Search
Enter Keywords:
Home
Recover a Lost Lexar JumpDrive Secure 1.0 Password PDF Print E-mail
User Rating: / 9
PoorBest 
Written by Michael Salsbury   
Friday, 12 May 2006

A while ago, my wife gave me a Lexar JumpDrive Secure 1.0 512MB USB Flash Memory Drive.  This drive had been given to her by someone else, who had apparently configured it so that about half the drive's storage was in the "secure" zone.

I didn't realize this until the drive had become full.  I noticed that Windows XP saw it as a 256MB FAT32 drive instead of a 512MB drive.  I had wiped the drive when I received it, so I lost the original software.  A visit to Lexar's site got me the "SafeGuard" software Lexar originally shipped with the drive.  I tried to use this to reset the drive but it did not work without the original password used to set up the drive.

Below are pictures of the front and back of the JumpDrive Secure 1.0:

Image

Image

The device in question has a part number of JDS512-04-500C in the 512MB model. Theoretically other models in the same line should unlock this same way.

I did some searches online and found articles from 2004 indicating that it was POSSIBLE to read the password in cleartext from the SafeGuard software while it was running in memory, so I decided to give it a shot.  I figured I had little to lose.  After some time, I figured out what to do. Unfortunately, all of the articles online were very vague as to the precise details.  I would need to discover those myself.

First, I found the program WinHex 12.9 SR-12 by Stefan Fleischmann on the web.  This program is a free download for evaluation purposes.  I installed it.  Then I went to the Tools menu and selected "Open RAM'.  I then chose the "SafeGuard" process.  I went back to SafeGuard and entered a password that was unlikely to appear in the program's memory (e.g., "mes123").  I got an error indicating that this was the wrong password.

I clicked the "find" icon (binoculars) on the toolbar.  I asked the program to search SafeGuard's memory for the "mes123" password I'd just typed in.  It found that password near the phrase "The password reminder is" in memory.  A few bytes after that, I saw the word "test" sitting all by itself among a bunch of blanks. 

I went back to SafeGuard and entered "test" as the password.  The drive unlocked immediately.  I had found it.


This leads to a simple process for you to identify a forgotten password to a Lexar JumpDrive Secure 1.0:

  1. Install the SafeGuard software from Lexar's web site.

  2. Install the WinHex evaluation version from http://www.x-ways.net/winhex/index-m.html
    (When prompted, select "Forensics" mode during installation.)

  3. Launch SafeGuard and type in any password so that you get a password error. Make it something odd and easy to remember, like "mes123". You'll need this "bad" password later.

  4. Launch WinHex.

  5. Under Tools, choose Open RAM.
    WinHex Tools Menu

  6. Select the SafeGuard process from the list.
    Selecting SafeGuard in WinHex

  7. Select "Entire Memory".
    Selecting Entire Memory in WinHex

  8. Dismiss the warning about only being able to view memory.
    Nag Message in WinHex

  9. WinHex will display the memory used by SafeGuard.
    WinHex Displays SafeGuard Memory

  10. Click the "Find" (binocular) icon in the WinHex toolbar.
    Use WinHex to Find SafeGuard Password

  11. Enter the password you typed in back in step 3 ("mes123" in this example) as the text to find and click "OK".

  12. A short distance below where the password is found you should see, in plain text, the password used to lock the drive originally (in this example, "test").
    SafeGuard Password Found in RAM!

  13. Go back to SafeGuard and try the password.  If it doesn't work, go back and take a closer look in WinHex to find the password.
    Enter the SafeGuard Password

Hope this helps you if you should lose your JumpDrive Secure's password.

Note: I don't have one of the newer JumpDrive Secure II drives to determine if this password retrieval technique will work on the newer JumpDrive Secure models.  Since they appear to use different software from this older model, my guess would be that the technique won't work, or that it will at the very least require research on your part to locate the correct area of memory where the password exists in plaintext. 


 


Last Updated ( Monday, 22 May 2006 )
< Previous   Next >

Main Menu
Home
Blog
Photos
Links
Search
Site Index
Feedback
Administrator
Featured Links
BlogInspiration
SpamToons
Shawn Prince's Blog
Jack Ludwig's Blog
Mike Cramer's Site
Fark
Slashdot
Woot!
Cigar Envy
John Kricfalusi's Blog
CigarBlog 101
Cigars 101 Forum
Sponsored Links


View Site Stats