PS3:Recovering Data

If something happens to your PS3 that leaves you unable to access files on the system storage, you may still be able to recover important files if you have previously dumped your per-console hard-drive encryption key (eid_root_key).

Please note, these tools allow for read-only access, you cannot use this to write files to the PS3s system storage.

Dumping the eid_root_key

Rebug Firmwares

1. Open Rebug Toolbox under "Game" on the XMB.
   • If you do not have rebug toolbox installed, the installer should already be on your console at dev_rebug/rebug/packages, where you can install it via "Package Manager > Install Package Files > PS3 System Storage".
   • If rebug toolbox is not downloaded, you can get the latest version [here] (automatic download).
2. Navigate to the "Utilities" category, scroll down to and select "Dump eid root key".
3. A popup will inform you that the eid_root_key will be created in "dev_hdd0/game/RBGTLBOX2/USRDIR", select "Yes".
4. The PS3 will reboot and beep.
5. Navigate to the location Rebug Toolbox informed you with either your choice of homebrew, or FTP program, copying over the "eid_root_key" file to a flash drive or your computer.

Evilnat 4.88.2

This feature was added in Evilnat 4.88.2, it will not be available in 4.88.1 or lower.

1. From the top of the "Network" column on the XMB, select "Custom Firmware Tools".
2. Navigate to and select the "Dump Tools" category.
3. Navigate to and select "Dump ERK".
4. Navigate to either /dev_usb/ or /dev_hdd0/tmp/ and copy the eid_root_key to a safe place such as your PC.

(Method 1) Reading the PS3 HDD on Windows

Whenever you plug the PS3s system drive into a PC, be careful to never format or initialize the drive, doing so will permanently erase your data.

1. Plug the SATA and power cable from your PC into the PS3's HDD.
2. Turn your PC on, and if prompted, select "No" to initialising or formatting the drive.
3. Download PS3_HDD_Reader by 3141card from here, extract the folder once complete.
4. Paste your eid_root_key into the "PS3_HDD_Reader_final_windows" folder
   • The readme.txt in the download will have the same or similar instructions to the below.
5. Navigate to the "PS3_HDD_Reader_final_windows" folder previously extracted, and where the directory is displayed (to the right of the search bar), right click and select "Copy address as text"
6. Press Start, search for "cmd", right click Command Prompt and select Run as Administrator.
7. Enter the command C:\...\ps3_hdd_reader.exe hdd (with ... being the path to the folder you extracted) and a list of partitions will be listed. Alternatively, if you have a dump of a PS3 HDD, name it backup.bin and use the command C:\...\ps3.exe file.
   • If you copied the "PS3_HDD_Reader_final_windows" folder to a drive other than C:\, you may have to enter "[drive letter]:" and press enter. (e.g. "C:\WINDOWS\system32>D:")
8. In the command prompt window, enter ps3_hdd_reader.exe hdd. This will display all available partitions on the PS3's HDD, and will indicate that everything is working okay.
9. Again in the command prompt window, you can begin copying and viewing the files you want through commands such as:
   • ps3_hdd_reader.exe hdd dev_hdd0 dir / to view the main partitions file structure
   • ps3_hdd_reader.exe hdd dev_hdd0 copy /PS3ISO to copy all files inside the "PS3ISO" directory
   • It's not recommended to copy large directories such as "/GAMES/" due to potential storage space issues, instead copy "/GAMES/[gameName]".
10. Once you have copied all your important data, unplug your PS3 hard drive.

(Method 2) Reading the PS3 HDD on Linux

This process was tested on Mint Cinnamon 18.2. YOU CANNOT DO THIS METHOD ON A LIVE CD/USB!

1. Open up a new terminal window and run the following command:

   sudo apt-get install openssl nbd-client

2. Download the HDD Decryption tools and extract the "ps3" file to /home/your_name.
3. Open up a new terminal window, or re-use your previous one and change directory to /home/your_name/ps3.
4. Copy your eid_root_key into this directory and rename it to eid_root_key.bin.
5. If you are using Cinnamon 18.2, rename the "bswap16 (Mint 18.2 64bit, 512).elf" file to "bswap16.elf" using the command mv "bswap16 (Mint 18.2 64bit, 512).elf" "bswap16.elf" in Terminal.
6. Run the following command:

   chmod +x makedev.sh bswap16.elf "PS3HDD Keygen v1.3.sh"

   ./PS3HDD\ Keygen\ v1.3.sh

7. Select what model PS3 you have. This script will create the decryption keys.
8. Run the command lsblk to determine what identifier the PS3 HDD has. (/dev/sda, /dev/sdb and so on).
9. Switch to superuser mode by executing the command sudo su.
10. Execute the following command using the sdx identifier from step 8. If it succeeds, you should not receive an error.

    ./makedev /home/your_name/ps3/bswap16.elf /dev/sdx

11. • If you're on a Fat console, run the following command:

    cryptsetup create -c aes-cbc-null -d /home/your_username/ps3/hdd_key.bin -s 192 ps3hdd /dev/nbd0"

    • If you're on a **Slim** console, run this one instead:

    cryptsetup create -c aes-xts-plain64 -d /home/your_username/ps3/hdd_key.bin -s 256 ps3hdd /dev/nbd0

12. Run the following command:

    kpartx -a /dev/mapper/ps3hdd

13. If everything went well so far, running the following command will yield multiple partitions starting with dm-X. If you're only getting one partition, you decrypted it wrongly.

    ls -l /dev/mapper/

14. On NOR consoles, dm-1 is the VFLASH and on NAND, dm-1 is dev_hdd1. dm-2 is always dev_hdd0 and dm-4 is dev_hdd2 (dm-3 on NAND consoles.)
15. To mount the VFLASH on NOR consoles, you need to execute the following commands:

    cryptsetup create -c aes-xts-plain64 -d /home/your_username/ps3/vflash_key.bin -s 256 -p 8 ps3vflash /dev/dm-1

    kpartx -a /dev/mapper/ps3vflash

16. To mount dev_hdd0, you need to execute the following command:

    mount -t ufs -o ufstype=ufs2,ro /dev/dm-2 /home/mint/ps3/dev_hdd0

17. Mounting of dev_hdd1 and the dev_flash regions (for NOR) requires you to execute the following. This also works for mounting dev_hdd1 on NAND.

    mount -t vfat /dev/dm-3 /home/your_username/ps3/dev_hdd1

    mount -t vfat /dev/dm-6 /home/your_username/ps3/dev_flash1

    mount -t vfat /dev/dm-7 /home/your_username/ps3/dev_flash2

    mount -t vfat /dev/dm-8 /home/your_username/ps3/dev_flash3

    • Keep in mind that you can only write to the vfat partitions and nothing else. For the other partitions, you can only read.
18. When you're finished doing your work, you'll need to unmount the partitions as well as delete the mapper drives. You can do that by executing the following commands.

    umount -l /home/mint/ps3/dev_hdd0

    umount -l /home/mint/ps3/dev_hdd1

    umount -l /home/mint/ps3/dev_flash1

    umount -l /home/mint/ps3/dev_flash2

    umount -l /home/mint/ps3/dev_flash3

    kpartx -d /dev/mapper/ps3vflash && cryptsetup remove ps3vflash

    kpartx -d /dev/mapper/ps3hdd && cryptsetup remove ps3hdd