MultiDrive – free backup, clone & wipe disk utility from Atola Technology

All times are UTC - 5 hours [ DST ]


Forum rules


Please do not post questions about data recovery cases here (use this forum instead). This forum is for topics on finding new ways to recover data. Accessing firmware, writing programs, reading bits off the platter, recovering data from dust...



Post new topic Reply to topic  [ 96 posts ]  Go to page Previous  1, 2, 3, 4, 5
Author Message
 Post subject: Re: WD MCU - No more...
PostPosted: September 5th, 2026, 17:46 
Offline
User avatar

Joined: September 29th, 2005, 12:02
Posts: 3590
Location: Chicago
WebClaw wrote:
Original PCB. Original MCU. Normal plaintext baseline. Modified the SA structure being discussed, power cycled, and read the same area again.
=Encrypted

Are you saying that non-original 0x8003 makes all data scrambled?
This sounds impossible. AFAIK is not read by the drive and it's written only externally.
I can check it when I'm back at work but very likely you made a mistake somewhere during the test

_________________
SAN, NAS, RAID, Server, and HDD Data Recovery.


Top
 Profile  
 
 Post subject: Re: WD MCU - No more...
PostPosted: September 5th, 2026, 18:00 
Offline

Joined: November 24th, 2011, 21:48
Posts: 255
Location: Canada
I can certainly recheck. I'll use Spyglass and the same Charger for comparison.


Top
 Profile  
 
 Post subject: Re: WD MCU - No more...
PostPosted: September 5th, 2026, 22:08 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 17208
Location: Australia
Can you also modify the foreign 0x8003 module by changing the reported SATA capacity to the IDEMA standard? For example, for a 2TB model, change 3906963632 to 3907029168. Then see if the reported capacity does indeed change. If it does, then this will be additional confirmation that the drive makes use of this module.

See https://forum.hddguru.com/viewtopic.php?p=320999#p320999

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: WD MCU - No more...
PostPosted: September 5th, 2026, 22:24 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 17208
Location: Australia
Doomer wrote:
2. On top of that initial SysTick value also need to be exact as it was during original keys generation (not sure how it's achieved).

Could this have something to do with it?

Code:
RT-02450 1/31/2019 10:04:28 AM

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: WD MCU - No more...
PostPosted: September 5th, 2026, 23:44 
Offline

Joined: November 24th, 2011, 21:48
Posts: 255
Location: Canada
I'll have my re-test tomorrow when I head into the office.

This makes the most sense to me:
MCU-held secret / state + SA-held drive-specific value / state -> correct decryption context


Top
 Profile  
 
 Post subject: Re: WD MCU - No more...
PostPosted: Yesterday, 4:06 
Offline

Joined: May 9th, 2024, 14:00
Posts: 7
Location: india
fzabkar wrote:
Can you also modify the foreign 0x8003 module by changing the reported SATA capacity to the IDEMA standard? For example, for a 2TB model, change 3906963632 to 3907029168. Then see if the reported capacity does indeed change. If it does, then this will be additional confirmation that the drive makes use of this module.

See https://forum.hddguru.com/viewtopic.php?p=320999#p320999

In module 0x8003,
For Charger it is 3906963632,

while for CaramelR 7200 it is 3907029168,

Charger is self encrypting while CaramelR 7200 is not.
Hope it helps.

MSM DATA RECOVERY


Top
 Profile  
 
 Post subject: Re: WD MCU - No more...
PostPosted: Yesterday, 4:12 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 17208
Location: Australia
The reduced capacity is typical of 2.5" Passport and Elements models. I believe the intent is to prevent the host from accessing the SmartWare encryption key at the end of the user area.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: WD MCU - No more...
PostPosted: Yesterday, 12:07 
Offline
User avatar

Joined: September 29th, 2005, 12:02
Posts: 3590
Location: Chicago
fzabkar wrote:
The reduced capacity is typical of 2.5" Passport and Elements models. I believe the intent is to prevent the host from accessing the SmartWare encryption key at the end of the user area.

it's space for a VCD with unlocking software

_________________
SAN, NAS, RAID, Server, and HDD Data Recovery.


Top
 Profile  
 
 Post subject: Re: WD MCU - No more...
PostPosted: Yesterday, 12:11 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 17208
Location: Australia
Doomer wrote:
fzabkar wrote:
The reduced capacity is typical of 2.5" Passport and Elements models. I believe the intent is to prevent the host from accessing the SmartWare encryption key at the end of the user area.

it's space for a VCD with unlocking software

I'm fully aware of that, but there is a twist. See my other thread on the subject. Normally, when the bridge is removed, the SATA drive then reverts to its full IDEMA capacity. However, this does not happen in recent USB models.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: WD MCU - No more...
PostPosted: Yesterday, 13:00 
Offline

Joined: May 30th, 2005, 17:07
Posts: 545
Hi,
Module 8003 is only an information module; it does not store information about disk capacity reduction.
Information about disk capacity reduction is stored in module 02.

