Hard Drive Passwords

From ForensicsWiki
Revision as of 03:38, 31 March 2009 by Simsong (Talk | contribs)

Jump to: navigation, search

Some hard drives support passwords. These passwords can be implemented in computer's operating system, its BIOS, or even in the hard drive's firmware. Passwords implemented in the OS are the easiest to remove, those in the firmware are the hardest.

Sometimes people use the term "password" but the hard drive is really encrypted, and the password is used to unlock a decryption key. These passwords cannot be removed — the encryption key must be cracked or discovered through another means.

Vendors

  • Disklabs (www.disklabs.com) is able to remove some forms of hard drive passwords.
  • Dell will assist law enforcement in removing the passwords from password-protected hard drives. You need to provide Dell with a copy of the search warrant and the computer's service tag #. Reportedly this can be done over the phone, once you have a good relationship with Dell.
  • SalvationData sells a system for "Stage 2 physical data damage" recovery from HDDs. The company sells tools for swapping out platters from one drive into another drive, changing the firmware on drives, and other kinds of operations.