Category: Software

How To UNLOCK a Password Protected Western Digital WD, IBM or Hitachi SATA Hard Drive Without Knowing the Master or User Password 

NEW INSTRUCTIONS (Oct 12, 2020)

Boot CD is now free. Newer versions exist, but not free from viruses like this download. Bitcoin Donations Welcome.

Download the old clean boot iso here: https://mega.nz/file/4llxUK7L#1H62fgGsOQAGcH7oS-lPo2QObYcdjZg_OCdW08ewkKQ

NEW INSTRUCTIONS (May 4, 2019)

Look, you are here for a reason.  You are stuck.  The drive is locked and you’re screwed. The whole reason for this post is to HELP YOU OUT. I’m not the author. This software can be found in its bare form for free.  I made this available because as a fellow man, I know what its like to help a bro out.

What I’m trying to say is if this works for you, please help out the next guy by posting your experiences at the bottom of this page as a comment.  Thanks! :>

I have made everything easier and more clear.  Now you just boot from an .iso file and it does the rest automatically.

*This guide was intended for Western Digital drives only at this time. I have some reports that software also works on IBM and Hitachi IDE/SATA drives, but I have not confirmed that yet by myself, so I do not claim that it will here yet.  If you unlock a non-WD drive, please post your results as a comment.  See Step 8 for IBM/Hitachi command line switches. Thanks.

1. Read everything on this page.  You need to understand that you need a compatible chipset, proper SATA/IDE BIOS settings, and that the WD Unlocker Software only unlocks hard drive bios passwords, and has *only been tested on Western Digital drives.  It has not been tested on SED self encrypted drives.

NOTE: UNTESTED ON WD My PASSPORT USB DRIVES.

SATA/IDE ONLY! NO USB!

SATA/IDE ONLY! NO USB!

2. Repeat Step 1.

3. You will need:

–SATA/IDE hard drive connected to the primary 1 or secondary 2 slot or plug.

Updated list of supported drives (no guarantees):

Maxtor (except STM),WD,Toshiba,Quantum
Fujitsu (except MHW,MHZ,MHY,MJA). There is a mistake for MHX
Nikimi (former Quantum & Maxtor)
MDT (former WD)
Native Hitachi (DK-xx,HTC..G7AT00)
IBM/HGST (many models,except 100h_byte_NVRAM & 4K-NVRAM & 2.5″ with blue controllers. (mcu=ARM & B9A3..), disks without NVRAM)
ExcelStore(former HGST).
Seagate(with parallel flash)+Grand(UX with serial flash).

NOTE: UNTESTED ON WD My PASSPORT USB DRIVES.

SATA/IDE ONLY! NO USB! (not tested, no guarantees)

–Compatible chipset.  I recommend early Intel based with both IDE+SATA support such as Pentium4 based. I know for a fact that a modern quad core based system such as a Dell T3500 or Lenovo s20 Thinkstation DO NOT WORK.  You need an OLDER chipset. I can confirm a HP Compaq d530 desktop WILL WORK. The first time I unlocked a drive, the software failed to detect the drive on two more modern motherboards, until I tried a different third older motherboard and it worked. Knowing this will save you hours of frustration.

YOU MUST HAVE A COMPATIBLE CHIPSET!

YOU MUST HAVE A COMPATIBLE CHIPSET!

YOU MUST HAVE A COMPATIBLE CHIPSET!

–BIOS SATA/IDE controllers set to the most NATIVE and non-AHCI or non-RAID mode you can set. This setting will vary greatly between motherboards. Try every setting if something fails or the unlocker does not see a drive.  You can test a good setting by booting and running a copy of MHDD 4.x (mhdd32ver4.5.iso). If MHDD detects and lists the hard drive, then your BIOS settings are correct.  If you cannot see the drive, try different drive controller settings in your bios, or get another motherboard.

–USB flash drive  or  blank cd/dvd disc and burner drive to burn the .iso file.

-the WD Unlocker Software .exe file (*written by Moltke) and a boot .iso. This software is freely available on the internet. I have done all the other extra hard work and created a complete boot package with all the files you need ready to go. This includes the hours of research, file procurement, creating a boot .iso, modified and optimized the startup configuration, and then repackaged these up with nice easy instructions. No fucking viruses here. If you don’t want to donate, go click around and download from the russian forums and try your luck. Either way you still need a boot package.  The prepared package is available if you like for a small donation here:

2020 I made the download free, please donate.

Buy with Crypto

TERMS OF SALE:

NO REFUNDS   DO NOT PURCHASE IF YOU WANT A REFUND

NO RETURNS

NO SUPPORT

NO GUARANTEES THAT IT WORKS ON YOUR HARDWARE

DO NOT BUY THIS SOFTWARE UNLESS YOU KNOW WHAT YOU ARE DOING.

