Help needed with Samsung SSD Locked

[Jim Wells]

Hi Everyone

Its been a while since I posted. I have got a Lenovo laptop when its powered up I get  Hard Disk Security Window up that shows 

LOCK PCIE SAMSUNG MZALQ512HALU-000L2

A disgruntled employee did this before they left. They think he wiped the drive before he took the customer list etc. It appears he locked it. I don't know if it was really wiped. Is there any way to unlock it? or is this a lost cause?

Thank you,

Jim Wells

CyberTech LLC

[t...@desertdatarecovery.com]

Have you removed the drive and put it on PC3K or similar (some sort of write-blocking)?

 

Tim Homer - Lead Engineer

Desert Data Recovery

t...@desertdatarecovery.com

www.desertdatarecovery.com

--
Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/CABmdQmC8BorHXNWM940pmxqfZNUb%3D7u7NxtWFq7RhfO%2BZed1Gg%40mail.gmail.com.

[Jim Wells]

Hi Tim

I don't have a PC3K but I can send it down to Atlanta to Data Savers if you think that may work. I do have a NVME adapter for these types of drives that has a built-in switch to block any writes to the drive. I used Access Data FTK imager to look at the drive and its all zero's. I assume maybe that is because its "locked" I am not 100% sure on that one. They may have wiped it then locked it. I have the full version of Xways forensics that I can look at as well as rStudio and others if needed. Thank you for the help

Jim

Thank you,

Jim Wells

CyberTech LLC

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/00ba01d7639c%24a461f490%24ed25ddb0%24%40desertdatarecovery.com.

[t...@desertdatarecovery.com]

Hey Jim

 

Sounds like it may possible be a firmware lock, but I really don’t know I have never seen that message before. It may well be all zeros which is easy to achieve on an SSD. Jono will probably be able to tell.

 

Tim

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/CABmdQmB%2BZ33GXohHHv5WpaLGxVrygrycdjMONvBk%3DqckhirNww%40mail.gmail.com.

[Luke Coughey]

I suspect that not much can be done, as there is no utility on the PC3000 Portable for Samsung NVMe SSDs.

Luke Coughey

CEO

Recovery Force Inc

866-750-3169

http://www.recoveryforce.com

This e-mail is intended solely for the person or entity it is sent to and may contain confidential and/or privileged information.  Any review, dissemination, reproduction or other use of this e-mail by persons or entities other than the intended addressee is prohibited.  If you have received this e-mail in error, please contact the sender immediately and delete and destroy this message, all attached material and all electronic reference from all computing based devices.

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/00ec01d763b3%2448a86410%24d9f92c30%24%40desertdatarecovery.com.

[CCSO Cyber]

All zeros on a SSD, you're SOL

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/CAM_TZbFyx%2B10Q%3Dnb7TXzTpE0mH63y6CCdW9ECKKsS_2ukOUhNg%40mail.gmail.com.

[t...@desertdatarecovery.com]

Unless its firmware locked.

I just had a T7 with exactly that issue.

It was using encryption tied to the firmware.

Drive appears to read all zeros, but load the encryption software and you have data.

 

Tim Homer - Lead Engineer

Desert Data Recovery

t...@desertdatarecovery.com

www.desertdatarecovery.com

 

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/CAADY9V784-JVJK08pLMiHa6Qtia2%3DF4fVsMzJ8aHP6SZFpbFcQ%40mail.gmail.com.

[Mr. Networks]

Tim

Are you referring to bitlocker for the encryption software or something else

Thanks 

Jim

On Jun 17, 2021, at 7:59 PM, t...@desertdatarecovery.com wrote:



To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/013f01d763d4%24cb3fc690%2461bf53b0%24%40desertdatarecovery.com.

[Luke Coughey]

I've seen FDE hard drives that returned 0x00 in all sectors when bypassing the firmware lock on the drive.  Seems reasonable that a similar setup would exist for SSDs too.

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/2B926CCD-1882-443B-B213-F53597EB7DA4%40gmail.com.

[Desert Data Recovery]

I will give you full details when I am back in the office tomorrow. 

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/CAM_TZbEbGoWaV3JU_L1S75qZ%2B4RrZETVR4BWxwVqR%3D0J5RHOtQ%40mail.gmail.com.

[t...@desertdatarecovery.com]

Here is a quick video of the drive I have in here.

The drives use software to alter the SSD firmware.

The drive you have being NVMe is obviously entirely different.

But just an example of when an SSD drive reads all zeros,

It does not necessarily mean its empty.

You will need to download the video to see it in HD.

 

https://drive.google.com/file/d/15f1O58Ha4XxXLeGpmhs2z3AUjitiihLU/view?usp=sharing

 

Tim Homer - Lead Engineer

Desert Data Recovery

t...@desertdatarecovery.com

www.desertdatarecovery.com

 

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/CAM_TZbEbGoWaV3JU_L1S75qZ%2B4RrZETVR4BWxwVqR%3D0J5RHOtQ%40mail.gmail.com.