Resurrect a Maximum Security Locked Samsung PM963 SSD

One of the risks of dealing with used market SSD/NVMe drives is encountering units which have been security locked via ATA password by a previous user or storage appliance. Some vendors may have a known master password which you can use to erase the drive, but otherwise you likely have little to no options when it comes to using a high security locked SSD or NVMe. In this case, I had some used Samsung PM963 drives I wanted to use for a project but they had been previously set to the maximum security lock setting with a user password which was unknown to me. I tried several different software options across a few operating systems but they would all produce failures when attempting to wipe the drives. While it didn’t solve my problem initially, I will be using the Parted Magic product to bring these drives back to life after we bypass the ATA security.

A password locked drive will look something like this during the BIOS POST

So, what’s the hard part? You have to open the drive and short out a component on the circuit board. I got the idea to try this after reading a forum thread relating to a different model of Samsung SSD (https://forum.hddguru.com/viewtopic.php?f=10&t=39458) and figured I have nothing to lose since I can’t otherwise use these drives. Since I don’t have the specs or electrical diagrams for the PM963, I basically just guessed at which IC I should try to short out in order to put the drive into ERRORMOD state. You’ll see later on why this is important.

I used a small wire to short out the IC pins from the drive’s ground

The photo above will give you a general idea of what you need to do. I’ve so far had 100% success rate doing this, but be advised that you could easily cause permanent damage to your SSD/NVMe so don’t do this unless you absolutely have to. Here’s the basics:

1. Power on the computer with the drive attached. In my case, I let it sit at the password prompt which came up during the BIOS POST.
2. Take a small wire and touch one end to a ground connection seen circled in the picture.
3. Take the other end of the wire and apply ground to the contacts shown in the picture. I don’t know exactly which one is the one you want, but I’ve been aiming for the second “leg” or pin from the left though I usually end up grounding two or three since they’re so close together. If you listen closely, you should actually hear the drive produce a low volume frequency noise when you do this.
4. Power off the computer, then turn it back on. If you were successful, it will no longer prompt you for the ATA security password.

So, what did we just do? We purposely placed the drive into ERRORMOD state which does a couple of interesting things. One thing it does is outputs a usable drive space of 1GB, but more importantly it also removes all the ATA security. This is where Parted Magic comes into play, but you can probably use most common Linux distributions for this next part anyway assuming they provide the right disk utilities.

Use smartctl to verify our drive is in the “broken” state

When we do a smartctl output of our NVMe drive, it tells us the drive is 1.07GB and you’ll also see the ERRORMOD state noted. Getting to this stage was important as other reading I did (https://forums.servethehome.com/index.php?threads/samsung-sm963-960gb-m-2-to-1gb-issue.21405/) showed that a simple format of an ERRORMOD drive could make it fully usable. Since I was already using Parted Magic for my disk work, I used the NVMe secure format utility it offered:

As you can see, the erase was successful. Prior to this when the drive was in a locked state, every attempt to format it had failed. Now we need to verify that our drive is actually functional, so perform a reboot (or preferably a full power cycle) and get back into Parted Magic or whatever operating system you’re using.

Here is my test to verify that the drive is usable. The computer booted without any password prompt, my NVMe was fully functional and let me create a new partition. The same sort of logic might be applicable to other vendors but so far I’ve only been working on Samsung drives.