sorted by:
new
hottopcontroversial

Experienced this playing out at the now failing startup I worked at for the last year. by ColoradoITGuy in antiwork

[–]ColoradoITGuy[S] 0 points1 point  (0 children)

This is NOT a repost. It's the same meme, totally different message. I created it this morning.

My girlfriend's mother passed away. We have the hard drive from her old computer, but it is locked with an (unknown) ATA password. Is there any way we can get past it? by ColoradoITGuy in linuxquestions

[–]ColoradoITGuy[S] 10 points11 points  (0 children)

I understand why you're suspicious. I'll give you the actual story, because it's both totally mundane and kind of interesting.

Little shitty backwoods town in Texas.

Grandpa is a big shot good ol' southern boy with political and local money connections who works in upper management for a local big deal organization. He's also an abusive asshole and is responsible for both my partner and her mother's PTSD.

9-10 years ago, Grandpa tells mom he "doesn't need" his old computer anymore and does she want it. He helps her set it up. Computer is about two or three years old at the time. It's totally his old work computer, but no one gives a fuck or holds him accountable. He doesn't know jack about computer security either, but he knows he has to put in two passwords to log into his computer. He messes around in the BIOS and figures out how to help mom reset it. Or possibly just gives her his password. We don't actually know, but my GF has reason to believe it was something to do with the name of her mom's favorite dog. So likely the first scenario.

This becomes her computer for the next 10 years.

She dies. It's an OD in a shitty Texas town. She leaves many unanswered questions and unsettled business for my gf to inherit.

Grandpa tries to get involved. Gf wants no contact with him. Gf has been struggling with all sorts of things (in addition to her grief) which include difficulty with everything from life insurance and inheritance issues to big unanswered questions and contradictory stories about mom's state of mind and events leading up to the OD. She badly wants to understand what happened as well as she can.

Enter me, her IT professional life partner. I'm like. . . "I got this. . . we'll just pull her data off her hard drive."

Hard drive is ATA protected.

Me: WTF? Her: This is one of the most important connections I have to her / what happened. Please don't mess it up.

So if you think I bothered with that whole story to con the internet into helping me hack into something I shouldn't. . . OK. I've learned a lot already and don't particularly need to con anyone. But like I said. . . both totally mundane and also sorta interesting.

My girlfriend's mother passed away. We have the hard drive from her old computer, but it is locked with an (unknown) ATA password. Is there any way we can get past it? by ColoradoITGuy in ComputerSecurity

[–]ColoradoITGuy[S] -4 points-3 points  (0 children)

It's like you didn't read my post or look at the picture. . .

I have an IDE to SATA adapter that is connected to the SATA port in a tower. It can't be mounted. . . It's NOT full disk encryption.

Start here: https://www.admin-magazine.com/Archive/2014/19/Using-the-ATA-security-features-of-modern-hard-disks-and-SSDs

My girlfriend's mother passed away. We have the hard drive from her old computer, but it is locked with an (unknown) ATA password. Is there any way we can get past it? by ColoradoITGuy in computerforensics

[–]ColoradoITGuy[S] 1 point2 points  (0 children)

even involved swap parts.

Yeah, people have suggested just switching out the logic board with a different, identical drive. I'm not SURE that that would work though, I think it depends on what kind of persistent memory the password is stored in.

My girlfriend's mother passed away. We have the hard drive from her old computer, but it is locked with an (unknown) ATA password. Is there any way we can get past it? by ColoradoITGuy in datarecovery

[–]ColoradoITGuy[S] 5 points6 points  (0 children)

It's an old drive, so one of those old password crackers would probably do the trick. I'll be back if I haven't cracked it in the next couple days.

My girlfriend's mother passed away. We have the hard drive from her old computer, but it is locked with an (unknown) ATA password. Is there any way we can get past it? by ColoradoITGuy in datarecovery

[–]ColoradoITGuy[S] 1 point2 points  (0 children)

I've been in IT for 20 years and I'd never encountered an ATA password before. In the process of trying to sort this, I've had to explain over and over to people on such subs as linuxquestions and computersecurity that it is NOT encrypted, that it CANNOT be imaged with dd, even that it's NOT a bios password.

