PDA

View Full Version : Data Recovery On Hardware Locked HD


Crgky127
08-07-2008, 04:25 AM
What options are available?

I don't even know what a healthy locked HD would do if you hooked it up to a usb adapter.

Same goes for HDD Regenerator.

The replacing PCB trick shouldn't be affected right?


I ask because my father has a non functioning hardware locked HD in his work laptop (new, copied over from old one, just barely got it how he likes it so didn't backup yet, lost about 2 weeks of work). The IT guy at his work (more of a server guy, he had never before seen the SATA to usb cable I lent my dad), put it in the freezer for a while, and then it worked a bit but not long enough to get the stuff off, the password entry prompt came up though. Now they are leaving it in the freezer over night. There were no clicking sounds. Regardless of how this situation works out, how are data recovery techniques affected by hardware locks?

Trouble-Shooter
08-07-2008, 06:43 PM
If it is locked with the "Drivelock" product, it's tough. I haven't been able to crack one yet, but apparently it can be done. Some boot CDs (hirens) have some HDD unlocking utilities, but I haven't been able to beat Drivelock yet. Here's a news article proving it CAN be done though:

http://www.dailytech.com/article.aspx?newsid=2135&commentid=24943&threshhold=1&red=647

Crgky127
08-08-2008, 05:06 AM
Does it need to be unlocked before using HDD Regen or connecting via USB adapter?

Simmy
08-08-2008, 07:54 AM
Yes, you cannot read/write any data from/to the hard drive until the Drivelock is removed.

It is a bugger to get around but it's also possible (not that I've done it). What make is the hard drive? You can get specific software for each make of hard drive to remove Drivelock. Assuming you've only set the user password on the harddrive, the master password should be set to one of the manufacturers defaults. If you've set the master password and you don't know what that is, then it's pretty much game over.

Replacing the PCB does work apparantly, but you need an identical board with the same firmware which will be quite difficult to locate for a laptop hard drive I would have thought. Or you could send the data to a specialist who can extract the data in a clean room directly from the platters.

Crgky127
08-08-2008, 01:50 PM
So fixing bad sectors with HDD Regenerator would need the lock removed first? And does having bad sectors make it impossible to remove the lock, resulting in a chicken/egg? Can the lock be removed when hooked up to a USB adapter, or only in a laptop?

I don't know any specifics on it, my dad was just telling me about it. He asked me what to do about it and I let him borrow my UBCD4Win, HDD Regen, and USB adapter, but I told him I don't know if any of the usual stuff will work. The IT guy at his work has the drive now, probably going to take it to a drive recovery service. That IT guy does know the password, but I assume to remove it the drive has to be recognized by the laptop. Which it was for a little bit after being in the freezer for a couple hours. They are trying overnight now I think.

I think I'm going to suggest to my customers that encrypting files is a more disaster ready technique than hardware locks.

Simmy
08-08-2008, 02:26 PM
So fixing bad sectors with HDD Regenerator would need the lock removed first?

Yes. Usually the drive won't even spin up until you enter the password. Does the drive spin up for you?

And does having bad sectors make it impossible to remove the lock, resulting in a chicken/egg? Can the lock be removed when hooked up to a USB adapter, or only in a laptop?

The password is stored on the PCB so bad sectors on the platters shouldn't affect removing the lock I don't think.

I don't know any specifics on it, my dad was just telling me about it. He asked me what to do about it and I let him borrow my UBCD4Win, HDD Regen, and USB adapter, but I told him I don't know if any of the usual stuff will work. The IT guy at his work has the drive now, probably going to take it to a drive recovery service. That IT guy does know the password, but I assume to remove it the drive has to be recognized by the laptop. Which it was for a little bit after being in the freezer for a couple hours. They are trying overnight now I think.

I think I'm going to suggest to my customers that encrypting files is a more disaster ready technique than hardware locks.

If you're going to take it to a specialist I would advise against putting it in the freezer. Condensation could form and freeze on the platters from what I've read.

Could you put the hard drive back into the computer it came from and remove the drive lock from within the BIOS, seeing as you know the password?

Crgky127
08-08-2008, 11:13 PM
I've never even seen it. The IT guy at my dads work is handling it. My dad just talked to me about it. It just got me thinking what would I do if I was in that situation. You answered my main concern though, thank you. If the lock is on the PCB it means it's just like any other recovery.

rahimhd
08-03-2010, 09:56 AM
ATA password totally disabled data access into the hdd. While in the locked status, you can't access the hdd. Only when the drive status changed to open/unlock that the hdd firmware permits data access. Various tools exists to remove the lock.
This page offer good reading: http://www.salvationdata.com/blog/hd-doctor01/ (http://www.salvationdata.com/blog/hd-doctor01/)

And for laptop with locked hdd, for super cheap services, visit:
http://www.acersnoop.co.cc