 **** Warning the .rar file you might be tempted to download from OTHER untrusted links has a very nasty new variant of the Win32/Virut virus.  DON’T DOWNLOAD IT!  You get what you pay for! Look you can mess around and register at a dozen Russian forums, download and open a hundred infected zip files, but I’m telling you, don’t waste your time, I’ve already done all the work for you.

****

 No Guarantees. No Refunds. No Support. No Returns. All Transactions are FINAL.

I didn’t write the unlocker software, it will either work or it won’t. I have only compiled and repackaged into a easy to use ready to go download. Your small donation goes to offset my site server costs…   but hey! It’s only two bucks! Otherwise, your drive is a guaranteed useless dead brick.

4. Download the above software file and save it. Open the .zip/compressed folder.

5. Insert USB Flash Drive. (you could alternatively burn the .iso file to CD or DVD and boot from that instead and skip to Step 8):

6.  ——> From the .zip package file you downloaded n Step 3 <——— , Run YUMI-0.0.9.5.exe and install the Unlocker_Boot_Image.iso file on the USB Drive.  YUMI will format and erase all data on the USB drive, so backup any important files first. See the readme.jpg graphic.  (The Unlocker_Boot_Image.iso file is only available/downloadable from the shopping cart in step 3.)

7. After your boot USB flash drive has been created, Open the USB drive folder and copy the file /multiboot/menu/menu.lst to the root / and /multiboot folders.  Copy/Paste it back to the USB drive into these two folders-> ‘ / ‘ (root) and  ‘/multiboot/’ .  This fixes a GRUB error that sometimes keeps the boot menu from showing.  Basically just copy the menu.lst file to every folder on the USB Drive to enable GRUB to find it. If you do not do step 7, your boot will probably (but not necessarily) fail at the GRUB prompt.    

8. Boot to the USB drive on the computer with the locked drive attached. Choose “Directly Bootable ISOs or Windows XP” from the YUMI boot menu.  Then Choose  “Boot Unlocker_Boot_Image.iso” from the GRUB boot menu. The unlocker software should automatically load some drivers and start.  My drive took 80 minutes to unlock.  Just let it work.  If you must quit hit CTRL+C.   You may restart the unlocker by typing ‘unlock.exe /A‘ (all) or ‘unlock.exe /P‘ (primary) or ‘unlock.exe /S‘ (slave/secondary) at the dos prompt. For Hitachi Global Star HGST / IBM drives add a ‘.’   Type ‘unlock.exe /P.‘   “.” for .  For Native Hitachi drives add an ‘8’. If you have success at unlocking a drive, please post a comment adding any additional knowledge that you can share, thanks! :>

Examples:

unlock.exe /A = Western Digital drive on (A)ll controllers

unlock.exe /S. =  IBM or Hitachi Global Star drive on secondary controller

unlock.exe /P8  = native Hitachi drive on primary controller

If You Have Success In Unlocking Your Hard Drive Using This Software, Please Post Your Results As a Comment to This Page So That You May Help Others.  Thanks

 THANK YOU MOLTKE !  You Deserve all the Credit.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~           OLD INSTRUCTIONS:

NOTE: This Guide Was Intended for WESTERN DIGITAL drives only. IT MAY WORK ON OTHER DRIVES AS WELL

So, you have a WD hard drive that has been password locked on the drives own bios, and you can’t format or partition it at all….

WHAT YOU NEED:

-Hiren’s Boot CD .iso file (i used a combo of v9.2 and 14) -a dos program called ZU.  There is a download link below in the instructions.

-your locked SATA drive hooked up to a computer with a compatible controller chipset. -The motherboard bios must be set to SATA NATIVE.  It Cannot be set to AHCI, RAID modes.  So play around with setting your sata controllers to NATIVE.  We want no IDE controllers! Just Sata.

A FEW KEY POINTS: This tutorial is only for IF YOU DO NOT HAVE THE MASTER, USERhi or USERmax hard drive lock password. This is not the computers bios password. However, the hard drive unlock password is set from within the computers BIOS. This is not the bios password set on the motherboard bios, this is the Password locking the drive from IO read/writes from below the computer’s bios level.

