PS3:Recovering Data: Difference between revisions

From ConsoleMods Wiki
Jump to navigation Jump to search
(Initial commit for guide to dump HDD encryption key and read data on windows)
 
No edit summary
Line 5: Line 5:
==Dumping the eid_root_key==
==Dumping the eid_root_key==


===Rebug firmwares:===
===Rebug Firmwares===
# Open rebug toolbox under "Game" on the XMB
# Open Rebug Toolbox under "Game" on the XMB.
#* if you do not have rebug toolbox installed, the installer should already be on your console at dev_rebug/rebug/packages, where you can install it via "Package Manager > Install Package Files > PS3 System Storage".
#* If you do not have rebug toolbox installed, the installer should already be on your console at dev_rebug/rebug/packages, where you can install it via "Package Manager > Install Package Files > PS3 System Storage".
#* if rebug toolbox is not downloaded, you can get the latest version [[https://web.archive.org/web/20200703122720/https://playstationscenefiles.com/rebug/REBUG_TOOLBOX_02.03.04.MULTI.16.pkg here]] (automatic download)
#* If rebug toolbox is not downloaded, you can get the latest version [[https://web.archive.org/web/20200703122720/https://playstationscenefiles.com/rebug/REBUG_TOOLBOX_02.03.04.MULTI.16.pkg here]] (automatic download).
# navigate to the "Utilities" category, scroll down to and select "Dump eid root key"
# Navigate to the "Utilities" category, scroll down to and select "Dump eid root key".
# a popup will inform you that the eid_root_key will be created in "dev_hdd0/game/RBGTLBOX2/USRDIR", select "Yes"
# A popup will inform you that the eid_root_key will be created in "dev_hdd0/game/RBGTLBOX2/USRDIR", select "Yes".
# your PS3 will reboot and beep
# The PS3 will reboot and beep.
# navigate to the location rebug toolbox informed you with either your choice of homebrew, or FTP program, copying over the "eid_root_key" file to a flash drive or your computer
# Navigate to the location Rebug Toolbox informed you with either your choice of homebrew, or FTP program, copying over the "eid_root_key" file to a flash drive or your computer.


===Evilnat 4.88.2:===
===Evilnat 4.88.2===
{{Note|This feature was added in evilnat '''4.88.2''', it will not be available in '''4.88.1'''}}
{{Note|This feature was added in Evilnat '''4.88.2''', it will not be available in '''4.88.1''' or lower.}}


# From the top of the "Network" column on the XMB, select "Custom Firmware Tools"
# From the top of the "Network" column on the XMB, select "Custom Firmware Tools".
# navigate to and select the "Dump Tools" category
# Navigate to and select the "Dump Tools" category.
# navigate to and select "Dump ERK"
# Navigate to and select "Dump ERK".
# navigate to either "dev_usb" or "dev_hdd0/tmp" and copy the eid_root_key to someplace safe such as your PC
# Navigate to either `/dev_usb/` or `/dev_hdd0/tmp/` and copy the eid_root_key to a safe place such as your PC.




