Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Data recovery from encrypted SSD. I know the password!


  • Please log in to reply
10 replies to this topic

#1 haczet

haczet

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:08:14 AM

Posted 09 September 2017 - 06:58 AM

I am trying to access my encrypted samsung evo 840 SSD

I had battery charging issues on my old laptop but the hard drive WAS WORKING until laptop battery discharged completely.

 

1. Drive is working now.

2. It was encrypted by setting ATA drive password in BIOS.
3. I know the password, I entered it many times on my old laptop.
 
After moving hard drive few months later to my new laptop I was not able to access it.
 
Drive is detected by the computer.
I enter ATA password.
It acts like the password is wrong.
 
From what I learned so far the issue is that my old laptop used different way
to set/unlock ATA password. It was 2013 laptop samsung 370r5e.
I found topics where people describe similar issues
and resolved them by plugging the hard drive to the old laptop.
So I can unlock it in an older machine.
 
My old laptop (samsung 370r5e) had 8 char ATA password and my new laptop uses 16 (or 32; not sure) password. And thats the main issue. There are different way ATA passwords are set and read? 
 
Solutions:
1. Useing MHDD is probably not posible.
       My new laptop (lenovo 700-15isk) demands I enter drives ATA password before booting into MHDD, cant go past it.
       Can I install some unofficial moded BIOS to boot MHDD and skip BIOS password prompt?
       Maybe some moded BIOS that will use some old ATA password scheme?
       Do mods like this exist and where would I find them?
       Maybe running older BIOS version on my laptop that used 8 char passwords? Not sure where could I find them.
       I can boot MHDD and than plug in my SSD after to skip password requirement but I dont know how risky it is to plug in drives while system is running. Is there a safe way to do it? SATA is plug and play right ;)
2. Repairing my old laptop.
       The issue is that is does not charge the battery. I checked the charger and it works OK. Laptop worked fine until battery went to 0%. I would have to replace motherboard to fix it. Its expensive ;)
3. Connecting drive using USB adapter.
       Are there ways to send ATA commands to the drive connected via USB adapter?
       Is there a software that could do it and turn off the ATA password? I have 100% the right password.
4. Trying different PC
       If you tell me that MHDD definitely had the different ATA password schemes worked out I could buy some 30 euro used desktop PC to run it.
       Would still be cheaper than sending drive to data recovery center to unlock it.
       I know that people where able to run MHDD by skiping BIOS ATA password prompt in desktops.
 
regards
Mr PleaseHelpMe :)


BC AdBot (Login to Remove)

 


m

#2 haczet

haczet
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:08:14 AM

Posted 09 September 2017 - 09:56 AM

I might have solved part of the problem.

It turns out setting BIOS password is sending scancodes of the keys I press to the drive and not the keys value itself.

On new laptop pressing same keys may send different scan codes.

 

Can someone help me now?

I need scan codes for my old laptop samsung np370r5e or similar model

I may be able to "translate" those scan codes :)



#3 britechguy

britechguy

    Been there, done that, got the T-shirt


  • Moderator
  • 5,354 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Staunton, VA
  • Local time:02:14 AM

Posted 09 September 2017 - 10:51 AM

Why can you not use your old laptop with the old drive, and simply copy (preferably unencrypted) that data off to an external backup drive?  I have had many a laptop with a completely dead battery or no battery at all that can run just fine on the charger alone and I'd hope yours would do that, too.

 

Then you can port it to wherever you want it and, if you so desire, have that destination be encrypted.


Brian  AKA  Bri the Tech Guy (website address in my profile) Windows 10 Home, 64-bit, Version 1709, Build 16299

       

    Plus ça change, plus c'est la même chose
              

 


#4 haczet

haczet
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:08:14 AM

Posted 09 September 2017 - 11:02 AM

I think that charging circuitry on the motherboard is broken, laptop worked fine on battery untill it went down to 0%.

I checked the charger. its good but it is not powering up the laptop with or without battery connected.


