|
A while ago, my wife gave me a Lexar JumpDrive Secure 1.0 512MB USB Flash Memory Drive. This drive had been given to her by someone else, who had apparently configured it so that about half the drive's storage was in the "secure" zone. I didn't realize this until the drive had become full. I noticed that Windows XP saw it as a 256MB FAT32 drive instead of a 512MB drive. I had wiped the drive when I received it, so I lost the original software. A visit to Lexar's site got me the "SafeGuard" software Lexar originally shipped with the drive. I tried to use this to reset the drive but it did not work without the original password used to set up the drive. Below are pictures of the front and back of the JumpDrive Secure 1.0: 

The device in question has a part number of JDS512-04-500C in the 512MB model. Theoretically other models in the same line should unlock this same way.
I did some searches online and found articles from 2004 indicating that it was POSSIBLE to read the password in cleartext from the SafeGuard software while it was running in memory, so I decided to give it a shot. I figured I had little to lose. After some time, I figured out what to do. Unfortunately, all of the articles online were very vague as to the precise details. I would need to discover those myself.
First, I found the program WinHex 12.9 SR-12 by Stefan Fleischmann on the web. This program is a free download for evaluation purposes. I installed it. Then I went to the Tools menu and selected "Open RAM'. I then chose the "SafeGuard" process. I went back to SafeGuard and entered a password that was unlikely to appear in the program's memory (e.g., "mes123"). I got an error indicating that this was the wrong password. I clicked the "find" icon (binoculars) on the toolbar. I asked the program to search SafeGuard's memory for the "mes123" password I'd just typed in. It found that password near the phrase "The password reminder is" in memory. A few bytes after that, I saw the word "test" sitting all by itself among a bunch of blanks. I went back to SafeGuard and entered "test" as the password. The drive unlocked immediately. I had found it.
This leads to a simple process for you to identify a forgotten password to a Lexar JumpDrive Secure 1.0: - Install the SafeGuard software from Lexar's web site.
- Install the WinHex evaluation version from http://www.x-ways.net/winhex/index-m.html
(When prompted, select "Forensics" mode during installation.)
- Launch SafeGuard and type in any password so that you get a password error. Make it something odd and easy to remember, like "mes123". You'll need this "bad" password later.
- Launch WinHex.
- Under Tools, choose Open RAM.

- Select the SafeGuard process from the list.

- Select "Entire Memory".

- Dismiss the warning about only being able to view memory.

- WinHex will display the memory used by SafeGuard.

- Click the "Find" (binocular) icon in the WinHex toolbar.

- Enter the password you typed in back in step 3 ("mes123" in this example) as the text to find and click "OK".
- A short distance below where the password is found you should see, in plain text, the password used to lock the drive originally (in this example, "test").

- Go back to SafeGuard and try the password. If it doesn't work, go back and take a closer look in WinHex to find the password.

Hope this helps you if you should lose your JumpDrive Secure's password. Note:
I don't have one of the newer JumpDrive Secure II drives to determine if this
password retrieval technique will work on the newer JumpDrive Secure
models. Since they appear to use different software from this older
model, my guess would be that the technique won't work, or that it will
at the very least require research on your part to locate the correct
area of memory where the password exists in plaintext.
|