==Reading the PS3s HDD on Windows:==
==(Method 1) Reading the PS3 HDD on Windows==
{{Warning|Whenever you plug the PS3s system drive into a PC, be careful to never format or initialise the drive, doing so will permanently erase your data.}}
{{Warning|Whenever you plug the PS3s system drive into a PC, be careful to never format or initialize the drive, doing so will permanently erase your data.}}
# plug the SATA and power cable from your PC into the PS3's HDD, ensuring your PC is turned off.
# Plug the SATA and power cable from your PC into the PS3's HDD.
# turn your PC on, and if prompted, select '''"No"''' to initialising or formatting the drive
# Turn your PC on, and if prompted, select '''"No"''' to initialising or formatting the drive.
# download PS3_HDD_Reader by 3141card from [https://mega.nz/file/WEkWnAgC#yGGgGhCGYAnSR3soi9CMufAfDoP_yjsbkELb_B2nuck here], extract the folder once complete
# Download PS3_HDD_Reader by 3141card from [https://www.mediafire.com/file/jdq0ot8bhp2c242/PS3_HDD_Reader_final_windows.7z/file here], extract the folder once complete.
# paste your eid_root_key into the "PS3_HDD_Reader_final_windows" folder
# Paste your eid_root_key into the "PS3_HDD_Reader_final_windows" folder
#* from here out, the readme.txt in the download will have the same or similar instructions
#* The readme.txt in the download will have the same or similar instructions to the below.
# navigate to the "PS3_HDD_Reader_final_windows" folder previously extracted, and where the directory is displayed (to the right of the search bar), right click and select "Copy address as text"
# Navigate to the "PS3_HDD_Reader_final_windows" folder previously extracted, and where the directory is displayed (to the right of the search bar), right click and select "Copy address as text"
# open a command prompt window (CMD) as administrator
# Press Start, search for "cmd", right click Command Prompt and select Run as Administrator.
# enter `cd ` into the command prompt window, paste the copied directory and press enter, your Command prompt window should display the directory you copied. (e.g. "C:\PS3Tools\PS3_HDD_Reader_final_windows>")
# Enter the command C:\...\ps3_hdd_reader.exe hdd (with ... being the path to the folder you extracted) and a list of partitions will be listed. Alternatively, if you have a dump of a PS3 HDD, name it backup.bin and use the command C:\...\ps3.exe file.
#* if you copied the "PS3_HDD_Reader_final_windows" folder to a drive other than C:\, you may have to enter "[drive letter]:" and press enter. (e.g. "C:\WINDOWS\system32>D:")
#* If you copied the "PS3_HDD_Reader_final_windows" folder to a drive other than C:\, you may have to enter "[drive letter]:" and press enter. (e.g. "C:\WINDOWS\system32>D:")
# in the command prompt window, enter `ps3_hdd_reader.exe hdd`. This will display all available partitions on the PS3's HDD, and will indicate that everything is working okay.
# In the command prompt window, enter `ps3_hdd_reader.exe hdd`. This will display all available partitions on the PS3's HDD, and will indicate that everything is working okay.
# again in the command prompt window, you can begin copying and viewing the files you want through commands such as:
# Again in the command prompt window, you can begin copying and viewing the files you want through commands such as:
#* `ps3_hdd_reader.exe hdd dev_hdd0 dir /` to view the main partitions file structure
#* `ps3_hdd_reader.exe hdd dev_hdd0 dir /` to view the main partitions file structure
#* `ps3_hdd_reader.exe hdd dev_hdd0 copy /PS3ISO` to copy all files inside the "PS3ISO" directory
#* `ps3_hdd_reader.exe hdd dev_hdd0 copy /PS3ISO` to copy all files inside the "PS3ISO" directory
#* i recommend against copying large directories such as "/GAMES" due to potential storage space issues, instead copy "/GAMES/[gameName]"
#* It's not recommended to copy large directories such as "/GAMES/" due to potential storage space issues, instead copy "/GAMES/[gameName]".
# once you have copied all your important data, turn off your PC, and unplug your hard-drive.
# Once you have copied all your important data, unplug your PS3 hard drive.
 
==(Method 2) Reading the PS3 HDD on Linux==
 
This process was tested on Mint Cinnamon 18.2. '''YOU CANNOT DO THIS METHOD ON A LIVE CD/USB!'''
 
# Open up a new terminal window and run the following command:
#:sudo apt-get install openssl nbd-client
# Download the [https://www.mediafire.com/file/qgudqgqcwcmgc6w/HDD_Decryption_Tools_for_Linux.zip/file HDD Decryption tools] and extract the "ps3" file to `/home/your_name`.
# Open up a new terminal window, or re-use your previous one and change directory to `/home/your_name/ps3`.
# Copy your eid_root_key into this directory and rename it to `eid_root_key.bin`.
# If you are using Cinnamon 18.2, rename the "bswap16 (Mint 18.2 64bit, 512).elf" file to "bswap16.elf" using the command `mv "bswap16 (Mint 18.2 64bit, 512).elf" "bswap16.elf"` in Terminal.
# Run the following command:
#:chmod +x makedev.sh bswap16.elf "PS3HDD Keygen v1.3.sh"
#:./PS3HDD\ Keygen\ v1.3.sh
# Select what model PS3 you have. This script will create the decryption keys.
# Run the command `lsblk` to determine what identifier the PS3 HDD has. (/dev/sda, /dev/sdb and so on).
# Switch to superuser mode by executing the command `sudo su`.
# Execute the following command using the `sdx` identifier from step 8. If it succeeds, you should not receive an error.
#:./makedev /home/your_name/ps3/bswap16.elf /dev/sdx
#
#* If you're on a ''Fat'' console, run the following command:
#:cryptsetup create -c aes-cbc-null -d /home/your_username/ps3/hdd_key.bin -s 192 ps3hdd /dev/nbd0"
#*If you're on a **Slim** console, run this one instead:
#:cryptsetup create -c aes-xts-plain64 -d /home/your_username/ps3/hdd_key.bin -s 256 ps3hdd /dev/nbd0
# Run the following command:
#:kpartx -a /dev/mapper/ps3hdd
# If everything went well so far, running the following command will yield multiple partitions starting with dm-X. If you're only getting one partition, you decrypted it wrongly.
#:ls -l /dev/mapper/
# On NOR consoles, dm-1 is the VFLASH and on NAND, dm-1 is dev_hdd1. dm-2 is always dev_hdd0 and dm-4 is dev_hdd2 (dm-3 on NAND consoles.)
# To mount the VFLASH on NOR consoles, you need to execute the following commands:
#:cryptsetup create -c aes-xts-plain64 -d /home/your_username/ps3/vflash_key.bin -s 256 -p 8 ps3vflash /dev/dm-1
#:kpartx -a /dev/mapper/ps3vflash
# To mount dev_hdd0, you need to execute the following command:
#:mount -t ufs -o ufstype=ufs2,ro /dev/dm-2 /home/mint/ps3/dev_hdd0
# Mounting of dev_hdd1 and the dev_flash regions (for NOR) requires you to execute the following. This also works for mounting dev_hdd1 on NAND.
#:mount -t vfat /dev/dm-3 /home/your_username/ps3/dev_hdd1
#:mount -t vfat /dev/dm-6 /home/your_username/ps3/dev_flash1
#:mount -t vfat /dev/dm-7 /home/your_username/ps3/dev_flash2
#:mount -t vfat /dev/dm-8 /home/your_username/ps3/dev_flash3
#*Keep in mind that you can only write to the vfat partitions and nothing else. For the other partitions, you can only read.
# When you're finished doing your work, you'll need to unmount the partitions as well as delete the mapper drives. You can do that by executing the following commands.
#:umount -l /home/mint/ps3/dev_hdd0
#:umount -l /home/mint/ps3/dev_hdd1
#:umount -l /home/mint/ps3/dev_flash1
#:umount -l /home/mint/ps3/dev_flash2
#:umount -l /home/mint/ps3/dev_flash3
#:kpartx -d /dev/mapper/ps3vflash && cryptsetup remove ps3vflash
#:kpartx -d /dev/mapper/ps3hdd && cryptsetup remove ps3hdd

