All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 10 posts ] 
Author Message
 Post subject: How to unlock HDD without the original computer?
PostPosted: December 7th, 2022, 10:54 
Offline

Joined: December 7th, 2022, 9:25
Posts: 8
Location: Hong Kong
How to unlock/erase BIOS password locked hard disks without the original computers?

There are a bunch of 2.5" mechanical hard disks (80GB of brand Fujitsu and Hitachi) left from old laptops (over 10 years). I recorded their BIOS hard disk passwords in a spreadsheet. All of their original laptops (mostly of brand Lenovo/IBM) were disposed.

When I connect these hard disks into another computer and boot, they prompt for hard disk passwords at the very beginning stage (most likely before BIOS). However, I tried most of the possible and recorded passwords, they do not unlock the hard disks.

As I know the passwords, and I cannot unlock any one of the hard disks, I think it is because I cannot unlock the hard disks in another computer.

If there is no way to unlock them, I will sacrifice the data and would like to format and reuse those storages. However I failed to format with ordinary methods. Windows' Disk Management and DiskPart reports the HDD is write protected. Linux's fdisk gives "cannot open /dev/sda: Input/output error". Tried HDDGURU's Wipe My Disks and HDD LLF Low Level Format Tool, they cannot write to the HDD too.

Here is the output of hdparm -I /dev/sda in Linux.

Code:
# hdparm -I /dev/sda

/dev/sda:

ATA device, with non-removable media
        Model Number:       HTS541080G9SA00                         
        Serial Number:      MPBDLAXNH3MJZM
        Firmware Revision:  MB4IC60R
Standards:
        Used: ATA/ATAPI-7 T13 1532D revision 1
        Supported: 7 6 5 4
Configuration:
        Logical         max     current
        cylinders       16383   16383
        heads           16      16
        sectors/track   63      63
        --
        CHS current addressable sectors:    16514064
        LBA    user addressable sectors:   156301488
        LBA48  user addressable sectors:   156301488
        Logical/Physical Sector size:           512 bytes
        device size with M = 1024*1024:       76319 MBytes
        device size with M = 1000*1000:       80026 MBytes (80 GB)
        cache/buffer size  = 7538 KBytes (type=DualPortCache)
Capabilities:
        LBA, IORDY(can be disabled)
        Standby timer values: spec'd by Vendor, no device specific minimum
        R/W multiple sector transfer: Max = 16  Current = 16
        Advanced power management level: 128
        Recommended acoustic management value: 128, current value: 254
        DMA: mdma0 mdma1 mdma2 udma0 udma1 udma2 udma3 udma4 *udma5
             Cycle time: min=120ns recommended=120ns
        PIO: pio0 pio1 pio2 pio3 pio4
             Cycle time: no flow control=240ns  IORDY flow control=120ns
Commands/features:
        Enabled Supported:
           *    SMART feature set
           *    Security Mode feature set
           *    Power Management feature set
           *    Write cache
           *    Look-ahead
           *    Host Protected Area feature set
           *    WRITE_BUFFER command
           *    READ_BUFFER command
           *    NOP cmd
           *    DOWNLOAD_MICROCODE
           *    Advanced Power Management feature set
                Power-Up In Standby feature set
           *    SET_FEATURES required to spinup after power up
                SET_MAX security extension
                Automatic Acoustic Management feature set
           *    48-bit Address feature set
           *    Device Configuration Overlay feature set
           *    Mandatory FLUSH_CACHE
           *    FLUSH_CACHE_EXT
           *    SMART error logging
           *    SMART self-test
           *    General Purpose Logging feature set
           *    WRITE_{DMA|MULTIPLE}_FUA_EXT
           *    IDLE_IMMEDIATE with UNLOAD
           *    Gen1 signaling speed (1.5Gb/s)
           *    Host-initiated interface power management
                Device-initiated interface power management
           *    Software settings preservation
Security:
        Master password revision code = 65534
                supported
                enabled
                locked
        not     frozen
                expired: security count
        not     supported: enhanced erase
        Security level maximum
        52min for SECURITY ERASE UNIT.
Checksum: correct


hdparm -I /dev/sda does not work also.

Code:
# hdparm --user-master u --security-unlock xxxxxxxx /dev/sda
security_password: "xxxxxxxx"

/dev/sda:
Issuing SECURITY_UNLOCK command, password="xxxxxxxx", user=user
SG_IO: bad/missing sense data, sb[]:  70 00 05 00 00 00 00 0a 04 51 40 00 21 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
# hdparm --user-master m --security-unlock xxxxxxxx /dev/sda
security_password: "xxxxxxxx"

/dev/sda:
Issuing SECURITY_UNLOCK command, password="xxxxxxxx", user=master
SG_IO: bad/missing sense data, sb[]:  70 00 05 00 00 00 00 0a 04 51 40 00 21 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00


How to unlock / format the HDDs with my known passwords? I really do not want to waste them and just turn those HDDs into metal garbage. Thank you very much in advance for any helps!


Top
 Profile  
 
 Post subject: Re: How to unlock HDD without the original computer?
PostPosted: December 7th, 2022, 17:31 
Offline

Joined: August 18th, 2010, 17:35
Posts: 3637
Location: Massachusetts, USA
MHDD, ZU...

_________________
Hard Disk Drive, SSD, USB Drive and RAID Data Recovery Specialist in Massachusetts


Top
 Profile  
 
 Post subject: Re: How to unlock HDD without the original computer?
PostPosted: December 7th, 2022, 18:07 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15529
Location: Australia
http://www.hddoracle.com/download/file.php?id=130

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: How to unlock HDD without the original computer?
PostPosted: December 8th, 2022, 11:49 
Offline

Joined: December 7th, 2022, 9:25
Posts: 8
Location: Hong Kong
labtech wrote:
MHDD, ZU...