Edited by haczet, 09 September 2017 - 11:03 AM.


#5 britechguy

britechguy

    Been there, done that, got the T-shirt


  • Moderator
  • 5,354 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Staunton, VA
  • Local time:02:14 AM

Posted 09 September 2017 - 11:14 AM

Then the first thing I'd try, if you're able, is looking inside the laptop to see if the charging port has "snapped off" of the motherboard, usually at the solder joints, which is not uncommon.  It may not be completely off, but if the joints are cracked you'll get no power going into the machine to fire it up.  There were some computers where this part was it's own little separate unit that has a connector to the motherboard.

 

These sorts of situations are precisely why I discourage my clients from encrypting drives unless something makes it absolutely necessary.  You are very lucky that you know your password, and someone else may have a "more creative" way to get at the drive when connected as an external drive to your new computer, but sadly I don't.  I just don't deal with encrypted drives at all frequently and discourage the use of encryption except when absolutely necessary.

 

By the way, what's the make and model of your old laptop?  Searching the web on that plus "service manual", if a service manual is now available online for it, can give you a wealth of information about exactly how the power port is configured and how difficult it might be to get to.


Edited by britechguy, 09 September 2017 - 11:17 AM.

Brian  AKA  Bri the Tech Guy (website address in my profile) Windows 10 Home, 64-bit, Version 1709, Build 16299

       

    Plus ça change, plus c'est la même chose
              

 


#6 haczet

haczet
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:08:14 AM

Posted 09 September 2017 - 11:39 AM

Tested board with a multimeter and its not the connector, there is a issue with one of the components.

 

Thinking about ordering exactly this same laptop I had before (its like 300 euro now), unlocking drive and than sending the PC back (Can return it within 2 weeks here EU without a reason) 


Edited by haczet, 09 September 2017 - 11:40 AM.


#7 haczet

haczet
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:08:14 AM

Posted 09 September 2017 - 12:30 PM

it seams when I entered password on my old laptop the letter "l" was saved by BIOS as key scancode $26 instead of ASCII $6C.
I think that the challenge is to send ATA command to the drive in the right code exactly like the one used by my original laptop
and I am unable to do this myself.
 
can anyone tell me how could I do it?


#8 JohnC_21

JohnC_21

  • Members
  • 20,537 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:14 AM

Posted 10 September 2017 - 08:56 AM

From my understanding you cannot unlock a HDD password on another computer. It can only be unlocked on the computer the password was imputed on as the encryption is tied to the hardware of the computer.

 

I believe there is hardware that can remove the password on the drive, something called a PC3000 board but it is expensive. There may be somebody local that can do this or you can contact a professional recovery service.

 

There is this company that says will find the password. I have no experience with them. I would ask them if removing the password with their program affects the data on the drive.

 

http://www.atola.com/products/insight/password-removal.html

 

 



#9 haczet

haczet
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:08:14 AM

Posted 10 September 2017 - 09:09 AM

Yes, you can unlock it on another computer, found many threads with problem similar to mine. the problem is ATA standard's implementation across different computers.

The drive is encrypted so there is no special software or hardware that can remove the password without loss of data.

Drive has to be unlocked, I got a lot of help on other forums, will try unlocking in next week.


Edited by haczet, 10 September 2017 - 09:09 AM.


#10 JohnC_21

JohnC_21

  • Members
  • 20,537 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:14 AM

Posted 10 September 2017 - 09:11 AM

If you have the time, please post an update. Thanks.

 

Edit: The HDDGuru forum is an excellent forum for your situation if you have not already posted there.


Edited by JohnC_21, 10 September 2017 - 09:23 AM.


#11 haczet

haczet
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:08:14 AM

Posted 07 November 2017 - 03:39 PM

Didn't have the time to unlock the drive till now.

 

Got a 50 euro Dell optiplex380 desktop PC.

Connected the drive to sata.

Unlocked the drive in BIOS on first run with this same password that I always used.

All data recovered.

 

F*** laptop BIOS man :)






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users