Revision as of 16:07, 8 January 2022

If something happens to your PS3 that leaves you unable to access files on the system storage, you may still be able to recover important files if you have previously dumped your per-console hard-drive encryption key (eid_root_key).

Please note, these tools allow for read-only access, you cannot use this to write files to the PS3s system storage.

Dumping the eid_root_key

Rebug Firmwares

  1. Open Rebug Toolbox under "Game" on the XMB.
    • If you do not have rebug toolbox installed, the installer should already be on your console at dev_rebug/rebug/packages, where you can install it via "Package Manager > Install Package Files > PS3 System Storage".
    • If rebug toolbox is not downloaded, you can get the latest version [here] (automatic download).
  2. Navigate to the "Utilities" category, scroll down to and select "Dump eid root key".
  3. A popup will inform you that the eid_root_key will be created in "dev_hdd0/game/RBGTLBOX2/USRDIR", select "Yes".
  4. The PS3 will reboot and beep.
  5. Navigate to the location Rebug Toolbox informed you with either your choice of homebrew, or FTP program, copying over the "eid_root_key" file to a flash drive or your computer.

Evilnat 4.88.2

Exclamation-circle-fill.svgThis feature was added in Evilnat 4.88.2, it will not be available in 4.88.1 or lower.


  1. From the top of the "Network" column on the XMB, select "Custom Firmware Tools".
  2. Navigate to and select the "Dump Tools" category.
  3. Navigate to and select "Dump ERK".
  4. Navigate to either /dev_usb/ or /dev_hdd0/tmp/ and copy the eid_root_key to a safe place such as your PC.


(Method 1) Reading the PS3 HDD on Windows

Exclamation-triangle-fill.svgWhenever you plug the PS3s system drive into a PC, be careful to never format or initialize the drive, doing so will permanently erase your data.


  1. Plug the SATA and power cable from your PC into the PS3's HDD.
  2. Turn your PC on, and if prompted, select "No" to initialising or formatting the drive.
  3. Download PS3_HDD_Reader by 3141card from here, extract the folder once complete.
  4. Paste your eid_root_key into the "PS3_HDD_Reader_final_windows" folder
    • The readme.txt in the download will have the same or similar instructions to the below.
  5. Navigate to the "PS3_HDD_Reader_final_windows" folder previously extracted, and where the directory is displayed (to the right of the search bar), right click and select "Copy address as text"
  6. Press Start, search for "cmd", right click Command Prompt and select Run as Administrator.
  7. Enter the command C:\...\ps3_hdd_reader.exe hdd (with ... being the path to the folder you extracted) and a list of partitions will be listed. Alternatively, if you have a dump of a PS3 HDD, name it backup.bin and use the command C:\...\ps3.exe file.
    • If you copied the "PS3_HDD_Reader_final_windows" folder to a drive other than C:\, you may have to enter "[drive letter]:" and press enter. (e.g. "C:\WINDOWS\system32>D:")
  8. In the command prompt window, enter ps3_hdd_reader.exe hdd. This will display all available partitions on the PS3's HDD, and will indicate that everything is working okay.
  9. Again in the command prompt window, you can begin copying and viewing the files you want through commands such as:
    • ps3_hdd_reader.exe hdd dev_hdd0 dir / to view the main partitions file structure
    • ps3_hdd_reader.exe hdd dev_hdd0 copy /PS3ISO to copy all files inside the "PS3ISO" directory
    • It's not recommended to copy large directories such as "/GAMES/" due to potential storage space issues, instead copy "/GAMES/[gameName]".
  10. Once you have copied all your important data, unplug your PS3 hard drive.