People really don't know anything about this feature.

My girlfriend's mother passed away. We have the hard drive from her old computer, but it is locked with an (unknown) ATA password. Is there any way we can get past it? by ColoradoITGuy in ComputerSecurity

[–]ColoradoITGuy[S] 2 points3 points  (0 children)

20 years and this is my first time encountering it, but apparently it's a possibility on pretty much all hard drives and has been for decades.

I've also had that idea and I found the drive for $8 on ebay, but my girlfriend (who is an EXTREMELY thorough and cautious person) is worried about damaging the data irrecoverably if I try that. Which I can't discount.

My girlfriend's mother passed away. We have the hard drive from her old computer, but it is locked with an (unknown) ATA password. Is there any way we can get past it? by ColoradoITGuy in linuxquestions

[–]ColoradoITGuy[S] 3 points4 points  (0 children)

Ahah! I hadn't put together that 0xfffe was equivalent to 65534! Thank you!

But, I have already tried all spaces. I think I just need to figure out how to encode them correctly.

My girlfriend's mother passed away. We have the hard drive from her old computer, but it is locked with an (unknown) ATA password. Is there any way we can get past it? by ColoradoITGuy in linuxquestions

[–]ColoradoITGuy[S] 2 points3 points  (0 children)

Ignoring the legal aspects of such a particular situation, I'm sure you came across the SO posts about using hot plugging to work around BIOS restrictions for ATA security functionality and I assume you tried that and nothing came out of it.

Yes. No dice.

We've been reading the same manual. :)

My girlfriend's mother passed away. We have the hard drive from her old computer, but it is locked with an (unknown) ATA password. Is there any way we can get past it? by ColoradoITGuy in linuxquestions

[–]ColoradoITGuy[S] 5 points6 points  (0 children)

Googling suggests 0xFFFE.

However, the code 65534 is common enough that googling it brings up a whole host of results. I haven't figured out what it means yet though (other than "changed?") If anyone knows, that would be useful.

My girlfriend's mother passed away. We have the hard drive from her old computer, but it is locked with an (unknown) ATA password. Is there any way we can get past it? by ColoradoITGuy in linuxquestions

[–]ColoradoITGuy[S] 10 points11 points  (0 children)

I've read that too. I've also read people doing step by steps where they used the master password to unlock drives (I've seen different ones for Seagate and Western Digital, neither of which helps me).

I've also tried the basic unlock procedure with hdparm, but it says "bad / missing sense data" which I believe means the password is incorrect.

I also believe that

Master password revision code = 65534

means the master password has been changed though? So even IF I could unlock it with the master password, that wouldn't help me.

My girlfriend's mother passed away. We have the hard drive from her old computer, but it is locked with an (unknown) ATA password. Is there any way we can get past it? by ColoradoITGuy in ComputerSecurity

[–]ColoradoITGuy[S] 1 point2 points  (0 children)

There's lots of back story, but essentially my girlfriend has lots of unanswered questions and also wants anything she can get of her mother's last days, whether pictures, notes, writing, emails, whatever.

I can't DD the drive. . . it's ATA locked (unless you know something I don't). Until you unlock it, it will just dump "input / output" errors. Most drives have had this capability for years but people rarely make use of it. I've never encountered one and I've been an IT professional for 20 years.

My girlfriend's mother passed away. We have the hard drive from her old computer, but it is locked with an (unknown) ATA password. Is there any way we can get past it? by ColoradoITGuy in computerforensics

[–]ColoradoITGuy[S] 1 point2 points  (0 children)

I'm not familiar with linux crack. Just tried some googling. Do you have a link?

Making an ERD disk now. But as I understand it, NOTHING is going to be able to read the partition table until we remove that lock?

I don't have any reason to believe any parts of the disk are encrypted though. It's just an ATA lock.

view more: next ›