Mikippp


Top
 Profile  
 
 Post subject: Re: WD MCU - No more...
PostPosted: Yesterday, 13:06 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 17208
Location: Australia
Mikippp wrote:
Hi,
Module 8003 is only an information module; it does not store information about disk capacity reduction.
Information about disk capacity reduction is stored in module 02.

Mikippp

Not in this case. See my other thread on this subject. All 5 capacity parameters in module 0x02 reflect the full IDEMA capacity. The SATA drive somehow knows that it was a USB model with a protected VCD area, and it continues to hide this area even after SATA conversion.

As for 0x8003 being an information module, that's what I assumed until @WebClaw's experiment suggested otherwise.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: WD MCU - No more...
PostPosted: Yesterday, 13:25 
Offline

Joined: May 30th, 2005, 17:07
Posts: 545
Capacity reduction works via a switch in module 02.
Simply change 80 to 00 in one place and the full disk capacity will be restored.

Mikippp


Top
 Profile  
 
 Post subject: Re: WD MCU - No more...
PostPosted: Yesterday, 15:02 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 17208
Location: Australia
Mikippp wrote:
Capacity reduction works via a switch in module 02.
Simply change 80 to 00 in one place and the full disk capacity will be restored.

Mikippp

I take that as a challenge. I've narrowed it down to three candidates in three separate sections.

When people convert these drives (Passport) to SATA, are they able to decrypt them with PC3000 by using the key in module 0x25? Or do they need to replace the coupling capacitors and decrypt the data via the USB bridge?

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: WD MCU - No more...
PostPosted: Today, 2:32 
Offline
User avatar

Joined: May 13th, 2010, 11:17
Posts: 2847
Location: Kuwait
fzabkar wrote:
Mikippp wrote:
Capacity reduction works via a switch in module 02.
Simply change 80 to 00 in one place and the full disk capacity will be restored.

Mikippp

I take that as a challenge. I've narrowed it down to three candidates in three separate sections.

When people convert these drives (Passport) to SATA, are they able to decrypt them with PC3000 by using the key in module 0x25? Or do they need to replace the coupling capacitors and decrypt the data via the USB bridge?


I told you, you should think about investing in DR,,,

I was away for few days and i saw some good progress, some are moving forward and others are going to the wrong direction.
Just a little final comment here for anyone who thinks am bluffing..



"Send me any healthy drive from those MCU locked families, in addition to the native ROM (hate to waste more time testing) and i will send you here screenshot of what you have inside"
i believe this is the best proof of concept i can do to prove that am not bluffing. (in addition to my fees in advance)

@msmdatarecovery Welcome here, Its good to know someone new here singing the same song well.


Attachments:
AE.jpg
AE.jpg [ 64.05 KiB | Viewed 45 times ]

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein
Top
 Profile  
 
 Post subject: Re: WD MCU - No more...
PostPosted: Today, 5:14 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 17208
Location: Australia
einstein9 wrote:
fzabkar wrote:
When people convert these drives (Passport) to SATA, are they able to decrypt them with PC3000 by using the key in module 0x25? Or do they need to replace the coupling capacitors and decrypt the data via the USB bridge?


I told you, you should think about investing in DR,,,

Why is even the most basic question treated like an industry-busting trade secret?

As for the quote "the secret to creativity is knowing how to hide your sources", "there is no substantive evidence that Einstein ever made a remark of this type".

https://quoteinvestigator.com/2014/06/01/creative/

In any case, the phrase means that you are telling us that you are not creative. Instead, you are saying that you have appropriated someone else's work and are passing it off as your own.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: WD MCU - No more...
PostPosted: 14 minutes ago 
Offline
User avatar

Joined: May 13th, 2010, 11:17
Posts: 2847
Location: Kuwait
fzabkar wrote:
einstein9 wrote:
fzabkar wrote:
When people convert these drives (Passport) to SATA, are they able to decrypt them with PC3000 by using the key in module 0x25? Or do they need to replace the coupling capacitors and decrypt the data via the USB bridge?


I told you, you should think about investing in DR,,,

Why is even the most basic question treated like an industry-busting trade secret?

As for the quote "the secret to creativity is knowing how to hide your sources", "there is no substantive evidence that Einstein ever made a remark of this type".

https://quoteinvestigator.com/2014/06/01/creative/

In any case, the phrase means that you are telling us that you are not creative. Instead, you are saying that you have appropriated someone else's work and are passing it off as your own.


You know me ; I don't waste my time on pointless arguments.
If you were in DR you will understand my research like the others who replied, and it is not my job to explain every single word from what am writing to YOU here.

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 96 posts ]  Go to page Previous  1, 2, 3, 4, 5

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 104 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group