Inherited Dad's computer stuff

[thrillhouse700]

So my father passed away in September and I finally moved my Mom home. After unpacking all of his stuff I decided to go through all the old HDDs and erased any sensitive info and or toss the old IDE drives. I have gone through almost everything and cleaned up a bunch.

For his main computer he had a password on it and I was able to get in using a list of passwords he had written down that I found. Only problem is I can't access any of the hard drives as none of the passwords work. I don't think he used truecrypt or anything like that. He could have used windows password and or maybe a lockbox type software. I don't want to wipe them clean because he had been working on an ancestry thing for 2+ years. He also has tons of family photos and i am sure a bunch of work stuff on them. Is there any way or software I can use to access them or bypass the passwords?

I am not a hacker or anything close but I am computer savvy. Any bruteforce software I can try that is free? I know this is an odd request but this is a legit issue. If I can get into everything and delete or save what my mom wants to keep then I can reformat and set the computer up for her.

Thanks guys

[stilly]

well you know bruteforce so there ya have it.

I am curious though, what kind of passwords are these? I mean, how do you mean can not access the hard drive? Like, upon bootup? Are these firmware passwords? Like, not even get into windows? Data is data when we talk about photos so why not yank out the HD and cradle it and then look for the photos? You are not telling something here.

[thrillhouse700]

I did yank out the HD and put it in my external dock and it asks for a pw still

I can get into windows just fine.

edit: Sorry I can get into the drive but there are two files, one is just back ups, the other is a file folder with a lock next to it, under properties it shows 0 bytes so maybe it is encrypted. It might be for his work, maybe. I just feel bad erasing everything if there are old pics of the family or something even more important.

[bruss01]

well you know bruteforce so there ya have it.

I am curious though, what kind of passwords are these? I mean, how do you mean can not access the hard drive? Like, upon bootup? Are these firmware passwords? Like, not even get into windows? Data is data when we talk about photos so why not yank out the HD and cradle it and then look for the photos? You are not telling something here.

It sounds to me like the OP's father's computer has multiple hard disks.

the C: disk containing the OS boots up fine... one or more of the additional drives is locked down with bitlocker or truecrypt or some other safeguard.

This can be a legitimate safeguard for financial data and other info you would not want unauthorized persons accessing. Beware though. If dear old dad had a porn stash, and one of those "models" who looks 21 happened to be 16 when the photo was taken, that's a potential Pandora's box.

I don't have access to decryption software and can't make a recommendation. I hope you find what you're looking for.

[meaty-btz]

sounds like a hardware password. You can set them on HDDs. The manufacturer has a backdoor, but...

[thrillhouse700]

It sounds to me like the OP's father's computer has multiple hard disks.

the C: disk containing the OS boots up fine... one or more of the additional drives is locked down with bitlocker or truecrypt or some other safeguard.

This can be a legitimate safeguard for financial data and other info you would not want unauthorized persons accessing. Beware though. If dear old dad had a porn stash, and one of those "models" who looks 21 happened to be 16 when the photo was taken, that's a potential Pandora's box.

I don't have access to decryption software and can't make a recommendation. I hope you find what you're looking for.

Didn't even think about that! haha I haven't found any porn on any of his 4 computers though.

[stilly]

I did yank out the HD and put it in my external dock and it asks for a pw still

I can get into windows just fine.

edit: Sorry I can get into the drive but there are two files, one is just back ups, the other is a file folder with a lock next to it, under properties it shows 0 bytes so maybe it is encrypted. It might be for his work, maybe. I just feel bad erasing everything if there are old pics of the family or something even more important.

THAT sounds like a firmware pw to me. BUT what do I know? What brand and model of HD are they? If it is asking for a PW THAT way then maybe we can obtain a HW list of PW to use.

Sounds like I might have to bust out my russian scripts again; I aint had to use them since '08.

Perhaps the HD can be duplicated via replicator and then the new drive can be one that does not support FW PW and that could be a weakness? MAYBE? Prolly not but still worth a try. (if it is a FW PW though then the drive might not be able to be duplicated at all cause it will not be read).

I have only seen this on a laptop drive that was a sata 2.5" so far. I was not aware that 3.5" drives also had it, but I suppose they exist now.

The long answer here is to find out the software that has locked that folder, then try to gain access via passwords that way. Gawd what a pita. AND it sucks to just toss it. Now I want to have a crack at it. OPHCRACK comes to mind, but I know not why or what it does...


BTW, maybe the passwords might be backwards. Sometimes folks do that... He would have known because it was HIS system. Just for kicks though I would have stored a master list in a safe...

WORST case call NSA, I am sure they can provide you with whatever information you need.

[stilly]

sounds like a hardware password. You can set them on HDDs. The manufacturer has a backdoor, but...

No butts! We are here to break in! Put it on the table!


Does it give a challenge code? I got my russian scripts ready...

[thrillhouse700]

Yeah right now I am on my desktop so I would need to hook his desktop back up and take a look at the program used. I will do it when I get home from work. I think it was some sort of file cabinet program.

I have trucrypt on my rig and it kind of acts like that when I open the locked file. You open it and it is empty but shows 300 gb used.

[stilly]

yeah. They make CONTAINER folders that give no indication of size unless you REALLY look around to find it out sometimes... I think I used trucrypt once. I was like, DAMN if anything breaks I am screwed. and THAT was the last time I used trucrypt... lasted for one week at work.

HOWEVER, using a GOOD encryption program is prolly a good way to defeat hack attempts and break in attempts. A better way is to use the FW option that wipes the entire drive after 3 failed attempts. Man I lucked out in that that drive that I came across did not have that option turned on, although it WAS in the menu, just not selected... LoL. gogo toshiba sattellite...

[thrillhouse700]

ok so I hooked it all up and he has kaspersky password manager that I can not get into. I feel if I can get into that I will have access to everything. I tried all of his passwords he has written down on paper. I asked my mom if she knew of any passwords she said nope. I was thinking of contacting kaspersky and explaining the situation and sending a copy of the death certificate maybe they will send me a password?

[the86d]

Could it be that the dock cannot access drives that large?

Can you throw it on a SATA or IDE cable and boot to a Knoppix DVD and see the data?

[The Mongolian]

Hmmm, I would wonder if he would be able to hook it up to his computer as a slave drive and just surf the files?

[LAmike]

Yeah, try hooking up the drive as a slave drive to see if you can read anything on it. However, if you don't think you need anything off the drive but still want to make sure it isn't hacked by anyone else, then physically take it apart and remove the silver platters from the inside. Destroy as needed.

[stilly]

Could it be that the dock cannot access drives that large?

Can you throw it on a SATA or IDE cable and boot to a Knoppix DVD and see the data?

0o0o0o that is SEXY talk.

http://support.kaspersky.com/5712

You might just need to start brute forcing passwords.