The HEX dump / MHDD 4.5 method did not work on my drive.  The scripts would error out and not dump the hex 22.bin file.  But i was still able to unlock the drive……. The SATA controller on the motherboard matters.  I tried two modern computers with no avail (Lenovo thinkstation s20 and Dell T3500).  I only got it to work when hooked up to an older P4 based computer with IDE and SATA plugs.  I tried for 2 whole days on the new systems before i moved to an older chipset and got it to work.

ALL THE CRAP I READ THAT DOESN’T REALLY MATTER IF YOU DON”T HAVE THE PASSWORD:

http://forum.hddguru.com/unlocking-ata-password-for-western-digital-t8374-360.html http://elettrofreak.blogspot.com/2011/02/estrarre-le-password-ata-da-un-hard.html http://www.tomshardware.com/forum/280346-32-lock-bios http://forum.hddguru.com/wd5000avvs-problem-pls-help-t22667.html http://forum.hddguru.com/unlocking-ata-password-for-western-digital-t8374-20.html http://forum.hddguru.com/unlocking-ata-password-for-western-digital-t8374-80.html http://www.rohitab.com/discuss/topic/35733-removing-hard-disk-password/ http://ipv5.wordpress.com/2008/04/10/4/ http://ipv5.wordpress.com/2008/04/14/list-of-hard-disk-ata-master-passwords/ http://forum.hddguru.com/ata-password-bypassing-t12257-20.html http://linux.die.net/man/8/hdparm http://mackonsti.wordpress.com/2011/11/22/ssd-secure-erase-ata-command/ http://participant.mykonicaminolta.com/productsattachments/manuals/bizhubHDDSecurityGuide362_282_222_350_250_200.pdf

ALL THE CRAP YOU CAN SKIP AND NOT EVEN BOTHER TRYING IF YOU DONT HAVE THE PASSWORD or MFG MASTER PASSWORD:

HDDUNLOCKER = its $50 im not paying

A-FF Repair Station = again, its $50 and im not paying

hdparm linux commands = Secure Erase and all those commands are worthless without a password

HDDERASE.exe = still need the password

HDDHACKR.exe = wouldn’t dump sectors 16-21 for me due to NO DRQ error.  i suspect this is related to hooking up to a motherboard drive controller that isnt compatible.

Victoria = still need the password

MHDD 4.6 = You need the mhdd.exe scripts anyways.  download and find dump, dump2 and dump48 scripts in the zip file called “mhdd.zip”. google it.  it also contains a perfect 512byte cs.bin file.  I tried for 2 days to get the scripts to dump my hex password 22.bin file  but they wouldn’t.  I could never get past the NO DRQ or DRIVE ERROR msg in the last line of the dump scripts.  READ ON BRAVE UNLOCKER!  there is a way!

MFG MASTER PASSWORDs: Didn’t work for me.  I suspect this is because this drive came from a secure bizhub konica minolta copier and the MASTER pw was changed from  default.   ‘WDCWDCWDCWDCWDCWDCWDCWDCWDCWDCWD’ , ‘h20insyde’ and all the rest did not work BUT YOU SHOULD PROBABLY TRY THEM IN MHDD FIRST! here is a list:

SEAGATE -> “Seagate” +25 spaces

MAXTOR series N40P -> “Maxtor INIT SECURITY TEST STEP ” +1 or +2 spaces series N40P -> “Maxtor INIT SECURITY TEST STEP F” series 541DX -> “Maxtor” +24 spaces series Athena (D541X model 2B) and diamondmax80 -> “Maxtor”

WESTERN DIGITAL -> “WDCWDCWDCWDCWDCWDCWDCWDCWDCWDCWD”

FUJITSU -> 32 spaces

SAMSUNG -> “ttttttttttttttttttttttttttttttttt” (32 times t)

IBM series DTTA -> “CED79IJUFNATIT” +18 spaces series DJNA -> “VON89IJUFSUNAJ” +18 spaces series DPTA -> “VON89IJUFSUNAJ” +18 spaces series DTLA -> “RAM00IJUFOTSELET” +16 spaces series DADA-26480 (6,4gb) -> “BEF89IJUF__AIDACA” +15 spaces

HITACHI series DK23AA, DK23BA and DK23CA -> 32 spaces

TOSHIBA -> 32 spaces For xbox hdds try “XBOXSCENE” or “TEAMASSEMBLY” too

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

BASICALLY HERE ARE THE INSTRUCTIONS:

