Slashdot Mirror
Unlocking a Travelstar 2.5" HDD?
Rogerborg writes "So, I buy a used 6.5Gb IBM Travelstar on eBay, only to find that I didn't caveat emptor enough, and it's password protected. No problem, I'll just, uh... uh... what will I do? According to this discussion at geek.com, the password is stored on the platter, not the controller, so swapping controllers won't help. If the controller finds a password, it refuses all access to the disk. Mounting the drive as a slave in an IDE converter, I can't fdisk, format or otherwise access it under Linux. DOS won't even recognize that the drive is there. I've even tried it in a freaky system running VxWorks. The drive mounts, but can't be accessed or formatted." How rude! Are there any utils out there that can be used to unlock the device so it can be used?
"The IBM tech sheet for a similar drive notes that there is a "security erase unit" command... but it's also password protected! I can't find any further info on the IBM site, but apparently their recommendation is to use password locked Travelstars as paperweights.
"Nortek can remove the password from Travelstars using black magic and chicken sacrifices (or a custom controller?) but will charge more than the price of the drive for even for a basic unlock that destroys the data.
I have to admit that I'm impressed by this security, but it renders the drive useless far too easily. Can Slashdot suggest any way to remove the password (the data can go too), short of degaussing the platters or building a custom controller?"
bottom line is -- youre really fucked. its too cheap of a disk to be worth the hassle. just go get another.
on the other hand, if you want to struggle and you have plenty of free time :
Look for an eeprom which is located on the underside of the planar near the main power connector. The chip is typically marked C46C1 - ST 39AD. It is an 8 pin package and holds the security supervisor data and the code required to unlock the embedded code on the hard drive. Replace this chip with a clean one from an unlocked laptop drive (you can burn it with a serial eeprom writer) and you should be able to format the drive. Note that you need to disassemble the housing of the drive and maybe 30% of the drive itself to get at the chip.
Someone claims that a program called 'zap' from IBM will do it.
It's response number 16.
Enjoy,
Indie rock lives! b-side!
Why don't you ask the seller what the password is?
Modern HDDs use "imbedded servo data" which basically means that there are magnetic "guide posts" or "mile markers" on the disk. This is a huge improvement. The sort of capacities that HDDs have today would be impossible without it. It has also cured the so-called "Monday morning blues." (For PCs anyway :-)
This is why many people used to think that you could perminately damage IDE hard disks with a low level format. You can't becuase 1. a low level format is really executed by the drive hardware, and is just initiated from software and 2. these drives have an electronic "interlock," which is to say they will "fail" on writing to the servo areas.
It is also important to understand that in modern drives the controller is the board on the drive. IDE isn't a controller, it is a simple data bus. (In fact, the original IDE ports were nothing more than stripped down ISA ports.) So the servo areas aren't externally addressable.
Bottom line, if you degauss, you'd better have a "factory" controller to re-write the servo areas if you ever want to store data on the disk again.
-Peter
Several HDDs I have taken apart have a small flash ROM or EEPROM or some other such small memory-storing chip, located in the same container as the physical drive platters. There's the EEPROM, some resistors, and the drive servo. I don't know about IBM drives; but it probably is stored in one of those chips. Per the geek.com discussion, it seems IBM won't be terribly helpful with it, but I'm sure somebody, somewhere, has written a reflasher for the drive. The question is finding that person...
Anyone know of a place I could purchase hard-drives with this type of hardware-level password protection for a desktop system? I'd put one of those onto my documents drive and keep it safe from prying family members while I was out.
Why do people purchase junk like this? The best thing to do with a used HD is throw it in the garbage. If you want a cheap HD, you can buy a brand new 10GB Travelstar for $81 shipped:. jsp?ProductCode=712553-017
http://www.googlegear.com/ggweb/jsp/ProductDetail
-nb
My personal paranoia and suspicions aside, who would sell their HD to a stranger *without* first wiping the disk?
Well, a local dot-com went out of business recently, and auctioned off almost all of their corporate and development servers (including the Visual SourceSafe repository) without wiping the drives. I've also bought an un-wiped computer from a consignment shop. So I wouldn't automatically assume that the laptop in question was stolen.
NEVER USE A MAGNET! Besides the data tracking informations are written on most hard disks. You will destroy this essential data with a magnet and render the harddrive unusable!
and harass the bejiznitz out of the seller. Heck, I'm up to my 3rd account because of idiot buyers who ruined my name (and got me banned) on false claims just because they were from overseas. At least you'd have an honest reason to slam the guy/gal/thing and maybe get enough insurance money to get the thing unlocked (or buy a much larger drive and toss the locked one)
:)
Or better yet : sell the drive on ebay
-Billco, Fnarg.com
For this kind of thing, I use PGPdisk. Let's you allocate space into an encrypted pseudodrive. Much more secure than a simple password-protected drive. As long as your software is uncomprimised, it's totally non-hackable. But don't lose your pass phrase!!!
Basic and industrial strength versions!
sulli
RTFJ.
Or if they're storing politically sensitive material, perhaps in a suppressive regime. Or really hard core porn. ;-)
It doesn't see the drive. The controller won't respond to any ATAPI commands except the password ones.
Actually, if you really want the data, an informed poster on another forum reckons that if you whip the controller off a non-locked drive (without powering it off, so it never gets an ATAPI power down or sleep from the BIOS), you can drop it onto a locked drive and read the data (once, until you power it down). I'm dubious about that, as I can't see any non-volatile storage on the controller to hold that state, but hey, it might be worth a try.
If you were blocking sigs, you wouldn't have to read this.
Bzzt, thanks for playing. Identical drives function as slaves just fine. Try before you post, please.
If you were blocking sigs, you wouldn't have to read this.
For the benefit of the archives, a last post from the article submitter:
I found a solution. The solution came in the form of a very nice man that I met on another discussion forum who, free and gratis, removed the password after I posted the drive to him. He also managed to tell me that what the password had been set to, and what kind of laptop the drive was in when it was locked.
How did he do it? He won't say. I think that he works for a shop that does this commercially, so I'll respect that and not mention his name or the shop that I think he works for. All I can say is that from our conversations, I suspect that with access to a custom drive controller, this is a thirty second operation, but that it does absolutely require modified hardware, and that there is, and never will be a software solution.
Thanks to all who contributed, and good luck with your own hacking and hardware reuse. ;-)
If you were blocking sigs, you wouldn't have to read this.