Introduction: Unlock Hard Drive From an Old BT Vision Box

A couple of years ago I cancelled my subscription to BT Vision. Since then the box has been gathering dust in my shed. I started putting together a server for my Xboxes running XBMC and was hunting for a suitable hard drive for the operating system when I came across the BT Vision box. I opened it up and found a 160gb sata hard drive. Ideal!

I first realised this wasn't going to be straightforward when I tried to install an operating system. Linux reported errors writing the partitions. A quick Google search found that BT Vision box hard drives are locked. Bugger! After a bit of research I managed to unlock the drive and install a operating system on it.

This instructable shows how I managed this and hopefully it will be of use to others in the same position.

What you will need:
~BT Vision box (Black version, the older silver/white ones have an IDE hard drive).
~Torx screwdriver (T10).
~Torx security screwdriver (or vise grips).
~Windows PC or laptop (I used Windows 7).
~PC and cables to connect the sata drive.
~USB pen drive (1 Mb is fine)

Step 1: Liberate the Drive

First thing is to get the hard drive out of the BT Vision box. There are three T10 torx screws on the back, some times these are security screws with a post in the middle, that need to be removed. This lets you lift off the top cover. If you don't have a security torx bit, you can get a hold of the screw head with a pair of vice grips and unscrew it. Unplug the connector from the back of the drive and remove the 4 screws that hold it in. Lift out your 160 gig drive.

If you are like me and like collecting bits and bobs for future project, there are also some other goodies in the box. The power supply gives 5 and 12 volt outputs. There is a small 12v fan and some buttons soldered to the front panel under the black plastic cover.

Step 2: Download the Software.

Next you need to download two pieces of software.

HDAT2
This is the software that will be used to unlock and erase the drive
Download from www.hdat2.com select the download link at the left of the page and scroll down to the SINGLE PROGRAMS section and download the HDAT2.EXE for usb dos boot.

Note: You could create a CD image and boot directly from the CD. I didn't use this method but it should be straight forward.

RUFUS
is used to create a dos bootable usb drive.
Download from http://rufus.akeo.ie.

Step 3: Prepare the USB Pen Drive

*Insert the USB pen drive
Note the drive letter Windows assigns to it by checking in MY COMPUTER

*Start Rufus
You don't need to install Rufus it runs straight from the downloaded exe.

*Format the USB drive as a free dos boot
Make sure the correct drive is selected, and use the default settings, hit START and in a few seconds it's done.

*Create a folder on the USB drive and call it "HDAT2"

*Copy the the HDAT2.EXE file that you downloaded into this folder

Step 4: Connect the New Hard Drive to Your PC and Boot From the USB Pen Drive

Shutdown your PC, remove the cover and install the BT Vision hard drive. I recommend that you disconnect the existing hard drives so you don't accidentally erase the wrong drive.

Note : Before touching static sensitive components inside the case, discharge youself of static by touching the metal case of the PC.

Insert the USB drive you prepared in the previous step. Switch on the PC and it should boot to the dos prompt. If not, you need to change the boot order in the BIOS of the PC.

To run HDAT2 we first change to the HDAT2 directory and run the EXE file.

Step 5: Using HDAT2 to Unlock and Erase the Drive.

The first screen shows the attached storage devices. Item 1 that has the red exclamation mark next to it is the locked drive. Highlight the locked drive with the arrow keys and press enter

From the next menu select the Security menu

Choose Erase Unit. The identifier is user. Press P to enter the password :"PACE FRANCE Master Security PWD2" then enter. The password is case sensitive

Next press I to change the identifier to Master, then S to start the erase. Answer Y to the prompt asking if you are sure you want to run Erase Unit

Almost done, you just need to let it erase the drive.

Step 6:

Last thing is to partition and format the drive using the operating system of you choice.

The next thing I want to do is get a hold of a BT Vision plus box, which has a 500 Gb drive, to see if the same procedure will work.

Would appreciate any feed back, be kind this is my first instructable.

