all

sean

[prawny12009]

aaaaaarrrrrggghhhhh!

Although it seems I have unlocked this drive and spent ages doing a full format and setting the partition as active , it still won't show in my computer.

I realy need help now I though I had this drive beat but it won't give in.

[Vulcan]

I don't have time to iteratively do all the necessary clarification which I would need, since some of your comments don't fit with what I would expect. Therefore I'll just say this: For a drive with security sex to "Max" (as you said), you cannot use the Master password to unlock the drive and access the data, using the standard ATA security commands.

For further details, read the ATA Security section in any recent version of the ATA specification.

[prawny12009]

I'm not trying to access the data I am trying to reuse the drive as storage, but i cannot use erase unit function even with master password.

I did at one point have the drive so that disk manager recognised/fully formatted it as a basic disk and then set to active, (hdd was then refitted back into my internal 5.25" hotswap drive) but still could not see it in "my computer" even after a reboot

I refitted the hdd to the bt box and let it reset itself in the hope I could start fresh, and programs like hdat2, mhdd etc show the drive as locked again, back in windows I get uninitialised disc pop up but when trying to initialse I get i/o error (i assume because of ata lock) but If i hot swap the drive I can see and erase the partitions and reformat the drive (three small one large) but still cannot get drive to show in "my computer"

Threads in other forums have suggested that bt vision hard drives even though set to maximum security can be erased and reused useing the PACE FRANCE Master Security PWD2 password but when I attempt to erase this drive I get told command aborted in hdat2 and simply failed in mhdd. It makes no differance whether the drive is hot swapped from the bt box or not same result.

I am fairly sure the password is correct as after running mavr_r.com (with hdd on sata 00) and reading through each output file I see this under 02_0004.mod but I am uncertain if i need to enter it in text, hex, or dec as another member suggested for others.


ROYL
0   €% 00080000 $ Â  Ù  ñ W H
< t € ¤ ª ²) Û í0  /= l; § · ÅD F OH „
< À
< ’ — § µV ” Ÿ9 ü
< Ø é > C 8< J Si ¼
WD-WCAV9W821186
? /`8:/`8:/`8:/`8:
¤B  ³ ô


–d
  
  ¼4 



@ @
2 
€ < € €

$.B_x€€  €       €


È 2 
€ È € €

(__x€€  €       €


È 2 
€ È € €

(__x€€  €    
  €


È 2 
€ È € €

(__x€€  €     8  €


È 2 
€ È € €

(__x€€  €    ` 8  €

 

    
   



d2
d

d i  (
z
d
Z

ÿ  „|Œ

ú<@

ú

  2Êú
2

<U × È º 

6 
d "


˜:




ÿÿ
 @ ÿÿ

€–˜ Àا
 
 ÿÿ 
   M $  ) 







 


WDC WD5000AVCS-632DY1
S|BBLQP8MKH6CYRRVDKWUB 06-17-2012
 â¢LfAvNõÅ«…¼š
„I`UÂãÉfñWlPACE FRANCE Master Security PWD2@

4 ô
Ä  2 

x 2 Uÿ
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX





002D0063@ 

ˆˆˆˆDD"SMTEST STRING LARGE SIZE IS 100 BYTES----------------------------------------------------------------- ODD
€  2 d  ,
À 


  
2
(d ,
 È
 <þÿÿF ,


ô
 d d d d    ýÿ ÿÿ 
 ýÿ ÿÿ






I did not use the script on the earlier pages as it was suggested they only work on older drives, and that mavr_r should be used instead. (or did I read wrong?) I did try using the wd password dump option in hdat2 but I could not save the file (got access denied error when saving even with output set to A: drive.

The only options I have in bios is to set supervisor or user password but no explaination as to whether these aare bios locks or bios+hdd locks, I will set a password with just an old 2.5" wd laptop drive connected via adaaptor cable to the motherboard and experiment with all the tools involved to see if I am doing things right or not.

[Vulcan]

I'm not trying to access the data I am trying to reuse the drive as storage

I know. But your plans seemed confused as you've also said variations on the claim that...

