Slashdot Mirror

← Back to Stories (view on slashdot.org)

Unlocking a Travelstar 2.5" HDD?

Posted by Cliff on from the unsecuring-the-wrongfully-secured dept.

Rogerborg writes "So, I buy a used 6.5Gb IBM Travelstar on eBay, only to find that I didn't caveat emptor enough, and it's password protected. No problem, I'll just, uh... uh... what will I do? According to this discussion at geek.com, the password is stored on the platter, not the controller, so swapping controllers won't help. If the controller finds a password, it refuses all access to the disk. Mounting the drive as a slave in an IDE converter, I can't fdisk, format or otherwise access it under Linux. DOS won't even recognize that the drive is there. I've even tried it in a freaky system running VxWorks. The drive mounts, but can't be accessed or formatted." How rude! Are there any utils out there that can be used to unlock the device so it can be used?

"The IBM tech sheet for a similar drive notes that there is a "security erase unit" command... but it's also password protected! I can't find any further info on the IBM site, but apparently their recommendation is to use password locked Travelstars as paperweights.

"Nortek can remove the password from Travelstars using black magic and chicken sacrifices (or a custom controller?) but will charge more than the price of the drive for even for a basic unlock that destroys the data.

I have to admit that I'm impressed by this security, but it renders the drive useless far too easily. Can Slashdot suggest any way to remove the password (the data can go too), short of degaussing the platters or building a custom controller?"

10 of 55 comments (clear)

  1. youre fucked. by Zurk · · Score: 5, Informative

    bottom line is -- youre really fucked. its too cheap of a disk to be worth the hassle. just go get another.
    on the other hand, if you want to struggle and you have plenty of free time :
    Look for an eeprom which is located on the underside of the planar near the main power connector. The chip is typically marked C46C1 - ST 39AD. It is an 8 pin package and holds the security supervisor data and the code required to unlock the embedded code on the hard drive. Replace this chip with a clean one from an unlocked laptop drive (you can burn it with a serial eeprom writer) and you should be able to format the drive. Note that you need to disassemble the housing of the drive and maybe 30% of the drive itself to get at the chip.

  2. hearsay: "ZAP" by b-side.org · · Score: 3, Informative

    Someone claims that a program called 'zap' from IBM will do it.

    It's response number 16.

    Enjoy,

    --
    Indie rock lives! b-side!
    1. Re:hearsay: "ZAP" by hdurdle · · Score: 2, Informative

      There's a whole host of tools on the IBM site all Zap does is write zeros to the first 128 sectors of the disc... if, as a previous poster stated, the password is on a chip on the drive, you're probably screwed.

    2. Re:hearsay: "ZAP" by FrozedSolid · · Score: 2, Informative

      Someone else on that same board mentioned...
      In the booklet for the 755C and similar models, there appears to be a "power on password" jumper next to the cmos battery sockets.
      Then.. later on, someone mentioned this (could be a troll, all caps.. but then again, could be foreign or something..)
      YOU MUST SUPPLY POWER TO THE HDD THEN SHORT OUT J11 J15 SHUT DOWN AND FDISK THEN FORMAT AND YOUR READFY TO GO
      Can't vouge for how true any of that is.. but it's worth a shot.

      -Scott

      --
      When all freedom is outlawed only the outlaws have freedom
    3. Re:hearsay: "ZAP" by Rogerborg · · Score: 3, Informative

      Thanks for the response, but the poster hasn't tried this on a Travelstar. Until you unlock the drive, you can't do anything to it. I've tried this in 2 DOS laptops, a Linux desktop and a custom system running a PPC and VxWorks. One laptop won't boot at all unless the password is entered (even from floppy or CD-ROM), the other systems booted but then couldn't see the drive. Actually, the VxWorks system saw and mounted the drive, but then couldn't access it at all.

      --
      If you were blocking sigs, you wouldn't have to read this.
  3. Re:Degauss? by pete-classic · · Score: 5, Informative

    Modern HDDs use "imbedded servo data" which basically means that there are magnetic "guide posts" or "mile markers" on the disk. This is a huge improvement. The sort of capacities that HDDs have today would be impossible without it. It has also cured the so-called "Monday morning blues." (For PCs anyway :-)

    This is why many people used to think that you could perminately damage IDE hard disks with a low level format. You can't becuase 1. a low level format is really executed by the drive hardware, and is just initiated from software and 2. these drives have an electronic "interlock," which is to say they will "fail" on writing to the servo areas.

    It is also important to understand that in modern drives the controller is the board on the drive. IDE isn't a controller, it is a simple data bus. (In fact, the original IDE ports were nothing more than stripped down ISA ports.) So the servo areas aren't externally addressable.

    Bottom line, if you degauss, you'd better have a "factory" controller to re-write the servo areas if you ever want to store data on the disk again.

    -Peter

  4. It's a $12 drive. Throw it away. by nukebuddy · · Score: 3, Informative

    Why do people purchase junk like this? The best thing to do with a used HD is throw it in the garbage. If you want a cheap HD, you can buy a brand new 10GB Travelstar for $81 shipped:
    http://www.googlegear.com/ggweb/jsp/ProductDetail. jsp?ProductCode=712553-017

    -nb

  5. Re:publically available by Anonymous Coward · · Score: 1, Informative

    In the 9x series just rename (from dos) a directory to contain the character 254 (ALT-254). Windows find will bypass it and windows explorer can't enter it. Set up some batch files to hide and reveal the directory. It's enough for idiot family's, anyway.

  6. Re:last resort by kju · · Score: 4, Informative

    NEVER USE A MAGNET! Besides the data tracking informations are written on most hard disks. You will destroy this essential data with a magnet and render the harddrive unusable!

  7. IBM Travelstar info by Anonymous Coward · · Score: 1, Informative

    The IBM Travelstar series has ATAPI commands which can protect the drive. If you don't supply the password to a locked drive you won't even see the drive. The firmware on the drive has a 5 counts and you're out system to slow down brute forcers. If you get it wrong 5 times you need to power down to reset the drive. There are no jumpers to short out and no utilities to bypass the mechanism. If you can't see the drive how are you supposed to use a utility to speak to it ?
    Think caps on people... let's hear some intelligent replies.