Comments

author
ChristopherP136 made it!(author)2016-05-18

im trying to unlock a youview box hdd i downloaded your tool and everything work but that password for the hdd even matched the hex key no luck just says command aborted in red im presuming because its not the right password could anyone help thanks

author
PaulH453 made it!(author)2017-07-12

I had the same problem and then I realised I'd missed the press I to set it to master when I did that it worked like a charm

author
atweedlie made it!(author)2016-05-18

I had a quick Google about. From what I've read I'm guessing that the drive isn't password protected. It will be formatted with a Linux filesystem. Did you try plugging and trying to format it from your normal operating system? Let us know how you get on.

author
Steaminson made it!(author)2017-06-09

Great Instructable

Running the erase so hopefully in 2 hours or so I will be able to reuse the 500Gb drive from my BT box

Much Thanks

Steaminson

author
Sparkgap made it!(author)2017-04-23

Many thanks for this instructable, I have liberated two 160Gb and one 500Gb hard disks from redundant BT vision boxes including ones I picked up from ebay for a few £s. I intend to try and use a couple of them in a RAID mirroring array in my elderly desktop PC. One area where I had a problem was that I had to enable USB legacy support in BIOS before my old PC would boot from the USB stick. Other than that It was exactly as you described.

Again many thanks, Sparkgap.

author
divenal made it!(author)2017-01-27

Thanks for this info. FYI was able to use this information to unlock a disk from linux using the standard 'hdparm' command.

hdparm -I /dev/sdb

hdparm --security-erase 'PWD' /dev/sdb

hdparm --security--unlock 'PWD' /dev/sdb

hdparm --security--disable 'PWD' /dev/sdb

Where PWD is the PACE one you gave. (It seems there is also a 'master' password set by the manufacturer, which could possibly override PACE's user one. Didn't try that approach, though.)

author
atweedlie made it!(author)2017-01-27

I never even thought of doing this with Linux! That would be so much easier. I'm definitely going to try it when I get some time. Thanks for the info.

author
divenal made it!(author)2017-01-28

One thing I forgot to mention was that after I came back after leaving it to do the erase, there was a kernel backtrace - I think it was complaining that the ata command had taken longer than 120s to complete, which I guess it hadn't been told to expect. But it appeared to have worked.

author
divenal made it!(author)2017-01-28

https://tinyapps.org/docs/wipe_drives_hdparm.html suggests I might have been using an old version of hdparm which caused the timeout, and may only have partially erased. (Not that I care in this instance.)

author
atweedlie made it!(author)2017-03-03

I finally got round to trying this with linux. My first attempt was with a SATA to USB adaptor on my laptop. This was unsuccessful as the USB adaptor wasn't passing the security commands to the SATA drive.

On my second attempt I plugged the drive into the motherboard SATA on an old dell running Lubuntu and it worked first time, no problems. The commands I used were:

sudo hdparm -I /dev/sdb

sudo hdparm --user-master m --security-erase "PACE FRANCE Master Security PWD2" /dev/sdb

sudo hdparm --user-master m --security-unlock "PACE FRANCE Master Security PWD2" /dev/sdb

sudo hdparm --user-master m --security-disable "PACE FRANCE Master Security PWD2" /dev/sdb

Thanks for the linux suggestion!

author
ChrisP406 made it!(author)2016-11-15

excellent guide first class but what i would say is do not rush and follow the guide step by step and look at the pictures carefully especially steps 4 and 5... its great when things work thank you

hqdefault.jpg
author
papajulietdelta made it!(author)2016-10-27

Brilliant instructions!! Spot on!

I liberated a 500gb Western Digital Drive.

You did not mention how long it would take to erase the drive. HDAT2 indicated 120 min. It actually took 3 hours 10 mins!! I was about to give up as the program does not show any progress, just the elapsed time.

Cheers

author
atweedlie made it!(author)2016-10-27

Glad it worked for you.

author
chuckychuck made it!(author)2016-06-17

re re-using old BT box hard drive -

A friend tried all methods here to no avail BUT says he finally connected the BT drive via usb using one of those converters that allows you to connect any old hard drive (SATA / IDE) via USB ... and HEY PRESTO . No problems at all. Formatted away all the BT garbage & now has a useful 160Gb western digital hard drive.