SOFTWARE YOU DO NEED!:   zu = THIS IS THE MAGIC program.  As far as I know it ONLY WORKS ON WESTERN DIGITAL HARD DRIVES (although I could be wrong). You may download ZU WD Drive Unlocker here:


You will be emailed a download link after checkout. No Guarantees. No Refunds. No Support. No Returns. All Transactions are FINAL. Do not contact me about refunds. There aren’t any. I didn’t write it, it will either work or it won’t. I do not make any money from this, your small donation is used to offset server costs…

(optional) MHDD 4.5 = still need the password to UNLOCK, but it tells you everything you need to know about the state of the locked drive.  Run from a bootable ISO cd or USB key.  DONT USE VERSION 4.6 that is in Hiren’s Boot CD.  GOOGLE AND FIND VERSION 4.5.  Google the file mhdd32ver4.5.iso, and create a bootable cd or usb out of it.

1. plug the drive into an older sata motherboard computer.

2. set your BIOS sata controllers to the most NATIVE and non AHCI or RAID mode you can.

3. Boot to your mhdd iso cd that you created.  This sets the DOS environment and memory manager and stuff.

4. MHDD -> press Shift+F3 and choose your drive.  if its not listed then either edit \mhdd\cfg\mhdd.cfg to enable the controllers or use another computer/motherboard/controller.

5. MHDD -> Press Shift+F2 to view the drive properties, it should say LOCKED (Note: it may also tell you the SECURE ERASE time in minutes.  Mine was ’80 Minutes’.  this is important to note)

6. Exit MHDD with ALT+X.  You should now drop to dos.

7. Run ZU.  you will obviously have to copy the file over, this is why i use a USB drive to boot my ISO, i can copy the file to the USB drive, Boot my ISO using YUMI Bootloader, Exit MHDD, change dos path to ‘C:\’ and then run my C:\ZU.exe program

try them all ‘ZU /’ or ZU /S or ZU /A, one of them should start and not error.

If you get an error or ‘Drive still locked’ msg then try a different command ie ZU /A

If you get something that says ‘ELAPSED TIME xxxxxxx’ then LET IT RUN FOR AS MANY MINUTES AS DENOTED IN step 5.  I let mine run for over 80 minutes.

So, after 80 minutes nothing happeded.  I hit CTRL+C and exited out of ZU.

Then I ran MHDD again, picked the drive using Shift+F3, then checked the status with Shift F2.  Then I exited MHDD

FINALLY, i ran ZU.exe /P as my drive was on the primary controller.  This time it worked! ZU betta reported ‘DRIVE UNLOCKED’ and i was able to now format, partition and otherwise use the drive as normal!

SUCCESS! WD SATA HARD DRIVE UNLOCKED!

In the previous release were actually  simple methods remove passwords. To remove the password on HDD HGST / IBM and Native Hitachi (cery _DK23DA, _DK23FA ..)
 they should be transferred to the so-called SafeMode.
 Support in this mode, and implemented with ZU2
 Since the screws go into this specialized treatment for different times (eg Native Hitachi to 2 minutes), for convenience, is now at the start of ZU, runs per second output message like ELAPSED 00:00:22 (00:00:23 ..) with naturally occurs poll preparedness on the specified parameter kanale.  poll if it continues obscenely long You can simply press any key. Work prg.budet finished with the message UNLOCK NOT DONE.
 To distinguish between vendors vvedny 2 qualifier
 "." for HGST / IBM
 "8" for Native Hitachi.
 Ie the type of command would for example be in the form
 ZU / S. :) battle with HGST on Secondary channel
 ZU / P8 disclaim NativeHitachi on Primary
 Translation SafeMode performed in different ways.
 From jumpers to PATA (for HGST) to "closing" NVRAM or special points on the PCB.
 In general, you can just try to power the controller otkruchenny from HDA.
 (Or unscrew the two screws on the side opposite the controller interface and slightly lift it
 toothpick :))

After ZU detect the drive and attack him, the PWG. will signal to Native Hitachi message "NOW YOU CAN SCREW IT IN.PRESS ANY KEY WHEN READY".
 HGST Message "POWER OFF / ON AND EXECUTE ZU AGAIN".
 In the first case, you just need [to the controller in place] neatly back bolts and press any key.
 In the second, turn off the power to fasten the controller to power the HDD and run ZU again with the same
 For IBM / HGST (ExcelStore) supported models from DTLA to HTS7225xxK9SA00 (5K250)