MQ01ABD050VS Toshiba DVR Locked

[Gabriel Popa]

Hello everyone,
Anyone able to unlock these kind of model? also same family version and different capacity ?

[RecuperoDati299]

VS mean nothing

regards

Ottieni BlueMail per Android

[Gabriel Popa]

those what came from DVR's tehy are fully locked not work to write something on them

[Data Recovery Guru]

Toshiba MQ01ABD032VS DVR HDD Unlock for Data Recovery - Dolphin Data Lab https://share.google/o3cn8EGTucBlp0rxf

DATARECOVERYGURU TEAM

(617) 571-9172

www.datarecoveryguru.com

Offices are open Mon-Fri 9AM to 4:30PM. 

Available by appointment outside business hours.

Boston: 100 Massachusetts Ave, Suite 500 (5th Floor), Boston, MA 02155
Cambridge: 1 Mifflin Place, Suite 400 (4th Floor), Cambridge MA 02138
Dedham: 3 Allied Drive, Suite 303 (3rd Floor), Dedham, MA 02026

Burlington: 1500 District Ave, 1st Floor, Burlington, MA 01803

Framingham: 945 Concord St., 1st Floor, Framingham, MA 01701

Providence: 10 Dorrance St., Suite 700 (7th Floor), Providence, RI 02903

New Hampshire: One Tara Blvd., Suite 200 (2nd Floor), Nashua, NH 03062

https://www.linkedin.com/company/data-recovery-guru

https://www.facebook.com/datarecoveryguru

https://www.instagram.com/datarecoveryguru

https://www.youtube.com/c/Datarecoveryguru1

https://twitter.com/DataRecoverGuru

https://rumble.com/

--
Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/18be66fa-89a1-4c6a-bd87-21311b82a649n%40googlegroups.com.

[Gabriel Popa]

its request an locked ROM and one unlocked, unlocked not exist

[Data Recovery Guru]

An unlocked ROM has to be created. How? Not sure, see what they say. Or figure out a way.

DATARECOVERYGURU TEAM

(617) 571-9172

www.datarecoveryguru.com

Offices are open Mon-Fri 9AM to 4:30PM. 

Available by appointment outside business hours.

Boston: 100 Massachusetts Ave, Suite 500 (5th Floor), Boston, MA 02155
Cambridge: 1 Mifflin Place, Suite 400 (4th Floor), Cambridge MA 02138
Dedham: 3 Allied Drive, Suite 303 (3rd Floor), Dedham, MA 02026

Burlington: 1500 District Ave, 1st Floor, Burlington, MA 01803

Framingham: 945 Concord St., 1st Floor, Framingham, MA 01701

Providence: 10 Dorrance St., Suite 700 (7th Floor), Providence, RI 02903

New Hampshire: One Tara Blvd., Suite 200 (2nd Floor), Nashua, NH 03062

https://www.linkedin.com/company/data-recovery-guru

https://www.facebook.com/datarecoveryguru

https://www.instagram.com/datarecoveryguru

https://www.youtube.com/c/Datarecoveryguru1

https://twitter.com/DataRecoverGuru

https://rumble.com/

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/bc8c5516-7ef3-43f7-86eb-ebcecce33ac4n%40googlegroups.com.

[pbzcbf...@gmail.com]

Upload your ROM and a regular MQ01ABD032 ROM. I'll build an unlocked hybrid for you.

[Gabriel Popa]

only 500GB and 1TB have, "regular" ones not find, FW versions its diff

[pbzcbf...@gmail.com]

The firmware version doesn't matter.

[RecuperoDati299]

hello

which device do you own?

Do you have PC3000?

Have you tried the password remove feature?

Ottieni BlueMail per Android

Il giorno 23 mar 2026, alle ore 09:10, Gabriel Popa <alecs....@gmail.com> ha scritto:

[Gabriel Popa]

yes i have
the idea is not t make it only for read, need fully unlocked and the user to can write/read from it, as i know about that the solution its hard and isnt about only ROM patching, right?

[RecuperoDati299]

at boot what do you have in the log of the pc3000?

have you asked to the Acelab support?

Ottieni BlueMail per Android

[pbzcbf...@gmail.com]

All the code is in the ROM. There are no overlays in the SA for these earlier models.

[G.N Data Laboratory]

can you upload the rom please.

[Gabriel Popa]

One ROM Here

but the full solution i found it

[G.N Data Laboratory]

kindly check

[Gabriel Popa]

wait, put put the wrong one, the drive is fauly, can not check

and your "patched ROM" means that its fully unlocked ? i read now one ROM and i will put here

[pbzcbf...@gmail.com]

This modified ROM is a hybrid which retains the patient's CPs but replaces the code section with the code from a standard model. That was my suggested approach.

