Service Forum

[Royliv]

Victor, I hope I am posting in the right place. I have seeen your information regarding unlocking IBM/Hitachi Travelstar type hard drives and it looks like you have come up with the only real solution to a problem that has stumped hundreds (Thousands??!) over the the last few years. Congratulations!
I have a few of these drives that I bought thinking that re-formatting would clear the passwords, not knowing that the password was stored in a fiendishly cunning chip on the disk controller board. After much investigation I came to the conclusion that the answer would be to re-flash the chip (if possible) back to the factory original settings. I thought that this may be possible as there are some pads on the board that look like they may have been put there for this purpose. I have been unable to ascertain wether the chip is re-programmable or not so far, or even what functions the pins support. The method of using a password dictionary in an automated capacity was discounted owing to the freeze lock function coming into operation after 5 tries.
I will look forward to you making your method available commercially but would respectfully remind you that people will not buy it if the cost approaches or exceeds the purchase price of a replacement drive (Unless of course there is data that they really need to recover) I suspect that the mass market will be for people such as myself who own these electronic paperweights and would like to put them to good use!
_________________
What me worry?

[victor]

Hi Royliv,

I have to mention that the password is located on the disk platter not in an eeprom or other chip. The only affordable method is to do a brute force or dictionary attack. Normally after 2-5 attempts the security status will be updated with the expired condition flag and security operations are locked.
Well, EraseON can scan the drive without activating the "expired" condition. The software is available commercially, it is not the single solution of that kind in the market, but is the cheapest for sure.

[Royliv]

Hi Victor,
Thanks for your reply. I have read a lot about the password being stored on the platters, and many people have tried to directly access by swapping boards etc without success. I suppose it is possible that the password is stored in TWO places ie. on the platters AND within a chip.
The chip I have been looking at Is the LSI 144 pin 90G3739 which was a collaboration between Mitsubishi and IBM and includes a 48K bytes flash memory.
Maybe what makes the drive so secure is that the input password is compared to the one stored on the platters AND that stored in flash memory? I may be completely on the wrong track, but these are just a few of my thoughts. Unfortunately, although I have a few of these drives I do not have an unlocked one that I could try the board swap method for myself.
_________________
What me worry?

[victor]

I will try to make some comments here:

1. The password is not located into a chip. The senseful reasons:
a. Security;
b. Ergonomy and costs.
No need to use an additional PROM, since the drive has plenty of space to use on the platter, not mentioning the speed advantage, a prom is much, much slower. If I were a HD designer I would make my drive this way and I know they did it as well.

2. A microcontroller is a computing system that has its own ROM to store the executable code aka firmware and some RAM to cache its processed data. Also the IDE controller has a buffer, 2MB or above, used to speed up the data transfer.
Supposing the drive needs to compare the password, it needs to read the platter and compare the words as you mentioned.
Well, trying to read this buffered memory is not a viable way to discover the password. Even if we can develop (in theory ) a solution for that, what do you think we will find there? nothing that can help us to much.
Even if we could have success doing that, just think about how many controllers and HD types are on the market and each of them has unique design.

One thing I can tell you exactly: almost all new HDs use to cache the IDENTIFY DRIVE results and the password 32 bytes as well. This is of some help for the brute force program because the speed increases significantly

Thanks for the patience.

[baomobile]

[lermon]

[victor]

To obtain the order form please contact us at support@allservice.ro.

Regards