Difference between revisions of "Hard Drive Passwords"

From Forensics Wiki
Jump to: navigation, search
m (New page: Some hard drives support passwords. These passwords can be implemented in computer's operating system, its BIOS, or even in the hard drive's firmware. Passwords implemented in the OS are ...)
 
(Vendors: - Fixed link)
 
(11 intermediate revisions by 4 users not shown)
Line 1: Line 1:
 
Some hard drives support passwords. These passwords can be implemented in computer's operating system, its BIOS, or even in the hard drive's firmware.  Passwords implemented in the OS are the easiest to remove, those in the firmware are the hardest.  
 
Some hard drives support passwords. These passwords can be implemented in computer's operating system, its BIOS, or even in the hard drive's firmware.  Passwords implemented in the OS are the easiest to remove, those in the firmware are the hardest.  
  
Sometimes people use the term "password" but the hard drive is really encrypted, and the password is used to unlock a decryption key. These passwords cannot be removed---the encryption key must be cracked or discovered through another means.
+
Sometimes people use the term "password" but the hard drive is really [[Full Disk Encryption|encrypted]], and the password is used to unlock a decryption key. These passwords cannot be removed the encryption key must be cracked or discovered through another means.
  
 
=Vendors=
 
=Vendors=
Disklabs (www.disklabs.com) is able to remove some forms of hard drive passwords.
+
* Disklabs (www.disklabs.com) is able to remove some forms of hard drive passwords.
 +
 
 +
* Dell will assist law enforcement in removing the passwords from password-protected hard drives. You need to provide Dell with a copy of the search warrant and the computer's service tag #. Reportedly this can be done over the phone, once you have a good relationship with Dell.
 +
 
 +
* [http://www.hdd.profesjonalnie.pl/to.php Seagate HDD Service Device for 2,5" drives BASIC Kit]: The tool works with 2,5" drives of Seagate. Main functionality - ATA PASSWORD removal from 2,5" drives.
 +
 
 +
* [http://www.acelaboratory.com/pc3000.htm PC-3000 for Windows] has "An opportunity to unlock USER and MASTER passwords used in a HDD".
 +
 
 +
* [http://www.hdd-tools.com/products/rrs/ With Repair Station you can remove an unknown ATA-password; both security levels are supported: High and Maximum]
 +
 
 +
* [http://www.vogon-investigation.com/password-cracker-solution.htm Using the Vogon Password Cracker POD, the protection from the drive can be removed]
 +
 
 +
* [[SalvationDATA]] sells several products for recovery from what they call "Stage 2 physical data damage". See [[Data Compass]].
 +
 
 +
= Master Passwords =
 +
 
 +
''These passwords were received from unofficial sources, they may not work!''
 +
 
 +
* Western Digital: ''WDCWDCWDCWDCWDCWDCWDCWDCWDCWDCWD''
 +
* Maxtor: ''Maxtor*INIT SECURITY TEST STEP*F'' (''*'' means ''00h'')
 +
* Seagate: ''Seagate''
 +
* Fujitsu, Hitachi, Toshiba: 32 spaces
 +
* Samsung: ''tttttttttttttttttttttttttttttttt''
 +
* IBM:
 +
** ''CED79IJUFNATIT''
 +
** ''VON89IJUFSUNAJ''
 +
** ''RAM00IJUFOTSELET''

Latest revision as of 05:44, 20 July 2009

Some hard drives support passwords. These passwords can be implemented in computer's operating system, its BIOS, or even in the hard drive's firmware. Passwords implemented in the OS are the easiest to remove, those in the firmware are the hardest.

Sometimes people use the term "password" but the hard drive is really encrypted, and the password is used to unlock a decryption key. These passwords cannot be removed — the encryption key must be cracked or discovered through another means.

Vendors

  • Disklabs (www.disklabs.com) is able to remove some forms of hard drive passwords.
  • Dell will assist law enforcement in removing the passwords from password-protected hard drives. You need to provide Dell with a copy of the search warrant and the computer's service tag #. Reportedly this can be done over the phone, once you have a good relationship with Dell.

Master Passwords

These passwords were received from unofficial sources, they may not work!

  • Western Digital: WDCWDCWDCWDCWDCWDCWDCWDCWDCWDCWD
  • Maxtor: Maxtor*INIT SECURITY TEST STEP*F (* means 00h)
  • Seagate: Seagate
  • Fujitsu, Hitachi, Toshiba: 32 spaces
  • Samsung: tttttttttttttttttttttttttttttttt
  • IBM:
    • CED79IJUFNATIT
    • VON89IJUFSUNAJ
    • RAM00IJUFOTSELET