All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 6 posts ] 
Author Message
 Post subject: Disable HDD password when master password is unknown
PostPosted: October 4th, 2015, 6:45 
Offline

Joined: October 4th, 2015, 5:47
Posts: 6
Location: Hungary
Hi all,

This is another thread to deal with HDD passwords. I have two 2,5 inch SATA drives those are password locked. I know the user password for these drives, so I can use them, e.g., I access their data without any problems. I can even change these user passwords to something I fancy. But my goal would be to remove password protection entirely, and that requires a master password, and the master passwords are unknown.

As for the first drive, it was a corporate drive. I was fine using the user password for unlocking it, but now I would disable password security. My ThinkPad T400 BIOS requires a master password for this, which I don't know. „Master password revision code = 16385”, which, as I learned elsewhere, means that the master password is not the factory default.

The other drive got password-locked due to my own stupidity. I don't even remember what steps I took exactly, but I wondered if it's possible to remove the user password, but leaving a master password. So I assumed to clear the user password, while still having a master password... but the result was different. Somehow, my master password became the user password, and now the master password is unknown. I would guess it's empty, undefined, yet BIOS and hdparm says, a master password is set, and I need to know that to remove the user password. It doesn't accept my user password as a master password, and it doesn't accept an empty password either.

As you see, my situation is probably different from most of the other HDD unlock threads, because at least I know the user password, thus I'm able to access the data on my disks. Also, I tried different hdparm security commands when the HDDs were unlocked, and it seems like I have unlimited tries, I don't need a power cycle after every 5 attempts.

Cracking the master password would be fine for me. However, somewhere I read, it is possible to force-remove passwords, but then the drive wipes itself, so at the end of the day, I'd get empty, passwordless drives... which would be totally fine for me. Since I can access the data on my disks, I could back them up to other disks, and then it would be acceptable for me to wipe the disks, if this is the easiest method to get rid of the passwords. Note, I'm not sure if this method actually exists, maybe it's an urban legend, as I didn't find a method to activate this wipe & unlock feature.

Could you help me how could I go on with recovering or force-removing my master passwords, even if I lose the drive's contents?


Top
 Profile  
 
 Post subject: Re: Disable HDD password when master password is unknown
PostPosted: October 5th, 2015, 12:45 
Offline

Joined: October 4th, 2015, 5:47
Posts: 6
Location: Hungary
This is the Security section of the hdparm -I output. It's identical for both of the drives, only the length of the SECURITY ERASE UNIT operation is different (76 mins for the other drive).

Code:
Security:
   Master password revision code = 16385
      supported
      enabled
   not   locked
   not   frozen
   not   expired: security count
      supported: enhanced erase
   Security level high
   94min for SECURITY ERASE UNIT. 94min for ENHANCED SECURITY ERASE UNIT.

So the security level is „high”, and not „maximum”, which is probably hope-inducing. I wonder if I could issue a SECURITY ERASE UNIT with the user password. That would hopefully remove my passwords.

I've ordered another hard disk for another computer, but I will borrow it for back up the data, and then I will be able to experiment with SECURITY ERASE UNIT – before that, I must resort to try safer methods.

Any comments or suggestions?


Top
 Profile  
 
 Post subject: Re: Disable HDD password when master password is unknown
PostPosted: October 5th, 2015, 15:12 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9981
Location: Portugal
1 - Get the free victoria for windows :
http://www.hddoracle.com/viewtopic.php?f=36&t=36

2 - Plug the drive in, make sure you select PIO mode, detect the drive a little bit like on this guide :

http://www.hddoracle.com/viewtopic.php?f=117&t=1072

3 - On the password box input the user password, select user and max.

4 - Press unlock.

5 - Done. Be happy :)

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Disable HDD password when master password is unknown
PostPosted: October 6th, 2015, 17:15 
Offline

Joined: October 4th, 2015, 5:47
Posts: 6
Location: Hungary
I managed to solve the problem. So I assumed I need to have an unknown master password to remove the password protection from the hard drive. Then I found this document. It has a fancy table which reveals that I don't have to know the master password to remove the password protection, as long as the security level is „high”, and the user password is known. That the Lenovo ThinkPad BIOS requires the master password to remove the user password is only a software restriction of the BIOS interface, and not a requirement of the ATA standards.