CP 0x00DC (LB) is also modified. However, this CP in the unlocked ROM has a bad checksum.

[pbzcbf...@gmail.com]

Here is a thread on this subject:

https://forum.hddguru.com/viewtopic.php?p=239927#p239927

[Gabriel Popa]

Hi there, using your ROM patched i only read the data not write allow...

On Tue, Mar 31, 2026 at 9:44 PM pbzcbf...@gmail.com <pbzcbf...@gmail.com> wrote:

Here is a thread on this subject:

https://forum.hddguru.com/viewtopic.php?p=239927#p239927

--
Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---

You received this message because you are subscribed to a topic in the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/datarecoverycertification/GQWmekGbg-4/unsubscribe.
To unsubscribe from this group and all its topics, send an email to datarecoverycertif...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/bdc7098e-9ee0-46d4-81cc-1dbc2b66e2edn%40googlegroups.com.

[LUIS D AGUILAR]

Owners likes me of Dolphin Cards can unlock directly after original ROM patched with the software of the Card.

Needs a FULL FUNCTIONAL ROM BACKUP from the Source.

You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.

To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/CAKnQ9riQ04EXLzu9vm0QrtA8dyHVJ_b_5PWL7cdJyyxZfUw8-Q%40mail.gmail.com.

[pbzcbf...@gmail.com]

Would you share a locked and unlocked ROM pair?

[pbzcbf...@gmail.com]

Would there be any point in fixing the checksum in the patched 18BJT9MK.bin? I can do that if necessary.

Is 18BJT9MKTR1E.bin your patient ROM?

[Gabriel Popa]

here, update me with your advices

[Gabriel Popa]

that patient one its already fully unlocked

--
Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to a topic in the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/datarecoverycertification/GQWmekGbg-4/unsubscribe.
To unsubscribe from this group and all its topics, send an email to datarecoverycertif...@googlegroups.com.

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/ebef3757-efa1-4bcf-83e5-0cd533f98647n%40googlegroups.com.

[pbzcbf...@gmail.com]

That was my suggested approach. You say that it reads, but does not write. I was hoping that "mctspr" could show us a working example created by Dolphin.

[pbzcbf...@gmail.com]

Which is your patient? If 18BJT9MKTR1E.bin is a donor, then "mctspr"unlocked your donor, which would be a pointless thing to do.

Please makes things clear. You are confusing everyone.

[pbzcbf...@gmail.com]

I examined a track dump. It consisted of four identical .trk files, each consisting of a block of 0x400 random bytes repeated from start to finish. In other words, junk.

This is the difference in CP 0xDC in the earlier example:

18BJT9MKTR1E.bin (CP 0xDC)

Offset(h) 00       04       08       0C

0007EBB0  4C420100 C82F6C3B 00000000 C8DC6E3B  LB..............
                   ^^^^^^^^

0007EBC0  00000000 000000FF FFFFFFFF 000000FF
0007EBD0  FFFFFFFF 000000FF FFFFFFFF 000000FF
0007EBE0  FFFFFFFF 00000000 00000000 000000FE
                                           ^^
                                 XOR checksum


18BJT9MKTR1E_hybrid_unlocked.bin (CP 0xDC)

Offset(h) 00       04       08       0C

0007EBB0  4C420100 C828643B 00000000 C8DC6E3B  LB..............
                   ^^^^^^^^
0007EBC0  00000000 000000FF FFFFFFFF 000000FF
0007EBD0  FFFFFFFF 000000FF FFFFFFFF 000000FF
0007EBE0  FFFFFFFF 00000000 00000000 000000CF
                                           ^^
                                 XOR checksum

[pbzcbf...@gmail.com]

I'm wondering whether "LB" is Logical Block.

In the locked 500GB example, the two 32-bit little-endian numbers are 0x3B6C2FC8 and 0x3B6EDCC8.

In the unlocked 500GB example, the two 32-bit little-endian numbers are 0x3B6428C8 and 0x3B6EDCC8.

In a locked 1TB example, the numbers are 0x75F616E0 and 0x75F8C160.

In a locked 320GB example, the numbers are 0x300BF730 and 0x300EA430.

These numbers look like max LBA counts, although they exceed the physical reported capacity of the drive.

