PS3 How to read data from PlayStation 3 HDD on PC (tutorials/tools hub + FAQ)

Berion

Berion

Developer
First of all, you can't expect that your computer will read the contents of a hard drive from your PS3 when you connect it. This is because:
  • The HDD is encrypted with a unique key (for each individual console!).
  • The partition table is non-standard, so it is neither MBR nor GPT (let's conventionally call it PS3PT), and only Linux supports it.
  • The file system on the partition mounted on the console as "dev_hdd0/" is UFS2 (not supported by Windows or macOS).
So there are two obstacles to reading the data: encryption and a logical structure that operating systems cannot understand. To deal with this, clever people have written dedicated tools. But they all require the disk key(s): ATA Key and ENCDEC Key (which I call the VFLASH Key; it is only used on NOR models). Without them, access to the encrypted data is impossible. There is no way around this today or ever in the near future! Both of these keys can be derived from the EID Root Key (ERK), which is part of metldr (first 48 bytes) and is located in the console's flash memory. Unfortunately, it is encrypted with an unknown key, so you can't read it with chip readers to retrieve the ERK. You have to use special programs on a running console, which in turn must be running CFW (known exploits for reading the ERK do not work on HAN or HEN). qCFW users can dump the ATA and ENCDEC keys directly from the CFW Tools menu. Owners of a semi-dead PS3 can retrieve the keys via SysCon, but only if the Cell and RSX are still functional and the NEC Tokin capacitors are in good condition (still, qCFW is needed).

Diagrams

On models with NAND flash memory, the logical structure is shown in the diagram below. The OtherOS area can only exist on firmware versions up to and including 3.16, or on dedicated CFW with so-called OtherOS++ support.

diagram_nand.png


On models with NOR flash memory, the logical structure is slightly more complex because the eFlash section was moved from NAND to a dedicated VFLASH partition.

diagram_nor.png


On models with eMMC flash memory, the logical structure is still unknown.

Summary

The ERK key can only be read:
  • on a working console
  • on all Fat models (CECHAxx up to and including CECHQxx) and some Slim models (all CECH-20xx and some CECH-25xx units with factory firmware v3.55)
  • on CFW (i.e Rebug, Evilnat)
The ERK key is NOT readable:
  • on a dead console or from a NAND/NOR memory dump
  • on Slim models CECH-25xx (with factory firmware v3.56 or later), CECH-3xxx, and Super Slim (CECH-4xxx)
  • on HAN or HEN
The ATA and ENCDEC keys can be read:
  • on qCFW (via XMB or SysCon)
  • on CFW (because of the ERK)
The ATA and ENCDEC keys CANNOT be read:
  • on qCFW via SysCon if the Cell/RSX or NEC Tokin capacitors have failed
  • on eMMC console models
The key(s) do not need to be read:
  • on GECR models, because they all use the same ERK key, and therefore the same ATA and ENCDEC keys
Tools

Logic structure reading (access to file systems):
Sectors decryption only:

FAQ

Q: How do I obtain the ERK (EID Root Key)?
A: Follow this guide.

Q: How do I obtain the ATA and ENCDEC (VFLASH) keys?
A: Follow these instructions.

Q: Can I read the HDD from another PS3 on mine?
A: You cannot, because it is encrypted with different key(s).

Q: Can I use someone else's key(s)?
A: No, for the same reason that your key will not open your neighbors house. ;) The exception is GEX (GECR models), because they use the same keys.

Q: My PS3 is completely dead. Can I guess the key(s)?
A: Only if you can wait a few million years to brute-force i.e the ATA Key. Or possibly a dozen or so until quantum computers become commonplace.

Q: My PS3 is completely dead. Can I read the key from somewhere?
A: No.

Q: I connected the HDD to my computer and Windows initialized the drive. Can this be fixed?
A: Yes, follow this guide. However, the recommended method is to bypass PS3PT using a dedicated script from the PS3HDH toolkit.

Q: How can I access all partitions and sub-partitions on a PC?
A: Follow this guide.

Q: How do I know what to copy and from where?
A: Follow this guide.