Thank you for the tips.

Tried MHDD but I still cannot unlock the disk. Using the unlock command with the recorded password does not work. Also tried following these steps to dump the hex. But I get ERROR: No DRQ at line 7: CHECKDRQ during the dump. (This error seems quite common and it seems no one was able to solve.)

I also tried using ZU, following these step. In that website he said ZU took only 2 seconds. But it took me 10 minutes+ and still loading. Is ZU checking each combination of the passwords? Do you recommend I should let it run for several hours? To use ZU, do I need to add commands after /p or /s, like this thread?

Thank you very much!!


Top
 Profile  
 
 Post subject: Re: How to unlock HDD without the original computer?
PostPosted: December 8th, 2022, 12:59 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15529
Location: Australia
ZU does not "brute force" the password.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: How to unlock HDD without the original computer?
PostPosted: December 8th, 2022, 14:32 
Offline

Joined: December 7th, 2022, 9:25
Posts: 8
Location: Hong Kong
fzabkar wrote:
ZU does not "brute force" the password.

Thank you very much. I see!

Should I use zu /p and zu /s only? Why I see others typing a dot (.) after it? Or adding a number 8 and some text after it? What else I can do if both zu /p and zu /s fail?


Top
 Profile  
 
 Post subject: Re: How to unlock HDD without the original computer?
PostPosted: December 8th, 2022, 14:42 
Offline

Joined: December 7th, 2022, 9:25
Posts: 8
Location: Hong Kong
I do not understand why, I know the password but I cannot unlock the hdd. Is it that the password is combined with the firmware of the original laptop?


Top
 Profile  
 
 Post subject: Re: How to unlock HDD without the original computer?
PostPosted: December 8th, 2022, 14:45 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15529
Location: Australia
English translation of ZU readme.txt

The previous release of ZU (ZU.Betta1.1) used simple methods to remove passwords.

Removing the passwords on HGST/IBM and Native Hitachi HDDs (eg _DK23DA, _DK23FA ..) requires that they be placed in so-called "SafeMode".

ZU.Betta 2.0 now supports working in this mode.

Since different drives require different amounts of time to enter this special mode (eg Native Hitachi HDDs require up to 2 minutes), now, for the sake of convenience, a timer is started when ZU is launched. The program reports the elapsed time at one second intervals, for example ELAPSED 00:00:22 (00:00:23 ..), while concurrently conducting a survey of readiness on the specified channel. Press any key to stop this polling if it continues for an excessively long time. The program will then terminate with the message "UNLOCK NOT DONE".

To distinguish between vendors, there are now 2 qualifiers:

Code:
"."     for HGST / IBM

"8"     for Native Hitachi

That is, one would use command formats such as the following:

Code:
ZU / S.       battle with HGST on the Secondary channel :)

ZU / P8       NativeHitachi on Primary channel

Placing the drive in SafeMode can be done using a variety of methods.

HGST PATA models can simply be jumpered for SafeMode, while other drives can be induced into SafeMode by "faulting" the NVRAM or by shorting specific points on the PCB.

In general, one can simply try to apply power to the controller while it is disconnected from the HDA (or unscrew the 2 screws on the controller on the side opposite the interface and slightly lift it with a toothpick :))

After ZU detects the drive and attacks it, the program will report the NativeHitachi message "NOW YOU CAN SCREW IT IN. PRESS ANY KEY WHEN READY".

The HGST message will be "POWER OFF / ON AND EXECUTE ZU AGAIN".

In the first case, you just need to reinstall the controller on the drive, carefully screw it down, and then press any key.

In the second case, turn off the power and reinstall the controller. Then power up the HDD and run ZU again with the same parameters. This procedure applies to IBM / HGST (ExcelStore) models from DTLA to HTS7225xxK9SA00 (5K250) (dozens of models).

The following are not supported:

    Notebook HDDs with suffix A300 (A301) (eg 5K500 B-250 HTS545025B9A300)
    (blue controller with 9 screws)

    3.5" HDDs with suffixes 332/362. (eg HDS721010CLA332, HTS721032CLA362 ..)
    [These will be supported as soon as there is a sufficient number for experimentation.]

P.S. Fixed bug for Samsung Rubicon.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: How to unlock HDD without the original computer?
PostPosted: December 8th, 2022, 16:51 
Offline

Joined: December 7th, 2022, 9:25
Posts: 8
Location: Hong Kong
fzabkar wrote:
English translation of ZU readme.txt

...


Thank you very much for the translation. It is quite interesting. I think I have to buy a T6 Torx screwdriver before proceed. I have been trying for 3 days without any progress.

May I ask if it will help if I use older motherboards or CPUs? Currently I am using Gigabyte B85M MDB with Intel 4790K. I think I have another ancient MDB but I have to dig it out from my storage.


Top
 Profile  
 
 Post subject: Re: How to unlock HDD without the original computer?
PostPosted: December 8th, 2022, 17:22 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15529
Location: Australia
Configure the SATA controller in BIOS for legacy or IDE compatibility mode. You will then see IDE controllers at the traditional I/O port addresses, namely 0x1F0 (primary) and 0x170 (secondary).

As for inputting a known password into MHDD, be aware that passwords are usually stored as keyboard scan codes rather than ASCII characters.

About passwords ...
http://www.hddoracle.com/viewtopic.php?f=95&t=614&p=1620#p1620

Lenovo passwords are a lot more complicated:
https://ascnb1.ru/forma1/download/file.php?id=25795

_________________
A backup a day keeps DR away.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 10 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Google [Bot] and 171 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group