0x3B6C2FC8 --> 510.436282 GB  MQ01ABD050VS locked
0x3B6EDCC8 --> 510.526067 GB  MQ01ABD050VS

0x3B6428C8 --> 510.166929 GB  MQ01ABD050VS unlocked
0x3B6EDCC8 --> 510.526067 GB  MQ01ABD050VS

0x75F616E0 --> 1013.27974 GB  MQ01ABD100VS locked
0x75F8C160 --> 1013.36919 GB  MQ01ABD100VS

0x300BF730 --> 412.718359 GB  MQ01ABD032VS locked

0x300EA430 --> 412.808143 GB  MQ01ABD032VS

[Gabriel Popa]

So if i patched the rom by DFL, i have only read and verify test option and work well, id i want to write on hdd, have ABR,  its possible to be from traks ans LB maybe?

--
Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to a topic in the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/datarecoverycertification/GQWmekGbg-4/unsubscribe.
To unsubscribe from this group and all its topics, send an email to datarecoverycertif...@googlegroups.com.

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/8afcadc7-e77d-45c8-8acf-cde980744287n%40googlegroups.com.

[Gabriel Popa]

0x75F616E0 --> 1013.27974 GB  MQ01ABD100VS locked

0x75F8C160 --> 1013.36919 GB  MQ01ABD100VS

maybe because of this i can not run write test or write data on drive ?

[pbzcbf...@gmail.com]

I think that the "LB" CP needs to be modified, but I don't know how to select the new LBA value. The firmware probably uses a different value for DVR and non-DVR drives, and it switches to read-only mode to protect the data if it finds the wrong value. That's only a guess, though.

[Gabriel Popa]

check pm

[pbzcbf...@gmail.com]

Your tool generates a bad checksum. Maybe the firmware ignores the checksum, but the tool seems to be crap.

[Gabriel Popa]

the checksum doesn't matter because PC3000 will recalculate it before writing

On Sun, Apr 5, 2026 at 6:53 PM pbzcbf...@gmail.com <pbzcbf...@gmail.com> wrote:

Your tool generates a bad checksum. Maybe the firmware ignores the checksum, but the tool seems to be crap.

--
Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to a topic in the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/datarecoverycertification/GQWmekGbg-4/unsubscribe.
To unsubscribe from this group and all its topics, send an email to datarecoverycertif...@googlegroups.com.

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/32ecd155-993c-4274-b253-51e08212477cn%40googlegroups.com.

[pbzcbf...@gmail.com]

I think the trick is to subtract 0x80700 from the first LBA, at least for the 500GB model.

MQ01ABD050VS

0x3B6C2FC8 0x3B6EDCC8 DVR
0x3B6428C8 0x3B6EDCC8 patched DVR

0x3B6C2FC8 - 0x3B6428C8 = 0x80700


0x3B293168 0x3B3BEC68 DVR
0x3B212A68 0x3B3BEC68 patched DVR

0x3B293168 - 0x3B212A68 = 0x80700

[Gabriel Popa]

This i really didn't get it😶

--
Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to a topic in the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/datarecoverycertification/GQWmekGbg-4/unsubscribe.
To unsubscribe from this group and all its topics, send an email to datarecoverycertif...@googlegroups.com.

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/32fabdca-12ea-4d10-97e2-f1c165132fc2n%40googlegroups.com.

[pbzcbf...@gmail.com]

I don't think I can explain it more simply for you. Do you understand what little-endian means?  Do you understand hexadecimal arithmetic?

[pbzcbf...@gmail.com]

Locate the first LBA in CP 0xDC. This is a 32-bit little-endian double word.

Offset(h) 00       04       08       0C

00000000  4C420100 6831293B 00000000 68EC3B3B  LB..h1);....hì;;
                   ^^^^^^^^

Convert the value to big-endian:

6831293B --> 3B293168

Subtract 0x80700 from this LBA:

0x3B293168 - 0x80700 = 0x3B212A68

Revert the result to little-endian:

0x3B212A68 --> 682A213B

Write the result back to the CP:

Offset(h) 00       04       08       0C

00000000  4C420100 682A213B 6831293B 00000000  LB..h*!;h1);....
                   ^^^^^^^^

Now recalculate the checksum by altering the last byte so that ...

byte1 XOR byte2 XOR byte3 ... XOR byteN = 0x00

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000030  FF FF FF FF 00 00 00 00 00 00 00 00 00 00 00 41  ÿÿÿÿ...........A
                                                       ^^

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000030  FF FF FF FF 00 00 00 00 00 00 00 00 00 00 00 D3  ÿÿÿÿ...........A
                                                       ^^

On Monday, April 6, 2026 at 2:56:59 AM UTC+10 alecs....@gmail.com wrote: