DriveLock feature i...
 
Notifications
Clear all

DriveLock feature in Harddisk

38 Posts
15 Users
0 Likes
2,970 Views
 Eddi
(@eddi)
Posts: 9
Active Member
Topic starter
 

Dear All,

in a recent case I am challenged with a harddisk (Toshiba 60GB) taken from a Compaq laptop computer.

The drive is locked with the "drivelock" feature, which is a feature of the ATA-command set. After powering on the system the (Phoenix-) BIOS asks for the master password. If the wrong passwort is entered for 3 times the drive is not available through the BIOS mapping. This drive-password is not the BIOS-password.

As intensive googling only provided some background information I dare opening a new thread on this topic.

1. Has anybody encountered a drive protected with drivelock?
If yes, how did you get around it?

2. Nortek (www.nortek.on.ca) claims they can recover the drive
password using software. Has anybody experience with the company?
Will they ship the software or do we have to ship the drive?
If the drive is shipped:
What are good practices when shipping evidence to a contractor?

Any ideas are welcome
Lotsa greetings
/Eddi

 
Posted : 08/12/2004 12:03 am
 Andy
(@andy)
Posts: 357
Reputable Member
 

Try replacing the drive back into the laptop and, and booting with a safe boot disk (EnCase – either the basic DOS disk or the network one). Then image the drive in its native environment, across a network/cross over cable. The lock might be one that prevents the drive being used elsewhere. If you have already tried this then apologies but you don’t say so in your post.

This method is slow, but one that I think will work. Give it a try.

I don't think the drivelock feature of ATA drive technolgy is a massive secret, you can find some examples with Google. I found this which is a method for unlocking an Xbox HDD with drivelock in place. Try this link: http://www.xbox-scene.com/tools/tools.php?page=harddrive
There are a coupe of interesting downloads for unlocking software/turorials. I don't know if they work, I have not tested them - use at your own risk.

If you need to send the drive away, best practice for submitting to an ‘outside’ agency, I suggest is auditable continuity of the item. So it can be proved that no unauthorised accesses have taken place and no tampering inferred. Use a registered currier, officer or yourself to hand deliver it if possible. And make sure it is sealed in a tamper proof forensic bag, with a seal number.

Andy

 
Posted : 08/12/2004 7:09 pm
(@Anonymous)
Posts: 0
Guest
 

Ok howmuch nortek takes i take 1/4 of thet price.
Nikola

 
Posted : 09/12/2004 12:37 am
 Andy
(@andy)
Posts: 357
Reputable Member
 

My original advice is for free… I suggest you try it first. Also if it doesn't immediately work, try removing the laptop real time clock battery, and replacing it before attempting an image (its a bit tricky - and on some laptops like open heart surgery). This may reset any passwords associated with the BIOS.

Andy

 
Posted : 09/12/2004 8:43 am
 Eddi
(@eddi)
Posts: 9
Active Member
Topic starter
 

Hi everyone.

We continued our examination (or should I say "experiments"?)

The drive requests a DriveLock password both in the original computer,
another computer of same maker/model and in our analysis workstation.

Vendor support states, that the password is stored in the drive electronics, and not on the magnetic media.

We found another Toshiba drive ("Drive 2") with - unfortunately - a different revision of the circuit board. We decided to take the risk and swapped the electronics: The drive will only spin up in one out of ten attempts. This is no big surprise: www.deadharddrive.com reports a smilar behaviour.

Swapping the electronics brought "Drive 2" back to live, so we did not do everything wrong.

I guess we have to send the whole thing to a lab.

Cheers
/Eddi

 
Posted : 09/12/2004 2:34 pm
(@Anonymous)
Posts: 0
Guest
 

what are You people talking about.
The password is stored on media.
You need master pwd to unlock drive or the other thing that I use.
See if security is set to max or to High.
Nortek veeery expencive

 
Posted : 09/12/2004 11:38 pm
 Eddi
(@eddi)
Posts: 9
Active Member
Topic starter
 

Dear all,

I just gut word from the DriveLock protected Harddisk

A lab could reset the password, the drive is on it's way home.
The engineer who did the work explained, that he had a
program to reset the password.

Is anybody aware of the necessary documentation to write suche a
program?

Cheers
/Eddi

 
Posted : 13/12/2004 5:16 pm
(@Anonymous)
Posts: 0
Guest
 

the program exists
there is no need in making it

 
Posted : 13/12/2004 10:52 pm
 JayT
(@jayt)
Posts: 10
Active Member
 

I came across this while re-installing the company laptop, previous user left and i didnt know the password. There are a few ways around this:

1) http://www.vogon-forensic-hardware.co.uk/password-cracker-pod.php
Vogons hardware can unlock this although i think i remember seeing it at the F3 meeting last year in nottingham (UK) and was quite expensive.

Alternativly there are a few programs on the net which claim can unlock the hdd. I tried one, cant remember where i found it but it seems as though it would of worked, had i not of tried the password a few times.

Think thats along the lines of what you were after. If not and you need data recovery from the hdd i can recomment KrollOntrack 😉 very good company!!

There are different levels of drive locks when i looked into it, older drives generally are only bios protected where as newer drives vary from scrambling the entire data or just 'locking'of the platters.

 
Posted : 22/03/2005 4:05 pm
(@dstefan)
Posts: 6
Active Member
 

I have not seen this problem before and i'm not sure what ranikolahdd is talking about. I have a friend who works at Compaq and he told me the Master Password can NOT be reset on some models. The same goes for the Drivelock.
I'm not saying it is impossible but i would really like to know how this works. If anyone has any info please email me.

There are some unlocking programs out there but I have not read anyone having any success unlocking a drive. I'm not sure that unlocking an XBOX drive is the same as a laptop drive. I know they are the same but the security is not. Then again i could be wrong 🙁
🙄

 
Posted : 31/03/2005 12:44 am
Page 1 / 4
Share: