Extracting and resetting an unknown ATA password

Atola Insight Forensic can recover and/or remove unknown HDD passwords (also known as ATA passwords). For most hard drives the unlocking process is fully automated.

This guide is applicable to all supported Samsung, Toshiba and Western Digital hard drives.

Detect an ATA password

When a device is connected and identified as locked with an ATA password, there is a corresponding PWD indicator displayed in the port, and Security Status in the Home page says Locked, High or Locked, Maximum.

High and maximum are password protection levels that the operator who locked the device selected. Although information about it may be relevant to the investigator, both security levels are supported by Insight password recovery functionality, therefore this information is not important for the purpose of this guide.

    Source device locked with ATA password

Source device locked with ATA password

To perform a complete Diagnostics, Insight needs to have a hard drive unlocked. Therefore we suggest that when dealing with a locked device, password recovery is performed before running the Automatic Checkup.

    Diagnostics showing password lock

Diagnostics showing password lock

Extract password, Reset password and Reset password until power cycle

There are 3 options of dealing with a locked hard drive:

  • To extract and display password without unlocking the device.
  • To reset password only until power cycle.
  • To permanently unlock the device.

Extract and display password

This option does not require to switch off the write protection on the source port.

To display the password without unlocking the device, do these steps:

  1. In the sidebar, go to Device Recovery > Password Recovery.
  2. Click Extract.

Reset password only until power cycle

When you reset password only until power cycle, write protection stays enabled on the source port, and no changes can be made to the drive.

To work with the data on the drive without permanently resetting the password, do the following:

  1. In the sidebar, go to Device Recovery > Password Recovery.
  2. Select Reset Password until power cycle.
  3. Click Reset.

If the Reset Password until power cycle option is selected, no power cycles that are executed in the course of automatic checkup, imaging, or other operations will affect the temporary unlocked status of the device. Only a deliberate power cycle, such as turning off and on the Power switch, will change the Security status of the drive back to Locked.

Permanently reset password

To permanently reset password and unlock the device, do next steps:

  1. Turn off the Write protection switch on the front panel of the DiskSense hardware unit.
  2. In the sidebar, go to Device Recovery > Password Recovery.
  3. Click Reset.

      Unknown password recovery

Unknown password recovery

Back to Manual start page