Locked hard drive

[turbos...@gmail.com]

Does anyone know if pc3000 or any other tool will unlock these drives. They r firmware level locked.  Or know if there is a free too like zu.exe that would work.

[t...@desertdatarecovery.com]

They are pretty old so hard to say, but PC3K should be able to work with them.

 

 

From: datarecovery...@googlegroups.com <datarecovery...@googlegroups.com> On Behalf Of turbos...@gmail.com
Sent: Wednesday, August 30, 2023 4:54 PM
To: DataRecoveryCertification <datarecovery...@googlegroups.com>
Subject: Locked hard drive

 

Does anyone know if pc3000 or any other tool will unlock these drives. They r firmware level locked.  Or know if there is a free too like zu.exe that would work.

--
Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/60966a4b-b83b-44db-a53b-fe32eae95e60n%40googlegroups.com.

[pbzcbf...@gmail.com]

Do you want the data?

The Endurastar looks like the kind of drive that is used in automotive applications. You say that these drives are firmware locked. However, if it's just an ATA password, and if you have access to the original installation, just install a WD drive and allow the device to lock it. Your DR tool should then be able to retrieve the password from the WD drive. Hopefully this new password will be the same.

Remove ATA password from Hitachi Endurastar J4K100 series:

http://www.hddoracle.com/viewtopic.php?f=21&t=570

I have other ideas for the Toshiba drive, if it turns out to be firmware locked as in the case of a DVR.

[turbos...@gmail.com]

Maybe firmware lock was the wrong word to use.   Yes all these are from vehicle radios.  When I put in my computer to image they won't read.  I usually will do a hot swap with the drive in the radio , use the car to power up and unlock the drive then disconnect the SATA cable and image it.  We do get cars that unfortunately won't turn on or don't have the key.   Just hate to spend 10k on a pc3000 to get the feature of being able to just remove the master password.   

Officer Paul Fressola 
Computer Forensics Unit 
Stratford Police Department 
900 Longbrook Ave 
Stratford, CT 06614 
Office 2033854100 
Cell 2033688522 
Email: pfre...@townofstratford.com

--
Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/f4552938-c9ef-461f-89f8-6f8e03a5f05bn%40googlegroups.com.

[pbzcbf...@gmail.com]

Similar non-destructive unlock procedure:

https://www.hddoracle.com/viewtopic.php?p=23387#p23387

[pbzcbf...@gmail.com]

I don't understand. Is a key needed to get into the radio after it is powered on? In any case, I would have thought that a police computer forensics unit would have all sorts of "capabilities" in this regard. I mean, if a criminal can get in ...

On Thursday, August 31, 2023 at 10:39:08 AM UTC+10 turbos...@gmail.com wrote:

 

We do get cars that unfortunately won't turn on or don't have the key.

[turbos...@gmail.com]

So the key is in somewhere on the motherboard and gets inserted when the car is turned on.  The unit boots up unlocking the drive and everything works.  Some car manufacturers use locked drives as a way to keep user data safe.  Mercedes uses western digital drives and we found the master password on some of those are wdwdwdwdwdwdwdwdwdw.   

Officer Paul Fressola 
Computer Forensics Unit 
Stratford Police Department 
900 Longbrook Ave 
Stratford, CT 06614 
Office 2033854100 
Cell 2033688522 
Email: pfre...@townofstratford.com

--

Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/af865e10-67dc-4f06-9c2e-3a7336aa7314n%40googlegroups.com.

[turbos...@gmail.com]

We r looking to get the data off these to read them and see who was in the car.  Or grab the gps logs or connected devices.   There is no cop tool for this like there is for phones.   There is 1 tool called berla but has very limited use and basically is useless 

Officer Paul Fressola 
Computer Forensics Unit 
Stratford Police Department 
900 Longbrook Ave 
Stratford, CT 06614 
Office 2033854100 
Cell 2033688522 
Email: pfre...@townofstratford.com

On Wed, Aug 30, 2023, 8:40 PM pbzcbf...@gmail.com <pbzcbf...@gmail.com> wrote:

Similar non-destructive unlock procedure:

https://www.hddoracle.com/viewtopic.php?p=23387#p23387

--
Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/f3e8bd7f-29eb-41e7-ad12-12cb5a1e6e32n%40googlegroups.com.

[pbzcbf...@gmail.com]

The firmware in newer WD drives has been locked down, but you can retrieve the ATA password in earlier WD models with HDDSuperTool (open source) or the demo version of WDMarvel.

http://www.hddoracle.com/viewtopic.php?p=22676#p22676

[pbzcbf...@gmail.com]

After watching all the different flavours of CSI on TV, I came away with the impression that US forensics labs have all the latest gear and methods. Perhaps CSI - Connecticut is the poorer brother. :-)

[pbzcbf...@gmail.com]

BTW, when I wrote "key", I meant car key. I was wondering whether the key to the vehicle was also somehow involved in the security for the radio/GPS/head unit.

