I have a hard drive that has data on it I need to extract. MHDD displays that the unit is locked with high security.

I have tried to unlock this 2.5" IDE drive by using the master password of 32 spaces and that apparently is not it.

Using UBCD 5.34 to try and gain access.

The computer I am using has SATA ports and 1 IDE port. It appears to work well enough to access the hard drive fine.

I have seen a 3 year old thread on a 500gb Toshiba DVR drive but didn't sound like that drive was locked the same way. I have not attempted the WD unlock method yet but will try that soon if I don't get any response.

The computer I am trying to access this drive with does support booting from USB-CD and USB-HDD so I am assuming if I install MHDD on a bootable USB I should be able to run a script on it and save to the USB drive hopefully.

I would GREATLY appreciate it if someone can either walk me through the process or atleast refer me to a link that should help me. I have spent hours looking on this site and don't even know what I should be searching for other than "Unlock Toshiba hard Drive"

From what I have read ZU might unlock the drive but I have not found a recent copy of that software. I have also seen mention of dumping the secure part of the HDD to a file then looking through with a hex editor.

I have considered purchasing similar drives and trying to swap the PCB if the password is on the PCB to get access to the data but reading some of the threads I gather it is likely on the platter but MHDD should be able to bypass the firmware and read directly from the platter. That or change the password and see what changes on the platter. Figure at a minimum if the password is hashed maybe I can erase the password if I can write to the sectors.

Would greatly appreciate if anyone can point me in the right direction!

Thanks!

Why?
Your drive is a Toshiba. Not Western Digital.
http://files.hddguru.com/download/Softw ... 050911.rar

This drive is out of a Windows Mobile based device and the password is set by the device so I have no access to the password.

I am trying to recreate what was already done in a Thread that is 3 years old and the people involved are no longer around to ask.

They suggested that it was simple to unlock and mentioned tools from the manufacturer that were readily available online. I have not been able to track down those utilities at this point and still trying to sort it out. The verbage of the posts in the thread are so vague I suspect that they could have used ZU or some other utility to gain access but from the verbage I assumed they meant a Toshiba utility.

I am doing this more as a learning experience than anything else. I may also be able to set my own master password on a new drive, install in the device and reinstall the software and do it that way as well but the posters on the thread I am referring to made it sound like it was a simple process. While my future career goal heads me in the direction of forensics and RE I am trying to learn the trade today by being able to customize my own devices. (A friend of mine works for a company that tests electronics for vulnerabilities for well known companies and with the latest IoT based bot attacks he is very busy. He has not dealt with trying to unlock hard drives nor does he have the equipment to do so. )

If I unlock the drive through a service it will be locked again as soon as it is installed back into the device and restarted. People have been able to customize the device once gaining access to the software on the drive but again those that know are not around anymore so I am trying to duplicate their process.

Again thanks for the help!

This is the one posting they left back in 2011. I think they live in Russia or one of the previous Soviet Union states from other postings so not sure their English is 100% but this is what I am refering to:


"
To unlock the drive you will need the drives tools from its website, Then start up the radio, After it starts, then leave power to the drive without killing power, connect it to your main computer. As long as the drive was unlocked from the radio and no power loss has occured, it will remain unlocked so you can read out the contents of the drive. Also you can unlock it with the drive tools.


I have hacked this unit pretty good so far. It was not very hard. I also made a set of files that update your whole system, including maps and gracenotes via a usb stick. It is 7gigs in size, so i cant just post it somewhere. It dont ask for a password either, so it can update anyones radio regardless of vin.

The drive layout is pretty simple to figure out. Same with hacking of the signing of components.

Also they didnt encrypt any of the files so they are simple to reverse thru ida pro.
"

So I am unsure what they meant.
Rest of thread won't really help with this so I just quoted the only post they left behind refering to the drive its self.
Have to get an environment up that will run ZU and try that on the drive. Maybe that will do it.

Rodney

ISTM that your thread ...

http://www.cadillacforums.com/forums/ca ... 05138.html

... is trying to do something like this:

Remove ATA password from Hitachi Endurastar J4K100 series (in a Chrysler Town & Country satnav):
http://www.hddoracle.com/viewtopic.php?f=21&t=570

Some lateral thinking (substituting a WD HDD for the Hitachi) was required.

_________________
A backup a day keeps DR away.

Yes fzabkar that is the thread I am refering to.

At this point in time I am trying whatever avenues I can to unlock this toshiba drive first before trying something different.

I am assuming that if I get a WD drive installed in this radio I might have much better luck?

I will likely purchase another unit, install that system into my car to get it up and running (requires reprogramming VIN to my car). Buy an update disk and go from there. But I will need to also have the current unit that I have programmed for my cars vin as well. So then I would have 2 radios programmed to my VIN. That would allow me to work on one of them and use the NAV disk to reinstall onto the hard drive if necessary and allow me to try a different manufacturer of hard drive.

Rodney

Spildit, I am not sure how they would be able to do that? I mean physically. The laptop connector has an integrated power cable so I am guessing would require building some sort of custom cable?

I have a USB cable I could use if I can figure out how they are able to turn on the radio and not lose power to it?

Other option is to sniff the connection as I seem to remember someone else doing that to grab the password? if I can capture the actual ATA commands sent from the radio to the drive I should have the password as well?

Rodney

A WD HDD is better to work with because there are publicly available methods to retrieve the password, assuming that the satnav locks each drive with the same password. If the password is uniquely generated for each drive, then we could use a tool such as HDDHackr to make a WD drive identify itself as a Toshiba.

_________________
A backup a day keeps DR away.

I have the following configurations available for reading this drive. I do have a 3.5" to 2.5" adapter.

I have a USB - IDE external case for a 2.5" drive.
I have a USB to SATA/IDE adapter cable.
I also have a PCIeX4 card that provides an IDE connection to the motherboard.

None of these methods worked with MHDD running from UBCD to recognize the drive.

I remembered I have an older PC with both SATA and IDE ports onboard. This one read the drive fine with MHDD.
Note that all modes worked to access the drive via Windows 10 and Linux but not MHDD.

I downloaded ZU but looking for a bootable DOS to run it from USB drive. Apparently at some point RUFUS used to have FREEDOS as an option but I don't see it now. Will try installing FREEDOS onto a USB drive and booting that tonight.

Will try ZU on it tonight and see if I get it to work. Would be MUCH simpler if it does.

Since the radio is a junkyard radio I have to have the VIN matched to my car. Then I have to have a navigation upgrade disk matched to the VIN in my car to install the software on the new drive. If I have to do this then I will be waiting until after the new year. I am hoping the VIN is setup on the drive. If it is in the Radio firmware I MAY be able to get it changed locally.

Anyhow thanks a bunch for the help so far.

I assume at this point we are figuring if ZU doesn't work with it then the only option is to use a hardware solution to access the drive and bypass the password and even that isn't fool proof?

Woo Hoo... ZU unlocked it like it was nothing... So for future reference ZU will do a MK4036GAC drive. Took longer to hit the return key after typing in the command than it did for zu to unlock the drive...

Currently imaging the drive using DD to a linux file...

Thank you for your help and I guess I made this more difficult than it needed to be...

Installed Freedos and ZU to a USB flash drive and boom....

Rodney