Extracting and resetting an unknown ATA password
Atola Insight Forensic can recover and/or remove unknown HDD passwords (also known as ATA passwords). For most hard drives the unlocking process is fully automated.
This guide is applicable to all supported Samsung, Toshiba and Western Digital hard drives.
- To unlock a Seagate drive, connect the device to the Serial port of the DiskSense unit and then follow the steps described in this guide.
- Hitachi drives require the use of the password extraction adapter. For more information, see Hitachi HDDs: Remove an unknown password.
Detect an ATA password
When a device is connected and identified as locked with an ATA password, there is a corresponding PWD indicator displayed in the port, and Security Status in the Home page says Locked, High or Locked, Maximum.
High and maximum are password protection levels that the operator who locked the device selected. Although information about it may be relevant to the investigator, both security levels are supported by Insight password recovery functionality, therefore this information is not important for the purpose of this guide.
Source device locked with ATA password
To perform a complete Diagnostics, Insight needs to have a hard drive unlocked. Therefore we suggest that when dealing with a locked device, password recovery is performed before running the Automatic Checkup.
Diagnostics showing password lock
Extract password, Reset password and Reset password until power cycle
There are 3 options of dealing with a locked hard drive:
- To extract and display password without unlocking the device.
- To reset password only until power cycle.
- To permanently unlock the device.
Extract and display password
This option does not require to switch off the write protection on the source port.
To display the password without unlocking the device, do these steps:
- In the sidebar, go to Device Recovery > Password Recovery.
- Click Extract.
Reset password only until power cycle
When you reset password only until power cycle, write protection stays enabled on the source port, and no changes can be made to the drive.
To work with the data on the drive without permanently resetting the password, do the following:
- In the sidebar, go to Device Recovery > Password Recovery.
- Select Reset Password until power cycle.
- Click Reset.
If the Reset Password until power cycle option is selected, no power cycles that are executed in the course of automatic checkup, imaging, or other operations will affect the temporary unlocked status of the device. Only a deliberate power cycle, such as turning off and on the Power switch, will change the Security status of the drive back to Locked.
Permanently reset password
To permanently reset password and unlock the device, do next steps:
- Turn off the Write protection switch on the front panel of the DiskSense hardware unit.
- In the sidebar, go to Device Recovery > Password Recovery.
- Click Reset.
Unknown password recovery
