Accessing from USB a drive encrypted with FDE

iacchi

Reputable
Jan 19, 2015
3
0
4,510
Hi everybody!
This is my first post and I'm going to ask something that I've understood is considered borderline, I hope you can answer me by forum rules.

So, here's the fact. A friend of mine asked me to buy him a PATA (just to tell you how old it is) HDD external enclosure because he had an old broken Lenovo Thinkpad and he wanted to remove the HDD and use it as an external drive. What he didn't remember is that he encrypted the drive with Lenovo's FDE BIOS feature and now that drive is inaccessible.
I tried to wipe the MBR, write zeroes with dd and similar, but realised only later that FDE writes the encryption key in the firmware and so any attempt is useless.

Contrary to other previous questions (that's why I think this post is legit), he remembers the HDD password, so that's not a problem. The problem here is finding a way to have this password asked so that he can access the drive and possibly remove the encryption key.
If I've well understood, it is only possible to remove the key from the BIOS of the original PC (or even a different PC of the same line of models). Unfortunately, his own PC is broken and we don't have access to any other Thinkpad to put the HDD into, or any other laptop with a PATA port for what matters.
So, the question is: is there any way (a software or something) that lets you handle this FDE key is some way, e.g. delete it, provided that you have to insert the current password first? Can it be done from the external HDD enclosure (any OS is fine, we have Windows, Linux, Mac)? If not, I have a desktop computer with PATA ports. If I connect the HDD to one of them and boot from it, is there a way to do what I'm asking?

Thanks in advance to everybody.
 
Solution
A Linux alternative is hdparm:

http://sourceforge.net/projects/hdparm/

The following example (all on one line) sends 32 hex bytes to unlock dev/ice:

hdparm --security-unlock $(printf '\xA3\x17\x3F\x87\x02\x5B\x67\x63\xBE\x34\x37\x08\xEF\x9A\xD9\x6E\x74\xE0\x67\xFD\xA7\x38\xF4\xDD\x90\x77\x8C\x4B\x60\x82\xB1\x0D') /dev/ice

Replace "/dev/ice" with your actual device name, eg /dev/sdb.

Here is a list of keyboard scan codes (use the "make" codes):

http://www.users.on.net/~fzabkar/MSKeyLog.TXT
I don't know of any tool that is able to set up a password challenge via USB. However, if you can find some way to connect your drive to a desktop machine via SATA or 40-pin PATA, and if the drive is protected by an ATA password, then you could use a tool such as Victoria for Windows to supply the password.

Tutorial: Using Victoria to send ATA passwords as file:
http://www.alexsoft.org/viewtopic.php?t=1072&p=4870#p4870

Note that your password will probably be encoded as keyboard scan codes rather than ASCII characters.

About Passwords ...
http://www.alexsoft.org/viewtopic.php?f=95&t=614&p=1620
 
Hi fzabkar, thank you very much for the information. My desktop PC (the one with the pata cable) runs linux unfortunately, I'll try and see if I can do this through Wine or if I can get my hands on a different PC. In the mean time, I hope there'll be some answers.
 
A Linux alternative is hdparm:

http://sourceforge.net/projects/hdparm/

The following example (all on one line) sends 32 hex bytes to unlock dev/ice:

hdparm --security-unlock $(printf '\xA3\x17\x3F\x87\x02\x5B\x67\x63\xBE\x34\x37\x08\xEF\x9A\xD9\x6E\x74\xE0\x67\xFD\xA7\x38\xF4\xDD\x90\x77\x8C\x4B\x60\x82\xB1\x0D') /dev/ice

Replace "/dev/ice" with your actual device name, eg /dev/sdb.

Here is a list of keyboard scan codes (use the "make" codes):

http://www.users.on.net/~fzabkar/MSKeyLog.TXT
 
Solution