Forensic Recovery and ATA-3 'Secure Mode', possible?

Andy,

sorry for duplicate, but…
I perfectly understand your doubts and lack of confidence regarding the tool offered previously ( http//www.hdd.profesjonalnie.pl/to.php - ATA PASSWORD removal tool for Seagate drives)

What kind of information do you expect me to provide to assure you it works as declared?

Please advise…

BR

Piotr

http//www.hdd.profesjonalnie.pl

I dont know if I got this right. if removing the HPA will end up removing the password protection that this is feasible and there freeware tools to do it. see the explanation in the following link

http//www.sleuthkit.org/informer/sleuthkit-informer-20.html

Hi there,

My company is dataclinic ltd (based in UK).

See our page http//www.dataclinic.co.uk/password-protected-hard-drive.htm

Kinga, A price for the device would be nice (may induce some confidence), also (and more importantly) some kind of description and explanation of how it works. I am not asking for you to divulge any secrets, merely provide an explanation with some technical details, and evidence of validity of the device (independent), i.e. trials, court cases, recommendations.

With Forensic Computing the likelihood (for my work anyway) is that cases may end up at Crown or Civil court. I would like to be in the position of being able to explain to a court the workings of the device, especially if I was using it to obtain evidence that I was asking the court to rely upon in the case. I can imagine an opposing barrister would have a ‘field day’ with me if all I could say was ‘that it plugs into a drive and cracks the password, other than that I don’t know how it works’. Credibility would be severely lacking.

simmo8403, many thanks for the website link, I have been on your site in the past (I’ve got it bookmarked for future reference).

Andy

Andy,

The ATA PASSWORD is being stored on the drive itself. What does the device offered previously ( http//www.hdd.profesjonalnie.pl/to.php ) do is reads it from there via manufacturers interface (connector located between the IDE connector and power connector on the drive unit).
One can read or set plenty of HDD' sparameters via this interface. Exactly the same as it is being done during the manufacturing process of the drive or service activities performed by Seagate repair station. ATA PASWORD is just one of the parameters that can be obtained via this connection.
I will send you the information regarding the price via PM, anyone interested - please ask.

Hope this helps, if there are any additional questions - feel free to ask.

BR

Kinga

http//www.hdd.profesjonalnie.pl

of this post is defeating the security built into the ATA standard…..

Vogon may have a device capable of cracking a protected drive password, but what is the price?

Andy

http//www.vogon-forensic-hardware.com/forensic-hardware/data-capture/password-cracker-pod.htm

"The laptop hard drive password cracker module enables the user to remove passwords from platter locked hard disk drives. It then allows the drive to be imaged and the original password to be replaced, all in a forensically sound manner. This may be essential when conducting field or covert investigation work. The techniques used are passive, and attachment to the host drive is via the drives' own interface.

In use the drive password is captured and a small database is built. This permits a drive password to be retained, whilst the drive is accessed, either by previewing or imaging. After these processes, the original password can be replaced so that the computer user is left unaware that their password has been by-passed.

The Password Cracking POD option is provided as a convenient add-on hardware module, which integrates into the VBus imaging hardware and software system."

http//www.vogon-forensic-hardware.com/literature/data-sheets/password-cracker.pdf

Igor, I'm sorry but I don't get the point of your post? or quoting me. I asked about the price. I read the specs of the device for myself, (it does look like a very good piece of kit), but quoting the sales litrature doesn't really answer the question. Do you have a price for one?

Andy

Andy,
see PM

I regret to inform you that your very complicated way of by-passing ATA password protection will not work.

Unfortunately the ATA security set is not as simple as that, the password is part of the drive firmware, loaded during initialisation (if set) and prevents access to the data area entirely.

Hard drives that are protected in this way are imagable, but only once the password is removed completely, to do this you need to re-write portions of the drive firmware.

If anybody needs a hard disk unlocking please let me know, we have developed ways of removing most passwords, IBM's are a specialty 😉

Question, where is the drive firmware? On the pcb, or inside the casing?

Upon dismantling a newer sata drive, I've only found one chip inside the casing - beyond the interface. It was at the end of a printed circuit cable mounted to the actuator. tiny, unlabeled, 16 lines in, 16 out - just enough for read and write to each head. What is this chip? Seems to be an AD/DA. If this is not the firmware, then theoretically, it would be possible to use an ata controller (replace the 'integrated drive electronics) that doesn't understand ata3 specifications (ata2?) , or possibly build a custom interface to talk to and read from the heads directly. I would guess that an ata2 ide wouldn't understand the track layout information written by ata3, or at least, I would design it to be incompatible if I were in charge ;).

Thanks for your time,
JB

ok, you already answered where the firmware was… but my basic question is the same. The small chip on the actuator - does it require that the heads visit the firmware area, or what does it do?

thanks,
JB