I did at one point have the drive so that disk manager recognised/fully formatted it

... which should not be possible in your situation (i.e. Max security & having only the Master password) without erasing the drive - and indeed, you later report that this didn't actually work. Personally I wouldn't be rushing to try so many different approaches, as I'm not seeing enough detail reported about any one approach to understand what may be causing your problem, nor waiting enough time to allow people to make further suggestions or ask questions, before you switch to try something else - but perhaps you just work faster than me Talking of work, gotta go...

Good luck.

[prawny12009]

When zu said it had succesfully unlocked the drive I fitted it back into my internal hotswap bay and rebooted.

Windows disk manager then recognised the drive (but not in my computer section) with it's four bt vision partitions where before it would not without hot swapping, I deleted the partitions and formatted the disk (not quick format) and set the partition to active, I thought this would be all I needed to do, but after a further reeboot I still could not see the drive in my computer even though it was identified as an active basic disk in disk manager.

Am I correct in my understanding that the master password is what is required to erase this drive making it usable? as I read last night on another website that the user password is needed for this under max security which seems counter intuitive to me.

I do not work quickly trust me It is just being a carer for an elderly relative I do not work full time so have have free time to try these things out.

I don't suppose you would know if the scripts from way back in this topic would work with this drive? it is a wd5000avcs.

btw I am working with windows 7 pro 64bit and a lot of the bootable media creator files in the download section say they are not compatible with my version of windows so I have been limited to which ones I could try, would xp be a better platform for me at this point so that I can use the other software?

[prawny12009]

my issue it seems was relying on windows to erase and reformat the drive once zu unlocked it, yes zu unlocked a locked drive set to maximum level but still could not disable password I realise now that it takes the user password to disable the password fuction under max security.

After starting from scratch and re arranging sata leads and bios settings I got zu to unlock the drive again, then i used mhdd to erase the drive (did not ask for password) and after cold booting into windows the drive was accessable and fully formattable etc. this time the drive is visable in my computer too even after restart etc.

[bill4d]

Is there a way to produce a 22.bin file using HDAT2 ?

I've tried using MHDD, but all I get is a disk error and a new 22.bin file does not get created on my USB flash drive.

Thanks for any help.

[karmann]

I read all(3x)and I see nothing
so please someone help me if you can
password please

Attachments

22.rar

(403 Bytes) Downloaded 573 times

[SamSKR]

I need help how unlock my intel 320 300gb SSD after recovery from crash I used MHDD to used for the recovery but after I recover the drive is locked by ATA password. Anybody can help me how to dump the bin file so I can unlocked my SSD. I am using MHDD v4.5 floppy disk version but don't know the command to dump the bin file. Any help I do really appreciate. Thanks Sam

[labtech]

Can you explain in as much detail as possible the following:
1) your interpretation of what caused the drive to crash? Maybe noticed some symptoms before the crash?
2) the actual symptoms after the crash?
3) what exactly did you attempt with MHDD to recover from the crash?

[karmann]

I found the solution,
thank you all

[networks]

I found the solution,
thank you all

Thank you for sharing the solution you found to help others out that come here with the same exact issue you had.

[sully]

Hi.

I have perhaps a peculiar problem maybe someone could advise me with.

I have used apps like MHDD and Spinrite, as well as many linux tools on many hdds. Here is a stumper.

I got this older computer my boy plays games on, Athlon FX55 with gtx7900 era stuff. He had two 80gb WD drives in it. Someone gave me a dell p4 3ghz machine with a bad PSU. I replaced PSU (had one laying around) and found HDD head was damaged, so put in a WD 120gb hdd and put PFSense on it. Maybe a week later the 120gb hdd failed. I thought it was dead, but shows up in windows drive manager and linux and mhdd, but cannot access it in windows nor can you format it in any way. I thought perhaps my Squid Guard had excessively written logs to it.

Anyway, within a few days the system drive on my boys machine pretty much does the same thing. I was thinking maybe a boot sector virus. But, no other machines in my house have been effected (thats like 5 other machines).

So at this point I have been trying this 120gb drive in different machines, and periodically try new things to get it to work. I tried MHDD and spinrite, linux parted tools, etc. Nothing. Recently though I was repairing a system drive in a mirroring raid array machine at work, and decided to run SeaTools on it, just to see if the system hdd had errors. Anyway, one thing led to another, and I brought that 120gb drive to work, put it in that box, and ran SeaTools on it. It said drive was locked, but did run the test and passed.

