Start a Conversation

Unsolved

This post is more than 5 years old

1619

June 8th, 2017 18:00

Seagate Momentus FDE.1 in a Dell Latitude D830 - Crypto-Erase fail, and then some!

I have a Dell Latitude D830 I bought brand new many years ago that I use for some odds 'n ends.  I also have a newer Dell Latitude E7470 and a Lenovo ThinkPad T470p that I use for business since security is of the utmost importance for the line of work I'm in.  That said, the D830 was my first business laptop I bought in graduate school, and honestly still has some decent security features well equipped for just daily tasks and securing the device.  Plus, I still enjoy tinkering around on it.

Anyways, onto my problem.  The D830 has a Seagate Momentus FDE.1 320 GB 7,200 RPM hard drive in it (model # ST9320424ASG).  It is not Opal or Opal 2 SSC; rather, it's Drive Trust, which is Seagate's older security API.  Anyways the drive has been initialized with Wave Embassy Security Center for quite some time, with pre-boot authentication and it always worked very well.  I have many, many self-encrypting drives that are significantly newer and "better," but the FDE.1 is preferred since it's a full 2.5" (thin drives can wobble in the case), and Wave Embassy treats it as a Trusted Drive.

The problem occurred a few weeks ago when I had to restore a backup due to driver errors on my laptop.  I uninitialized the drive before I restored the backup and it showed the FDE.1 and being uninitialized.  However, after the backup was complete, it showed the drive was initialized.  No big deal since I have my username and password, I figured.  Wrong.  Now I get an error telling me that either the username or password is incorrect, and neither of them are incorrect.  I even have Wave's backup file that shows my username, SID, password, Trusted Drive model, etc. and everything is spot on, but I cannot access the console to remove the Drive Trust security.

Mind you the hard drive is completely open and only shows as initialized.  There's no PBA so I'm not locked out of the drive, and it works as it always has, I just can't uninitialized it and remove Drive Trust's security and nothing I've tried has worked.

On Opal 1 and Opal 2 self-encrypting drives, a simple PSID revert would fix this issue in a few seconds but therein lies my other problem.  The SID printed on the top of the drive (not PSID, but SID, which is the master password to the drive, basically) never yields any results when trying to crypto-erase the unit in order to regenerate a new encryption key and return the drive back to default per the Seagate manual's instructions.  I've tried Linux, SeaTools, SeaTools for DOS, SeaTools for EFI boot and even the BIOS options in my newer laptops that allow you to secure erase a SSD right from the BIOS, as well as crypto-erase a self-encrypting drive.  SeaTools does not even recognize it as a self-encrypting drive, but the security features in the BIOS on my newer hardware does.  Unfortunately despite that, it's never able to do a crypto-erase and that's because its unable to set a user password to do it.  And on that, I am unable to set a hard drive user password for it, too.  In my Dell machines I will get a message "That password is unacceptable."  Even sudo hdparm in Linux can't do it, so I know I have to uninitialized Drive Trust but am at a loss here.  The SID, or hard drive master password, has NEVER been changed.  It's never even had an ATA user password set, so I know the SID is correct but for some reason, it's not recognized even by Seagate's own tools.

Wave is basically no more of a company, so the messages I sent them never yielded any responses.  All Google info I find about this sort of thing revolves around people being locked OUT of the drive, but I am not locked out of the drive.  It's initialized but nothing more.  No security features like locking are enabled, but I have no idea how the drive initialized itself by simply restoring a backup and especially when it was uninitialized before I deployed the backup.

I mean these drives are not expensive but really it'd be nice if I could salvage this because it does not have many hours on it and works perfectly (minus the enabled security).

Anyone have any ideas?  I've felt as if I've exhausted every avenue but it seems like somehow either my username or password were "changed" somehow after the restore.  Oh and going back to the point before I restored it did nothing, either.  Wave's latest version of their software will not install because it says the drive has been initialized with another version of their software and needs uninitialized before it can be installed, and even WinMagic SecureDoc will not install because it detects the drive has been initialized.  I'm just confused as to why it doesn't even show up as a FDE/SED and why crypto-erase will not work.

Sorry for the lengthy; any advice would be appreciated.

2 Posts

June 10th, 2017 12:00

I ended up removing the Drive Trust security in a way that would probably be frowned upon if detailed here, but in short I was able to output the raw encrypted data and locate the DEK blob and dump it.

It's unreal no one on all of Google seems to have had this issue.

No Events found!

Top