[turbos...@gmail.com]

No the car key is not.  Some cars that have hard drives in them are older Infiniti, Land Rover, bmw, mb,Lexus, some dodge , Toyota older models,   most swapped to emmc chips 

Officer Paul Fressola 
Computer Forensics Unit 
Stratford Police Department 
900 Longbrook Ave 
Stratford, CT 06614 
Office 2033854100 
Cell 2033688522 
Email: pfre...@townofstratford.com

On Wed, Aug 30, 2023, 9:09 PM pbzcbf...@gmail.com <pbzcbf...@gmail.com> wrote:

BTW, when I wrote "key", I meant car key. I was wondering whether the key to the vehicle was also somehow involved in the security for the radio/GPS/head unit.

--

Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/403be9f8-ac46-432b-9e98-de5ae44cb6f3n%40googlegroups.com.

[Fraser Corrance]

So why not just power up the radio using an external power supply? 

[turbos...@gmail.com]

We typically do that then once the unit unlocks it I swap the SATA cable over to my imager and read it.   But I get a bunch of cars that are smashed and finding the power pinouts is not that easy.  U need to not only give power but u have to give power additional power at a certain time to boot the can bus system so doing bench power up never works right.  Some units have 44pin ata drives which make hard to hot swap.  

I should have said in my first email the drives are ata locked not firmware locked 

Officer Paul Fressola 
Computer Forensics Unit 
Stratford Police Department 
900 Longbrook Ave 
Stratford, CT 06614 
Office 2033854100 
Cell 2033688522 
Email: pfre...@townofstratford.com

You received this message because you are subscribed to a topic in the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/datarecoverycertification/y8w78dmNFoo/unsubscribe.
To unsubscribe from this group and all its topics, send an email to datarecoverycertif...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/25df7806-7c26-4de0-9619-7b9a72dc1bden%40googlegroups.com.

[Fraser Corrance]

Considering what your department paid for Cellbrite, the cost of a PC3K should be chump change. ;-}

Another possible option, although not a great one, would be an MRT card. They offer a subscription model of payment where you could just pay for a month when you need to use it. You have to keep making monthly payments until the device is paid for in full. I just picked up an MRT card and am still learning how to use it. I know some of the other folks on this forum are more experienced MRT users than I am and they may be able to confirm it's ability to remove ATA locks. 

On Wednesday, September 6, 2023 at 2:25:58 PM UTC-7 turbos...@gmail.com wrote:

We typically do that then once the unit unlocks it I swap the SATA cable over to my imager and read it.   But I get a bunch of cars that are smashed and finding the power pinouts is not that easy.  U need to not only give power but u have to give power additional power at a certain time to boot the can bus system so doing bench power up never works right.  Some units have 44pin ata drives which make hard to hot swap.  

I should have said in my first email the drives are ata locked not firmware locked 

Officer Paul Fressola 
Computer Forensics Unit 
Stratford Police Department 
900 Longbrook Ave 
Stratford, CT 06614 
Office 2033854100 
Cell 2033688522 

Email: pfressola@townofstratford.com

To unsubscribe from this group and all its topics, send an email to datarecoverycertification+unsub...@googlegroups.com.

[pbzcbf...@gmail.com]

Why not just outsource these jobs to other police forensic units? Is the USA just as bad as Australia when it comes to cooperation between the states? We have six separate "kingdoms", whereas you guys have 50 of them.

[turbos...@gmail.com]

Cause there are very few departments in the country that have PC3000 .  You have to remember most cops that have a digital forensics background don't stay in law enforcement.  The private sector offers them 3 times there pay.  

I'll probably just end up getting a pc3000 portable 

Officer Paul Fressola 
Computer Forensics Unit 
Stratford Police Department 
900 Longbrook Ave 
Stratford, CT 06614 
Office 2033854100 
Cell 2033688522 
Email: pfre...@townofstratford.com

On Wed, Sep 6, 2023, 9:01 PM pbzcbf...@gmail.com <pbzcbf...@gmail.com> wrote:

Why not just outsource these jobs to other police forensic units? Is the USA just as bad as Australia when it comes to cooperation between the states? We have six separate "kingdoms", whereas you guys have 50 of them.

--
Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to a topic in the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/datarecoverycertification/y8w78dmNFoo/unsubscribe.

To unsubscribe from this group and all its topics, send an email to datarecoverycertif...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/199dba5c-099a-41f7-b0ba-247b71caf4c8n%40googlegroups.com.