So this led me to this thread (a long winding road lol ). The drive says it is locked. I used RIP Linux, trying to use hdparm on it to unlock it, said IO error. But I can start a disk wipe on it, so maybe it isn't dead, but locked. Now in all fairness to those in this thread asking for help, it is quite a confusing thread. Thats beside the point though..

I have MHDD 4.5 running, and attempt to use the .dump and .dump2 scripts. The end with the last line 8 (cs.bin or 42.bin) and then "drive reports error". I looked through most all of this thread, but it seems like any who figured that error out didn't tell how they fixed it, or I missed it in the many pages..

So, does anyone have any idea where I might go from here to get those scripts to work? The drive is a WD1200JB-00EVA0. I don't really need the drive, but have always been curious why it behaves the way it does, and would be even more curious to know if it does in fact have a password set in it. I don't use laptops nor have had any experience with passwords on hdds. Bios passwords are one thing, but firmware passwords, why this drive would have gotten one is beyond me, but if this does, and I can read it, and my boys old 80gb does as well... well, I am going to have to figure out how and why that happened and make sure it doesn't happen again.

Like I said, a very peculiar problem.

[marciorssilva]

Hello, i have one WD Scorpion Blue 250GB with user password...can someone retrieve the password? I have used MHDD and make the 22.bin file. Thanks on advanced

Attachments

22.rar

Bin file

(324 Bytes) Downloaded 661 times

[sully]

For anyone finding this in the future:

When using the version of MHDD provided in this thread, it is set to only work on secondary channel, so you must hook your HDD up to the secondary. I had a hdd on primary and cdrom on secondary, so I had issues running the scripts.

Once you get your hdd only on secondary, make sure it is the chosen drive (duh). Then, at least in the mhdd.zip file I got, you can run one of these 3 commands
.dump -- creates 21.bin and 22.bin
.dump2 -- creates 42.bin
.dump48 -- creates 21.bin and 22.bin

Run .dump and .dump2. If like me you used a floppy, exit mhdd. You should be sitting at c: which is the ramdrive. Create a new directory on the floppy with this command
md a:\dumps

Now copy and rename the 21/22 .bin files with this command
copy 21.bin a:\dumps\21dump.bin
copy 22.bin a:\dumps\22dump.bin
copy 42.bin a:\dumps\42.bin

Now (you are still sitting at c: ) type in MHDD and choose your drive again. Now you type in .dump48. This will overwrite the 21.bin and 22.bin files on the c: drive. Once complete, exit mhdd and copy and rename those two files again with this command
copy 21.bin a:\dumps\21dump48.bin
copy 22.bin a:\dumps\22dump48.bin

Now you have 5 .bin files, two for .dump, one for .dump2 and two for .dump48. For myself, only 42.bin had any data even close to the examples given here. For those not used to hex, look for the WDC or XXX string near the bottom. Usually the right side of a hex editor will show the strings, while the left side shows hex. When you find the strings WDC or XXX repeated (or whatever yours might show) on the hex side of the screen, look for the hex combination of 01 07 00 prior to the WDC or XXX area. This hex sequence, from what I gather, will typically come just before your user password. The next 32 characters should be your password.

I solved my issue by using MHDD to unlock the drive with the master password that was clearly visible in my 42.bin file. I used the method listed here
unlocking-ata-password-for-western-digital-t8374-520.html#p163321

In my case, the drive was locked for some unknown reason. Maybe a power failure? I know that mobo doesn't have a feature in the BIOS to set the password on the hdd, not that I can see. My boy says he hasn't gone into the bios nor ran any password tool at all on that machine. Its a mystery. But the good news is that a drive I thought was dead wasn't dead at all. The way it behaved was different from most dead drives I have had, so I am happy that I did not throw it away.

Always good to learn something new!

[sully]

Hello, i have one WD Scorpion Blue 250GB with user password...can someone retrieve the password? I have used MHDD and make the 22.bin file. Thanks on advanced

Your password is clearly visible. If you don't have a hex editor you might try xvi32, a free and simple hex edit application. Open the 22.bin file. On the right, locate, near the bottom the XXX sequence (it should be 32 characters long).

Now roughly 90 characters before your XXX string starts, look on the hex side for 00 01 07 00 combination. On the string side (usually the right side) you will see no text. Your password is right after this combination.

At least according what I have read here it should be.