Q: I only want to back up data from OtherOS, but I don't have any keys. How can I do that?
A: You don't need any keys. The OtherOS areas are not encrypted. Follow this guide.

Q: Can I recover deleted media from a quick-formatted drive or one with a broken PS3PT?
A: Yes, as long as the data previously stored in "dev_hdd0/" has not been overwritten. You need to make a sector-by-sector copy, decrypt it, and then use a program that scans the media for known file systems (e.g. R-Studio). Examples.

Q: Can I read HDDs from PS3 development kits?
A: Yes, but you need to read the ERK from them just like on standard CEX and SEX models (CECH). For compatible DECR and DEX (DECH) units there are dedicated CFWs (Rebug and Evilnat).

Q: Can I read HDDs from PS3 prototypes?
A: I have no idea.
 
Last edited:
What exactly Slim model? You can install CFW on all Slims with exceptions with those CECH-25xx which have newer boot loader. Those CECH-25xx which have old metldr, they can use CFW. If You have exactly CECH-25xx (i.e CECH-2504) You can check it by trying MinVerChecker (update package) or read it from bgtoolset (webapp). If You have CECH-20xx or CECH-21xx You can install CFW without checking anything.

Without CFW, currently user cannot get ERK.

If You already have installed CFW (not HAN, not HEN ;)) then just get the ERK key.
 
Last edited:
Hi there! I'm testing the PS3 HDD Reader in Windows and I wanted to point that it wasn't working for me at the beginning because I had the program in partition D: I have an old laptop which I use to tinker with consoles and stuff, it has 2 partitions C: (where the OS Windows 7 is installed) and D: (I save games and other things here).

The cmd was saying that it was unable to find PS3. I moved the PS3 HDD Reader entire folder to to C: and it's working perfectly!

Also comment that I pressed "Cancel" in the window when Windows tried to initialize my external PS3 connected HDD. I did some research and people say that some Windows 10 and 11 initialize disks automatically. I think this don't always happens and it will depend on your OS updates or your settings. But beware of checking this first it you are running in this OSs. Otherwise, you HDD might get initialized or even fast formatted!
 
Lost_Lombax said:
Hi there! I'm testing the PS3 HDD Reader in Windows and I wanted to point that it wasn't working for me at the beginning because I had the program in partition D: (...) The cmd was saying that it was unable to find PS3. I moved the PS3 HDD Reader entire folder to to C: and it's working perfectly!
Click to expand...
Indeed, I experienced that in the past, one of the old bugs.

I have an old laptop which I use to tinker with consoles and stuff, it has 2 partitions C: (where the OS Windows 7 is installed) and D: (I save games and other things here).
Click to expand...
3 partitions. And if Win7 was pre-installed, then 4 or 5. ;]

Also comment that I pressed "Cancel" in the window when Windows tried to initialize my external PS3 connected HDD. I did some research and people say that some Windows 10 and 11 initialize disks automatically.
Click to expand...
Never happen to me. Few users reported that but I'm not convinced. ^^

But beware of checking this first it you are running in this OSs. Otherwise, you HDD might get initialized or even fast formatted!
Click to expand...
Just use Linux. ;P
 
Hello, my PS3 is dead and I still have the SSD I used in it. I tried everything I could but I couldn't fix it. I have his NAND backup. With this backup, would it be possible to gain access to the ERK key?
 
Idk why but from what I read so far, you seems to assume that syscon somehow has the keys and by setting certain eeprom byte will make it print that key.

This is not true. Dumping is performed by Stagex. It watches data transfer between lv1ldr and encdec device. With static key known it is possible to decrypt a encrypted bus then extract hdd keys from it.

Syscon "w f03 1" command is just setting dump request flag for Stagex to read and perform dumping if 1.
It's exact same thing as dump option in XMB. All it did is set that flag then reboot.

Without modchip, nothing happens.
 
@aomsin2526 I'm aware of that modchip and qCFW are mandatory in this scenario. But if you goes to that conclusion, it means that my guide is not precise enough. I will think about a little reorganize some parts and add additional question in FAQ, directly pointing to that. Thank you very much for value insight!
 
You must log in or register to reply here.

Similar threads

Back
Top