I've been left struggling due to encryption based on the PCB of a caddy, one of these:
http://support.lenovo.com/en_GB/product ... MIGR-74406
http://download.lenovo.com/ibmdl/pub/pc ... _hd-ug.pdf

HDD has had full disk image created, bad sectors filled with pattern, there were very few.
Connection by USB powers the HDD, it is possible to unlock using the keypad and get the green light indicating successful unlock. The device is not detected by the computer (no USB detection or by eSATA). I've checked continuity on all the USB pin-outs. These are fine. The data + & - have no break in continuity to the point they reach the USB processor - Initio INIC 1610EL.

The manufacturer of the PCB with the security features is Apricorn INC. I've had one in before branded as "iStorage diskashur" and it was straight forward to decrypt. It appears there is some fault with the caddy PCB.

I presume the security info is stored in either of the 8 pin serial ROM chips or the larger 28pin chip, but I expect trying to find a matching donor caddy PCB will be difficult due to chip revisions? On the previous model I handled the critical chips had a hard epoxy covering to prevent removal or identification

Does anyone have any suggestions?

Wanted parts post here:
viewtopic.php?f=15&t=27529
If you have one then sensible offers are welcome.

Image of PCB can be viewed here:
http://s30.postimg.org/chj3tw4yp/IMG_20 ... 193828.jpg

Thanks,
J

If you could provide a better photo, perhaps I could try to help you on the electronics side.

BTW, you first two URLs are incomplete.

_________________
A backup a day keeps DR away.

Is it a 500gb drive inside?

_________________
PC Image Data Recovery
http://www.pcimage.co.uk

New!! HDD-PCB.COM for all your PCB and donor HDD requirements!

Hi Sean, yes it's a 500GB Toshiba that was inside.

A (slightly) better quality image is attached.

The photo is still useless, but ISTM that if the password were stored on the PCB, then a PCB swap would easily defeat it.

I don't see the two "8 pin serial ROM chips" that you refer to. I only see Q4 which is possibly a dual MOSFET for switching power to the SATA connector. The other is U4 which, judging by its proximity to the bridge IC, could be a flash memory.

I suspect that U3 (the 28-pin IC) is, among other things, a keyboard decoder, not a memory device, although it may contain some embedded flash.

If you could provide the markings on each of these chips, then I may be able to determine a little more about them.

BTW, these are your broken URLs:
http://support.lenovo.com/en_GB/product ... MIGR-74406
http://download.lenovo.com/ibmdl/pub/pc ... _hd-ug.pdf

_________________
A backup a day keeps DR away.

Post the contents of sector 976,773,105

_________________
PC Image Data Recovery
http://www.pcimage.co.uk

New!! HDD-PCB.COM for all your PCB and donor HDD requirements!

I had exact same case but was unable to solve it quickly enough for impatient client.

These controllers seem to check for a key sector after entering the correct keypad code, and only then will it initialise as a device. After some extensive research, I located the sector containing the key sector and in the patient it was zeroed.

I had an exact same working device and tried swapping the two "ROM" chips from the patient PCB over to the donor PCB to no avail.

The patient PCB worked with the donor "ROM" chips and donor hdd, indicating that it wasn't an electronic fault.

I was in the process of trying to locate a backup copy of the key sector, ran out of time before client wanted drives back.

_________________
PC Image Data Recovery
http://www.pcimage.co.uk

New!! HDD-PCB.COM for all your PCB and donor HDD requirements!

I can only see one possible "ROM". :?

Which chips are you referring to?

_________________
A backup a day keeps DR away.

I can't remember exactly, but seemed there were two candidate chips from memory.

Now you mention it, only one seemed to be necessary as I remember.

I'm not in lab so don't have access to my notes.

But either way it's irrelevant, the patient PCB was proved to be OK and it was the absence of the key sector that was preventing the device even initialising as a USB device.

_________________
PC Image Data Recovery
http://www.pcimage.co.uk

New!! HDD-PCB.COM for all your PCB and donor HDD requirements!

Qn = transistor
Un = integrated circuit

_________________
A backup a day keeps DR away.

I wasn't referring to the photo, just from memory.

I was just trying to assist the OP from my past experience on this particular device, rather than showing off my electronics prowess which is obviously inferior to yours. Well done.

I shall continue this in private with the OP.

_________________
PC Image Data Recovery
http://www.pcimage.co.uk

New!! HDD-PCB.COM for all your PCB and donor HDD requirements!

To be accused of showing off my electronic prowess simply because I pointed out the difference between a transistor and a memory chip leaves me both embarrassed and bemused. I don't know what to say except that such knowledge is trivial, and certainly not worthy of expert status.

I do appreciate your input in other respects, though. In fact IMO you are the most helpful of the "old guard", especially of late.

To the OP, if you are willing to provide the requested information, or a legible photo (preferably both), I would be happy to research the circuitry for you. It may not be of help in this case, but it may save you some time in the future.

_________________
A backup a day keeps DR away.

Where did I say I didn't know the difference between a transisitor and a memory chip?

I already said I wasn't referring to the photo (it looked too unclear to make out any detail, so I didn't even look at it)

_________________
PC Image Data Recovery
http://www.pcimage.co.uk

New!! HDD-PCB.COM for all your PCB and donor HDD requirements!

