Forensic Recovery and ATA-3 'Secure Mode', possible?

answer, it's an amplifier. A custom head/motor controller should have no trouble reading the drive.

-JB

Recovering data from "Maximum Security" locked hard drive is possible, but the process is different for different brands and drives. There is no "universal" way or utility. 2.5" IBMs/Hitachi's are especially complicated.
This is not the kind of knowledge one will share willingly )

In Asia rates for unlocking start from $150 depending on the drive + shipping.
It's very easy to test if the company really does what it says,
sacrifice the spare drive of the same brand and age as the one you want to unlock.
Write some text or picture files to it, lock it with maximum security and send it.
Ask the company to send you the files back by email as a proof.
This way you are not risking with your problem/evidence drive.

ok so I told You that i can recover data 2 years ago and Youare still talking about that , even kids do it now

I work for a Technology Consultant, Baker Robbins & Co., in Houston, TX. I work in the Forensic and E-discovery practice group. I have been researching "locked" hard drives and solutions. From all my research , over 2 months of all day, every day research I came to these conclusions.

1. There is no universal way of unlocking all types and models of hard drives.
2. Logic board swapping, and platter swapping will not bypass "locked" hard drives
2. There are many ways to lock hard drives, but the common thread is that the password is stored on what are referred to negative cylinders on the disk.
3. Negative cylinders can contain around 100MB of data.
4. Software alone can never "crack" this method of protection because of the logic in which the ATA-3 standard was created.
5. The general way to bypass this protection is to buy or develop a device that is able to access these negative cylinders, and or the firmware on the logic board.
5a. If you get to the negative cylinders of the hard drive the password will be there HEX form. Each make and model places the password in a different location within these negative cylinders.
5b. If you have the know how, you can crack the firmware on the logic board and or re-write the firmware to not look for the password when the device is turned on. For forensics purposes this method would not be an advisable solution.

Im sure I left out some points, but these are some of the more important ones. Oh and there are devices for sale that can do this. They are very expensive around the $10,000 range. I apologize but I cannot tell you what device we use. I hope this information can guide you to the answer you are looking for. If you cannot find the answere search in the data recovery forums.

has anyone tried this company?

http//www.hdd-tools.com/products/rrs/

to djimenez
LOL
Do not talk things that u do not understand.
I have a tool that cost 200$ and it can unlock any hdd, send me hdd and u will see if u do not belive.
Firmware is not on PCB it is on hdd.
serbia@helpdisc.com

And… which tool is it? D Give us further info please!

I HATE PEOPLE WHO SPEAK BUSINESS in A FORUM COMPLETELY INTENDED TO SHARE KNOWLEDGE. THATS PROSTITUTION OF KNOWLEDGE!!!

ok here is how you do it; )

boot your forensic workstation in linux.
using command; hdparm
http//freshmeat.net/projects/hdparm
hdparm is a Linux shell utility for viewing and manipulating various IDE drive and driver parameters

hdparm [ flags ] [device]

some reading http//www.die.net/doc/linux/man/man8/hdparm.8.html

——-Some ref. ——-
ATA-standard security commands

Security Set Password F1H
Security Unlock F2H
Security Erase Prepare F3H
Security Erase Unit F4H
Security Freeze Lock F5H
Security Disable Password F6H
Command name Command code (in hex)

————————————————-

ATA Security Feature Set
These switches are DANGEROUS to experiment with, and might not work with every kernel. USE AT YOUR OWN RISK.

–security-help
Display terse usage info for all of the –security-* flags.
–security-freeze

Freeze the drive's security settings. The drive does not accept any security commands until next power-on reset. Use this function in combination with –security-unlock to protect drive from any attempt to set a new password. Can be used standalone, too.

–security-unlock PWD
Unlock the drive, using password PWD. Password is given as an ASCII string and is padded with NULs to reach 32 bytes. The applicable drive password is selected with the –user-master switch. THIS FEATURE IS EXPERIMENTAL AND NOT WELL TESTED. USE AT YOUR OWN RISK.
–security-set-pass PWD
Lock the drive, using password PWD (Set Password) (DANGEROUS). Password is given as an ASCII string and is padded with NULs to reach 32 bytes. The applicable drive password is selected with the –user-master switch and the applicable security mode with the –security-mode switch. THIS FEATURE IS EXPERIMENTAL AND NOT WELL TESTED. USE AT YOUR OWN RISK.

–security-disable PWD
Disable drive locking, using password PWD. Password is given as an ASCII string and is padded with NULs to reach 32 bytes. The applicable drive password is selected with the –user-master switch. THIS FEATURE IS EXPERIMENTAL AND NOT WELL TESTED. USE AT YOUR OWN RISK.

–security-erase PWD
Erase (locked) drive, using password PWD (DANGEROUS). Password is given as an ASCII string and is padded with NULs to reach 32 bytes. The applicable drive password is selected with the –user-master switch. THIS FEATURE IS EXPERIMENTAL AND NOT WELL TESTED. USE AT YOUR OWN RISK.

–security-erase-enhanced PWD
Enhanced erase (locked) drive, using password PWD (DANGEROUS). Password is given as an ASCII string and is padded with NULs to reach 32 bytes. The applicable drive password is selected with the –user-master switch. THIS FEATURE IS EXPERIMENTAL AND NOT WELL TESTED. USE AT YOUR OWN RISK.

–user-master USER
Specifies which password (user/master) to select. Defaults to master. Only useful in combination with –security-unlock, –security-set-pass, –security-disable, –security-erase or –security-erase-enhanced. u user password m master password
THIS FEATURE IS EXPERIMENTAL AND NOT WELL TESTED. USE AT YOUR OWN RISK.

–security-mode MODE
Specifies which security mode (high/maximum) to set. Defaults to high. Only useful in combination with –security-set-pass. h high security m maximum security

by the way; you can now brutforce it using a simple password dictonary.

–security-unlock %PWD%

& for HPA enabled disk and you want to gain access to the hidden data, you will need to change the disk configuration. HPA is removed by setting the maximum user addressable sector to be the maximum sector on the disk. This can be done using the volatility bit such that the configuration change will be lost when the hard disk is powered off. This command is blocked hardware write blockers
ftp//dmares.com/pub/hpa.exe
http//www.dmares.com/maresware/gk.htm#HPA

EDIT i missed something, if u brutforce password on some hdd it might disable itself after x attempts. check vendor specification or experiment it with a identical hdd

pc3000 chinese

After Andy and Nikola spatting at each other, I gave up reading the thread. The secret is simple. PC3000. There are different versios which support different models, and the kit is quite expensive. It also helps if you can speak Russian, as the manuals are in Russian.

Unfortunately, there are a few translating mistakes with this manual, words such as 'read' and 'write' are often mixed up, which needless to say, cause major problems.

All the PC3K does is to allow manufacturer level system area access to the hard disk and the firmware. This is where passwords are stored. We at Disklabs are able to retrieve these, but only on the stated models. We just came across a new 2.5inch laptop disk from Hitachi which we couldnt crack using this method, (first time ever).

If there is anyone in the UK who would like site of this kit and to take a look at how it works, contact me, and I will arrange a time when you can pop in to the labs.

I hope the above was interesting enough?

Regards,

Simon

Disklabs Computer Forensics and Disklabs Data Recovery