Hi,

I am new here, so sorry if the question is dumb but I couldn't find an answer with searching.

Is it possible to erase (and unlock) a Samsung HDD if the disk is locked with an unknown user password (security=high, master password = factory default)? I am aware that I would lose all data. Or is the drive bricked (without using special hardware or paying for unlock services)?

Or is it even easily possible to unlock the drive without destroying the data? If it's relevant, it's a Samsung Spinpoint F3.

Thanks!

is it USB (Buffalo) or normal SATA?

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein

Hi, thanks for reply. It's normal SATA: http://www.amazon.co.uk/Samsung-HD105SI ... B0031M9JC4
Thx!

in this case you will need proper tools/knowledge to do so

suggest to find close DR company to do it for you
no DIY


good luck

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein

Hello einstein9,

so it's not even possible to erase the disk and make it usable again (without getting the data) with a tool like MHDD and learning?

Thank you for your information!

I'll just add my opinion (which may not be the same as einstein9 )

Yes, it is possible to use standard techniques to erase a drive in the state that you are reporting, but only if the drive was really locked due to an unknown user password (there are other possible causes of a drive reporting that it is locked, and for them the answer is different) - and only if you really know the drive's current master password. That is the functionality that is built into the ATA standard, so that is not a secret.

However, how do you know that the master password is still at the default? Are you believing the Master Password Identifier (sometimes called revision) value = 65534 mans that the master password is still the manufacturer's default?

How do you know that the drive is locked due to a lost user password, and is not reporting that it is locked, but for another reason?

How do we know that the drive belongs to you, and you are not trying to erase a drive belonging to someone else, and that is why you do not know the user password? Do you see the problem? There is no way for you to prove ownership of the drive to this forum... We have already seen people say on the forum that a drive belongs to them, and later they admitted it was not their drive.

I hope that gives you some ideas about why this situation may not be as simple, as it might appear to be.

OK, it comes back again, so let me ask the same question:

How do we know that the drive belongs to your client, and your client is not trying to erase a drive belonging to someone else, and that is why your client do not know the user password? Do you see the problem? There is no way for your client to prove ownership of the drive to you ... We have already seen people say on the forum that they do verify proof of ovnership of their clients and later they admitted it was not a real proof, but shifting responsibility.

Go figure how hipocritical we are....

Are you asking this to me?

Actually you don't need to answer. If you asking me, then I have no "clients" - all my work (most of which is nothing to do with any kind of DR) is within the engineering department of a company, so ownership of all drives is known.

I see from your comments, that you don't like some of the previous discussions on the topic of ownership - that's fine, we have different views. Your comments don't change my view, and I'm sure mine don't change yours. That's the end of any comments from my side. Life is too short...

Of course there is.

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners

Hello,
before this discussion completely goes off-topic, I have to clarify something: My question is hypothetical. I just want to know, if it is possible to 1) restore the data or 2) erase and re-use the drive, not HOW. I want to know because of this reasons:

1) If I set an ATA (user) password, and I lose the disk or it get's stolen, how easy would it be to get to the data? By easy I mean, is it just necessary to download a simple tool from the internet to unlock the data, or does it require special (by special I mean not available through a Google search) knowledge and/or hardware? The data is not top secret, I just don't want somebody to just plug in the hard drive and get to it.

2) If I set an ATA (user) password, and somehow I am not able to enter the password correctly, maybe because I mistyped it the first time because of e. g. another keyboard layout or I forget the password after some time, will it a least be possible to erase and unlock the drive to reuse it, with all data lost?

(I know that both cases could be better solved with encryption, I just want to consider all options.)

Sorry if my post would have caused unnecessary work.

Thank you in advance for your valueable information!

This had been discussed in two different threads and it wasn't convincing at all.

Answer isvery simple. You should never ever depend on ATA password security. It is brain damaged concept and poorly implemented. Carry this message to everybody.
It doesn't require special tools, it is five minutes fix to restore drive with all user data.

2. Erase and re-use drive concept is even part of ATA standard. It is called Master password. In high security mode you can use secure erase feature and this(commonly known) password to unlock the drive. Some companies are changing master password too and also switch to maximum security mode which disable secure erase, most frequent on laptops. However it is bypassed as in #1.

Having said so, the only the way to secure your data is encryption. But remember if you secure your data properly, you can spend more time in detention on bogus accusations, even being forced by the law to disclose your passwords to law enforcement agencies.

To you.
I don't feel I have to convince anyone.

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners

@northwind,
+1

@mrfusion,


Oh dear - if this had been clear to me at the beginning, I would not have answered, because as I have seen here before, it is often impossible to fully answer hypothetical questions, within a sensible amount of time, due to the lack of exact fixed details in the hypothetical question. My bad, I didn't recognise the situation earlier. Your extra questions have unfortunately confirmed this situation here. So I will just briefly reply (all IMHO of course), but I'm deliberately not going to directly address your latest questions.

As you see, SAjunky confirmed some of what I said earlier about what is possible using the ATA master password - I suggest that you read the ATA specification (the pdf of ATA-8 is widely available for download), to get an idea of what actions are possible on drives which support the ATA security commands.

I already answered some of your latest questions, so it seems you didn't understand my previous answer. FYI I agree with SAjunky that normal ATA security should not be relied upon for sensitive information, and you already acknowledged this, since you mentioned encryption.

Finally, the answers to some of your questions depend on details that have not been given i.e. "it depends", which is the big problem with hypothetical questions. Even when you receive an answer, that may only be true for one specific interpretation of the hypothetical situation, and may be untrue for other interpretations.

Anyway, I'll stop here. Good luck with your investigation

Details were very clear, there is not need for such gimmickry.

Why then bother to reply?

Completely irrelevant. mrfusion didn't ask how, question was "if possible".

@Vulcan,
thanks for your time and feedback. While I understand most of your points and I can grab a copy of the ATA specification, I doubt that the specification tells me how easy or hard it is to break implementations of its security, which was the primary intent of asking here. Also I don't see why it's harder to answer a constructed question because I can fix all the details of the question (like, no, I have not changed the master password, it's factory default, which I stated in the first post).
But once again thanks for your patience!
Best regards

You're welcome.


Your second set of questions made that clearer (to me). I did not understand your intent from your first questions. I (mis)understood originally that this was a real situation, with a real drive.


Time. I have wasted much time trying to help with previous hypothetical questions, where the constructed situation changes, or cannot be defined clearly etc. etc.. I choose to limit that situation again. That's my position - nothing personal.


But you didn't answer my earlier question about how you knew that the master password was the default. Many people mis-understand this part of the ATA specification. Only in your second questions do we now see that we are to assume this hypothetical situation, but in reality, this assumption is not always the case (as shown by previous questions on this topic on the forum, which you probably have not read, since you're asking these questions). Therefore as I said before, the real life drive behaviour depends on the details, as I explained in my first reply to you.


In your opinion. Considering that you have tried to teach me about words in the English language and their meaning, I have no doubt that some things are clearer to you, than they are to me.


And I already answered that question originally (see the second sentence in my first reply!) - but then there were more questions, so perhaps things were not as "clear" as you stated... All IMHO of course.

You are right, ATA specification won't tell you this. All you need from specification is contained in your first post.
No, it is not harder, it is a method to avoid answering questions.
To the master password issue, Vulcan question is valid. You need to be aware that some BIOS implementations modify master password too, so if you change user password, user and also master password is is modified by some hash table (not your plain typing).

That's your opinion, not a statement of fact. I already explained the reason for my approach. It's fine if your opinion is different, but with respect, your opinion is no more factual than mine. These are just opinions...