(Method 2) Reading the PS3 HDD on Linux

This process was tested on Mint Cinnamon 18.2. YOU CANNOT DO THIS METHOD ON A LIVE CD/USB!

  1. Open up a new terminal window and run the following command:
    sudo apt-get install openssl nbd-client
  2. Download the HDD Decryption tools and extract the "ps3" file to /home/your_name.
  3. Open up a new terminal window, or re-use your previous one and change directory to /home/your_name/ps3.
  4. Copy your eid_root_key into this directory and rename it to eid_root_key.bin.
  5. If you are using Cinnamon 18.2, rename the "bswap16 (Mint 18.2 64bit, 512).elf" file to "bswap16.elf" using the command mv "bswap16 (Mint 18.2 64bit, 512).elf" "bswap16.elf" in Terminal.
  6. Run the following command:
    chmod +x makedev.sh bswap16.elf "PS3HDD Keygen v1.3.sh"
    ./PS3HDD\ Keygen\ v1.3.sh
  7. Select what model PS3 you have. This script will create the decryption keys.
  8. Run the command lsblk to determine what identifier the PS3 HDD has. (/dev/sda, /dev/sdb and so on).
  9. Switch to superuser mode by executing the command sudo su.
  10. Execute the following command using the sdx identifier from step 8. If it succeeds, you should not receive an error.
    ./makedev /home/your_name/ps3/bswap16.elf /dev/sdx
    • If you're on a Fat console, run the following command:
    cryptsetup create -c aes-cbc-null -d /home/your_username/ps3/hdd_key.bin -s 192 ps3hdd /dev/nbd0"
    • If you're on a **Slim** console, run this one instead:
    cryptsetup create -c aes-xts-plain64 -d /home/your_username/ps3/hdd_key.bin -s 256 ps3hdd /dev/nbd0
  11. Run the following command:
    kpartx -a /dev/mapper/ps3hdd
  12. If everything went well so far, running the following command will yield multiple partitions starting with dm-X. If you're only getting one partition, you decrypted it wrongly.
    ls -l /dev/mapper/
  13. On NOR consoles, dm-1 is the VFLASH and on NAND, dm-1 is dev_hdd1. dm-2 is always dev_hdd0 and dm-4 is dev_hdd2 (dm-3 on NAND consoles.)
  14. To mount the VFLASH on NOR consoles, you need to execute the following commands:
    cryptsetup create -c aes-xts-plain64 -d /home/your_username/ps3/vflash_key.bin -s 256 -p 8 ps3vflash /dev/dm-1
    kpartx -a /dev/mapper/ps3vflash
  15. To mount dev_hdd0, you need to execute the following command:
    mount -t ufs -o ufstype=ufs2,ro /dev/dm-2 /home/mint/ps3/dev_hdd0
  16. Mounting of dev_hdd1 and the dev_flash regions (for NOR) requires you to execute the following. This also works for mounting dev_hdd1 on NAND.
    mount -t vfat /dev/dm-3 /home/your_username/ps3/dev_hdd1
    mount -t vfat /dev/dm-6 /home/your_username/ps3/dev_flash1
    mount -t vfat /dev/dm-7 /home/your_username/ps3/dev_flash2
    mount -t vfat /dev/dm-8 /home/your_username/ps3/dev_flash3
    • Keep in mind that you can only write to the vfat partitions and nothing else. For the other partitions, you can only read.
  17. When you're finished doing your work, you'll need to unmount the partitions as well as delete the mapper drives. You can do that by executing the following commands.
    umount -l /home/mint/ps3/dev_hdd0
    umount -l /home/mint/ps3/dev_hdd1
    umount -l /home/mint/ps3/dev_flash1
    umount -l /home/mint/ps3/dev_flash2
    umount -l /home/mint/ps3/dev_flash3
    kpartx -d /dev/mapper/ps3vflash && cryptsetup remove ps3vflash
    kpartx -d /dev/mapper/ps3hdd && cryptsetup remove ps3hdd