Would be interested if anyone else succeeds this way. No idea why this would work when nothing else did.

author
MarkR227 made it!(author)2016-05-02

Hiya, I downloaded everything and put it into a folder, but i try to run the .exe and it says: 'This program cannot be run in DOS mode.' I formatted the usb drive using rufus, and it is a SANDISK Cruzer Facet (8GB). Help?

:(

author
atweedlie made it!(author)2016-05-02

Sounds like you might not have the DOS version of the .exe

author
SimonB98 made it!(author)2016-04-02

I have done this exactly how it says but there is no option to erase, there is only set password and Freeze lock have I done something different

author
atweedlie made it!(author)2016-04-03

Have you selected the correct hard drive from the first screen (device list)? Also make sure it is connected to the motherboard with a sata cable and not using a usb adaptor. Hope this helps.

author
SimonB98 made it!(author)2016-04-03

Hi yes its connected with sata cable and I have selected the correct hard drive but there is no option to wipe it

author
atweedlie made it!(author)2016-04-03

Sorry Simon, I'm not sure how to help you. I've never seen this issue.

author
oddjobkia made it!(author)2015-08-24

Hi..I have the 500gb version here and was wondering if I could use it as a second portable hard drive.. It is a Seagate Pipeline Hd.2 My Question is how you connected it it via USB. I have the same red data cable as in your photo. Is i just a ploy to stop you trying to hack it? I know usb have Positive, Negative and two data terminals and thats it. I belive it is a sata connection Is there an adaptor ?

author
atweedlie made it!(author)2016-03-17

You can't connect it by usb, you have to use sata.

author
shabbla made it!(author)2016-03-17

I made an account here just to thank you for such an excellent guide. My drive is unlocking as we speak but looks as though it'll take a couple of hours.

That HDAT2 software is a godsend, but your guide made the process completely painless.

Big thanks!

author
atweedlie made it!(author)2016-03-17

Thanks shabbla, it's good to know my guide has helped a few people.

author
markawes made it!(author)2016-02-18

I get stuck on the part where I have to put the USB into the computer because it tells me that there is no bootable device - any suggestions?

author
KierenD1 made it!(author)2015-12-30

BRILL, SEEMS TO HAVE WORKED FIRST TIME! ON MY BT VISION BOX WITH A 500GB DRIVE

author
ultimateOne made it!(author)2015-09-23

Thank you for the comprehensive guide

author
hammy434 made it!(author)2015-08-18

thanks for writing this, it worked 100% :D

author
CrashO1 made it!(author)2015-03-01

I ve the same problem, i ve also a STB from Telenet (Belgium) with an Sata 320 Gb HDD from Seagate pipline. Those hdds are also locked with a master password.

Will this help for my HDD cuss i wonder if your password (PACE FRANCE Master Security PWD2) isnt related to the setupbox you have or the installed HDD init

author
atweedlie made it!(author)2015-03-02

The master password is set by the STB manufacturer. The password would indicate that they were made by Pace although the box isn't branded as a Pace box.

The procedure should work with any locked hard drive as long as you have the correct password. It would be worth a go to see if the password worked.

author
CodeR2 made it!(author)2015-01-27

Excellent instructable , thankyou for the solution.

author
andybodiam made it!(author)2014-07-08

Hi all, I can confirm that this works with the 500GB WD Green drive. Many thanks for all the info

author
error323 made it!(author)2014-06-03

Hi my name is Greg and i going to check your way on HDD WD 500gb removed from new BT Vision plus box. I let you know if its working on half terra HDD. Wish me luck.

