3

Context: I have a proprietary Tandberg Data RDX QuickStor Internal USB3 drive bay for PC (item number 8666-RDX) and some storage cartridges for it. Esentially, these are just regular TOSHIBA MK3276GSX 2.5" SATA drives in some fancy housing and the corresponding SATA-to-USB-3.0 adapter bay.

The catch: The SATA Drives are protected with an ATA password and the bay unlocks them when inserted. I cannot use them if i connect them directly to my PC and all of my attempts at triggering an ATA Secure erase or obtaining an OEM master password failed.

My question: Is there a sane way to obtain the ATA password, e.g. by soldering a few wires onto the SATA connector in the drive bay and recording some data with an oscilloscope for later analysis?

I once asked about this on the superuser stack exchange but the answers were limited to software based solutions. I wasn't able to succed with that approach.

Improve this question
11
  • What is the brand of the SATA Drives?
    – pythonpython
    Commented Jan 9, 2021 at 16:50
  • 1
    shackspace.de/2011/04/27/… Might be interesting
    – morsisko
    Commented Jan 9, 2021 at 22:05
  • @pythonpython i updated the question to include that info
    – Brian
    Commented Jan 10, 2021 at 3:53
  • @morsisko That is an awesome resource, thanks! No i've already got a real understanding of how this can look like. Now all that's left is to get access to such a device. Investing in buying a new one sadly would probably not pay off as i'd be cheaper off just buying new drives. Welp.
    – Brian
    Commented Jan 10, 2021 at 4:06
  • 1
    You can get logic analyser for like 5$. I got similar one which can sniff signals up to 24MHz on 8 channels. I don't think the ATA setup is any faster, so you should be fine.
    – morsisko
    Commented Jan 10, 2021 at 14:29

1 Answer 1

Reset to default
2

This tutorial (NB: in Italian) covers recovering ATA passwords from the drive itself. Not for the faint of heart, and drive controller firmware dependent. You might also post on forum.hddguru.com as they seem like SMEs.

Here's another tutorial covering different tools and techniques.

There's plenty of additional information about Tandberg RDX here starting on Page 14 which seems germane:

There are two types of cartridge data protection available:
• Full Disk AES 256 XTS Encryption – All data stored on the cartridge is encrypted
using the XTS-AES 256 encryption standard (recommended).
• Basic Password Protection – Access to the cartridge and 
its data is protected by a single password.
IMPORTANT: When using the Basic Password Protection option, data 
on the cartridge is NOT encrypted and is only protected by a password.

Based on your question I'm assuming these carts are secured with the 2nd type which is implemented as an ATA Password. I assume you've tried the steps on page 24 of the manual to remove this type of protection.

Improve this answer
4
  • Nice, but the question was about sniffing the password on the bus (sent by the enclosure), not extracting the password from the drive.
    – Igor Skochinsky ♦
    Commented Jan 12, 2021 at 23:22
  • From what I've read about ATA Passwords, they are stored on the drive themselves as part of the drive controller firmware. This is separate from the enclosure, otherwise you can just pull the drive mount and read it without the enclosure. In this case the OP wants to use the drives, but they cannot be written to due to the ATA Password on the drive itself.
    – pythonpython
    Commented Jan 12, 2021 at 23:47
  • If the drives are usable by the enclosure it means it’s unlocking them, probably by sending the password on connect. This password could be sniffed without having to mess with the drive firmware.
    – Igor Skochinsky ♦
    Commented Jan 12, 2021 at 23:49
  • "My question: Is there a sane way to obtain the ATA password" For some of us sane is poking at the firmware, for others sane is taking a soldering iron to it. For me a red hot poker near microelectronics isn't my idea of sane :) I probably do stuff which others think is nuts.
    – pythonpython
    Commented Jan 12, 2021 at 23:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.