With that being known, I should have been able to remove the password with hdparm:

Code:
root@thinkpad:~# hdparm --security-disable PASSWORD /dev/sdb
security_password="PASSWORD"

/dev/sdb:
Issuing SECURITY_DISABLE command, password="PASSWORD", user=user
SECURITY_UNLOCK: Input/output error


It failed. Somewhere I've read that many BIOS-es encode the HDD password in keyboard scan codes, and not in ASCII. I encoded the password into keyboard scan codes, but I was still unable to disable security. It probably means that the Lenovo BIOS encodes the HDD password in an unknown way.

In theory, setting another password does not require to supply the old password. So I should be able to supply an arbitrary new password when the hard drive is unlocked, and then try SECURITY_DISABLE with the correctly encoded password. However, I found this method too dangerous, for the following reasons: if I set a password that doesn't conform with the Lenovo BIOS encoding style, the Lenovo BIOS will not allow me to unlock the HDD anymore. Thus, I could have really ended up with a HDD that I can not even unlock, and then it's game over. Theoretically, issuing a SECURITY_SET_PASSWORD immediately followed by a SECURITY_DISABLE should be fool-proof, but honestly, I did not dare to take the risk. If I manage to set a new password, but still unable to disable security, that would suck big times.

Then I've found Jethro Beekman's post. This guy has reverse engineered the algorithm that the Lenovo BIOS uses to encode HDD passwords. He also has a Ruby tool which reproduces this algorithm. Its output can be used with hdparm.

Here are the commands those helped me to remove the password (it is based on the tool's original instructions, adapted to my situation):

Code:
root@thinkpad:~# hdparm --Istdout /dev/sdb > sdb.ata_identify
root@thinkpad:~# P="$(ruby pw.rb sdb.ata_identify)"
Enter password: <<interactively asks for password>>
root@thinkpad:~# hdparm --security-disable $P /dev/sdb
security_password="GARBAGE"

/dev/sdb:
Issuing SECURITY_DISABLE command, password="GARBAGE", user=user


Now, hdparm -I gives me the following:

Code:
Security:
   Master password revision code = 16385
      supported
   not   enabled
   not   locked
   not   frozen
   not   expired: security count
      supported: enhanced erase
   94min for SECURITY ERASE UNIT. 94min for ENHANCED SECURITY ERASE UNIT.


Yeah! It says, security is disabled! Now I have no password anymore!
The same should work with my other drive too.

In theory, if this doesn't work, you can set a new password and then disable security. But, as I wrote earlier, I find it dangerous. I only publish this method for the sake of completeness. If you are really desperate, you can try it, but be warned – if it won't work, you could permanently lock your hard drive. If it won't work, don't power off your drive until you find another solution, because once it will be locked, probably you may never be able to unlock it again.

Code:
hdparm --security-set-pass ARBITRARY /dev/sdb
hdparm --security-disable ARBITRARY /dev/sdb


Once again, be warned: if the first command succeeds but the second one fails, your BIOS will not unlock your drive anymore.


Top
 Profile  
 
 Post subject: Re: Disable HDD password when master password is unknown
PostPosted: October 6th, 2015, 18:10 
Offline
User avatar

Joined: April 3rd, 2011, 0:19
Posts: 1872
Location: Providence, RI
FYI the master password for most WD drives is WDCWDCWDCWDCWDCWDCWDCWDCWDCWDCWDC... I forget exactly how many WDC's it is exactly.

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company


Top
 Profile  
 
 Post subject: Re: Disable HDD password when master password is unknown
PostPosted: October 6th, 2015, 18:57 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 11010
Location: Australia
This might help for the second drive:

ZU - ATA Password Unlock Tool for Several Drives:
http://www.hddoracle.com/viewtopic.php?f=95&t=166&p=334

_________________
A backup a day keeps DR away.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 6 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Exabot [Bot], Google [Bot] and 31 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group