Regards Greg

author
atweedlie made it!(author)2014-06-04

Good luck Greg, let's us know how you get on.

author
error323 made it!(author)2014-06-04

Hello again ;). I must say after yesterday "struggling" with my PC finally i become lucky owner HDD WD 500GB ... Everything worked perfectly nice and smooth as you said. No complications at all :D.
All process wiping HDD take around 2hours. I have to say your guide was very accurate and gentle everything explained nice and clear plus supportive pictures ;). Thank you very much indeed!!
I must also say i found in home SKY box which i don't use anymore as they don't covering area in new place where i moved recently, so i opened that one too. Liberation that hdd was much more complicated as sky put a lot effort to make hdd latest part to unscrew from all box :D but.... They not protect HDD by locking it with password and use better quality hard drive because that what i found inside is 500 GB HDD SAGATE which as far i know is the best company producing Hard Drives... so if you have any around go for it :D
One more time thank you much now i have 2 HDD 500 GB each .. for free :D:D:D!!!!! JIIIIIIIIIIIHHHHHHAAAAAAA
Best regards
GREG ;)

author
atweedlie made it!(author)2014-06-04

Thanks for the feedback! :-)

author
atweedlie made it!(author)2014-05-04

Once you are in the hdat2 directory and you type "dir" and it lists the exe file as HDAT2_~1 EXE you should enter "HDAT2_~1". Check the screen shot I added to the previous step.

author
cyeates1 made it!(author)2014-05-04

Thank you for the added screen shot. Instead of the hadt2 43 something or other. I used the hdat2 50 exe as shown on your screen shot. It worked and I'm the erasing stage. Wonder if the 50 works better with windows 7 ultimate. Many thanks for your help.

author
cyeates1 made it!(author)2014-05-03

I'm stuck here. The first screen isn't like the one above. I get the dos command (i.e. c:\> I don't none of these types of commands so I went to that gives command prompts such as c:> dir [c:] I just get file not found. I've followed the previous instructions, but to no avail. Please can anyone help me get past this bit. Many thanks

author
atweedlie made it!(author)2014-05-03

At the DOS command prompt type "dir", this will display the contents of the current directory. there should be a folder called HDAT2. Type "cd HDAT2", this will change your current directory to HDAT2. Enter "dir" again and there should be a file ending in ".exe" enter the name of this file (can't remember the exact name off the top of my head, think it should be "HDAT2.exe"). Note DOS isn't case sensitive.

author
cyeates1 made it!(author)2014-05-04

Still no joy. I can get to the hdat2 directory. I can see HDAT2_~1 EXE When I type dir hdat2.exe what I get is

volume in drive c is kingston (this is the name of my usb stick)

volume serial number is BCA7-4EE8

FILE NOT FOUND

Can't get no further. Please help...

author
atweedlie made it!(author)2014-05-04

I added screen shot of the above.

author
AK47UK made it!(author)2014-04-17

I was stuck here but thanks to the user who commented on the next page I managed to do it. The password should actually be: "PACE FRANCE Master Security PWD2". Thanks for the guide.

author
atweedlie made it!(author)2014-05-04

I fixed the typo, sorry.

author
dadd10 made it!(author)2014-04-05

Hi

Can you change the password to "PACE FRANCE Master Security PWD2" I spent hours searching the web before I zoomed in on your image and realised you had made a typo ( couldn't have been in a worse place :) ) all sorted now thanks to yourself and by the way it worked on the 500gb drive I have.

Many thanks

author
atweedlie made it!(author)2014-05-04

Great to know it works on the 500gb drive, thanks for the feed back.

author
cyeates1 made it!(author)2014-03-19

The HDAT2.EXE software won't on my 64bit version of win7. Do you have other suggestions please?

author
atweedlie made it!(author)2014-03-19

Don't think HDAT2 will run on windows. You will need to make a boot disk or pen drive with Rufous and boot to DOS.

author
atweedlie made it!(author)2014-01-21

If you want to access the files already on the drive you would have to let the vision box boot with the drive in it and hot swap it to your PC. Not sure if the files are encrypted.

author
f1dd13r made it!(author)2014-01-20

Now that is useful, I have a 160GB HD sitting on my shelf from our old box.....

If I unlock it, is there any way to read any of the old files before clearing it I wonder?

I remember reading somewhere that they are encrypted....