I don't understand your annoyance. I pointed out the OP's error in a polite way, without making a big deal of it, and I prevented him from needlessly transferring a transistor which he thought to be a "ROM". By insisting that there were two ROMs, and that you had transferred both of them, it seemed to me that you disagreed with my observations. Did you actually transfer the transistor/ROM, or did you transfer the 28-pin IC/ROM (keyboard decoder?), or is there some other mystery component on the other side of the board?

BTW, I am always being told, sometimes disdainfully, by experienced DR professionals that all they need to know about electronics is how to swap a board and transfer the "ROM". In fact at this very moment I'm communicating with a recent graduate of Scott Moulton's 5-day Data Recovery "Expert" course who is struggling to come to terms with a multimeter and who has been told the same thing. Well, it's clear from this thread that transferring ROMs is only part of the story. For a start, you need to be able to identify them.

_________________
A backup a day keeps DR away.

See attached the sector dump as requested. Content of the requested sector obviously of different sort to the encrypted data on the sectors either side.

PCImage - Interesting that the device does not initialise to be detected by the computer even as a USB device if the critical sector has not got the correct data in.

Yes, my apologies for the bad pictures - the battery on the SLR has died. Better picture now attached.

_________________
CDR - Manchester Data Recovery Services
0161 408 4857
http://www.cheadledatarecovery.co.uk/

I have taken a closer look at the photo and also checked my notes on my old case, and fzabkar is totally correct and my recollection of the case was incorrect. There is indeed only one "ROM" chip on the board, there is not one on the other side of the PCB either. I apologise for any confusion caused, I must have been thinking of a different case.

I can however confirm that in my case, the drive would not even be recognised as a USB device until the code was entered (indicated by a green LED) and a valid "magic sector" in place., as in your case.

It would also seem that the backup copy (if there is one) of the key sector isn't in the ROM chip, as the contents of the two chips (patient and donor) only differed in 3 bytes, which seems too small for an encryption sector to me.

It was suggested that the backup key could be hidden in the FW of the drive somewhere, maybe the smart logs, but didn't get time to check it properly.

Your encryption sector looks OK at first glance, but I will try and find the one from my old cases donor drive (I have it backed up somewhere) and compare it to yours.

Of course it could well be a electronic fault in yours, and it wouldn't hurt to take up fzabkars offer of fault-checking the PCB, but the fact that the drive spins and the unit accepts the key code points to the contrary.

_________________
PC Image Data Recovery
http://www.pcimage.co.uk

New!! HDD-PCB.COM for all your PCB and donor HDD requirements!

@cheadledatarecovery, if you would like me to help you determine the function of the various chips, I would need you to identify their markings. I can't make out anything in that regard from your photos.

If you would like to determine whether the USB interface is functional, one way would be to imagine how the board would behave if the flash memory (U4) were blank, as would be the case at manufacturing time. In this case the Initio bridge IC would probably prepare itself to receive a firmware upload, and to this end it would probably enumerate itself as an Initio Default Controller using Initio's PID and VID. To place the bridge in this mode, I would short U4's HOLD pin (#7) to ground. Of course you would need to verify the chip's pinout from a datasheet before you could be certain that this was safe to do.

BTW, Q4 appears to be a single P-channel MOSFET whose function would be to switch +5V power to the drive. Pin #4 is the gate (control) pin, and it would probably be driven by U3 or U2, probably the latter, if WD's products are any guide.

U3 appears to be an intelligent chip, possibly a 4-bit microcontroller with several 4-bit I/O ports. It may contain some flash memory. The keypad has 3 rows and 4 columns which means that 7 I/O lines would be required to decode it. I can't see where these lines go, but the underside of the PCB will probably point to U3 as the decoder. U3 also has 3 I/O pins which drive the tri-colour LED at D1.

U1 and Q1-3 appear to have some power related function, but I can't be certain until I see their markings.

_________________
A backup a day keeps DR away.

Regarding sector 976,773,105. I've found that if I do zero this out, or even using a completely non-matching HDD, that when I enter the security code that I still obtain the green LED indicating a successful unlock.

Moreover, if I then remove the HDD from the caddy and check sector 976,773,105 it shows that same data as pictured in the above sector dump has been re-written to the hard disk drive.

In this case the user's key code is the default code provided with the HDD (12345678'unlock'). From reading the user manual it appears that after certain number of incorrect attempts that it will prevent further unlocks and the device requires resetting to allow normal functionality. What the manual does make clear is that if you choose to reset the device then it will not be possible to recover the data from the device.

I am not certain what previous attempts the customer made with this device. He works for a large organisation and it could well have been handled by his IT support staff too.

_________________
CDR - Manchester Data Recovery Services
0161 408 4857
http://www.cheadledatarecovery.co.uk/

If you enter the wrong code, do you get a different coloured LED, and does the key sector change to something else? For example, does it look like some counter is being incremented? If there is no change, then this would suggest that the password attempt counter could be stored within U3. It would help to know the markings on U3 (can you not see them under a bright light?) so that we could consult a datasheet. The datasheet might tell us if U3 has rewriteable memory. You might need to scrape away the white paint.

_________________
A backup a day keeps DR away.

When the wrong code is entered a red flashing LED is produced.

See attached sector dump for the difference in data on the HDD at 976,773,105 when the incorrect unlock code us used. Differences highlighted. When a incorrect code is entered a second time there are no further changes to the sector.

On U3:
PIC16F883
-I/22
11189BQ

Thanks

_________________
CDR - Manchester Data Recovery Services
0161 408 4857
http://www.cheadledatarecovery.co.uk/