Hi, I'm trying to find the encryptionkey for my mybook studio 3TB.

The enclosure is a My Book Studio with usb-2 and FW800.
The disk is WD30EZRX-00DC0B0
The chip is a PLX OXUF943SE

I've tried the sector locations found on the web but:

Using both the USB-SATA bridge and the drive directly connected via sata i get:

sudo dd if=/dev/sdd of=test.bin bs=512 skip=5860533120 count=1
dd: /dev/sdd: cannot skip: Invalid argument
0+0 records in
0+0 records out
0 bytes copied, 8.314e-05 s, 0.0 kB/s

Dumping the same sector with hddsupertool gives me something, but it looks like data so I don't know if it wraps?

(via the bridge)
00000000 00 70 00 6c 00 65 00 2e 00 73 00 79 00 73 00 74 |.p.l.e...s.y.s.t|
00000010 00 65 00 6d 00 2e 00 53 00 65 00 63 00 75 00 72 |.e.m...S.e.c.u.r|
00000020 00 69 00 74 00 79 00 00 00 10 00 00 00 00 00 00 |.i.t.y..........|
00000030 00 00 00 00 00 44 01 2c c1 6d 00 00 00 00 00 00 |.....D.,.m......|
00000040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 |................|
00000060 00 00 ab cd ef ab cd ef ab cd ef ab cd ef 00 00 |................|
00000070 00 0c 00 00 00 02 00 00 25 34 00 5a 00 00 03 3f |........%4.Z...?|
00000080 b8 35 00 00 00 00 00 27 00 63 00 6f 00 6d 00 2e |.5.....'.c.o.m..|
00000090 00 61 00 70 00 70 00 6c 00 65 00 2e 00 66 00 69 |.a.p.p.l.e...f.i|
000000a0 00 6e 00 64 00 65 00 72 00 2e 00 63 00 6f 00 70 |.n.d.e.r...c.o.p|
000000b0 00 79 00 2e 00 73 00 6f 00 75 00 72 00 63 00 65 |.y...s.o.u.r.c.e|
000000c0 00 2e 00 63 00 68 00 65 00 63 00 6b 00 73 00 75 |...c.h.e.c.k.s.u|
000000d0 00 6d 00 23 00 4e 00 00 00 10 00 00 00 00 00 00 |.m.#.N..........|
000000e0 00 00 00 00 00 04 74 90 a2 fd 00 00 00 00 00 00 |......t.........|
000000f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|

(via sata)

00000000 1a 66 1c 1b f6 ed 1d 48 2c bb 43 83 6f a5 75 6a |.f.....H,.C.o.uj|
00000010 0e 4f be 01 60 61 07 3e 8f 84 b3 42 56 3f c1 0c |.O..`a.>...BV?..|
00000020 31 63 47 15 46 a4 97 07 3b 72 7c 3e a4 4b 1f 19 |1cG.F...;r|>.K..|
00000030 dd 9f 21 6b f5 15 5b 54 3b 70 4b e6 3e 0b 4c 65 |..!k..[T;pK.>.Le|
00000040 6e a6 14 51 8e 75 4d 1b fb 08 3b 70 4d 0e ae f8 |n..Q.uM...;pM...|
00000050 55 b1 ad 1f 1b 5e 07 1d a2 ca 5e c8 26 b6 e8 26 |U....^....^.&..&|
00000060 9a 4e ea 7e 5e 4e 83 22 e2 d4 85 41 cc fd fe 35 |.N.~^N."...A...5|
00000070 fd 24 05 ed 76 5c f7 4a e2 91 18 0c c4 62 f1 02 |.$..v\.J.....b..|
00000080 82 d3 ba 62 87 50 da 66 55 64 36 e4 71 93 6f 75 |...b.P.fUd6.q.ou|
00000090 dc b2 6c a3 19 af 9b 9a 04 5b dd 29 a5 b4 4f 90 |..l......[.)..O.|
000000a0 c5 bb a4 42 c5 b8 7b 4b b3 49 f7 c2 02 67 55 1d |...B..{K.I...gU.|
000000b0 c9 5f 15 34 3a ed 9f 33 f0 a9 14 af 76 d0 a0 ce |._.4:..3....v...|
000000c0 d7 35 cd ca 9a 92 f2 77 e7 5f 17 71 d1 9f 22 4c |.5.....w._.q.."L|
000000d0 31 85 de 9b a2 fd b9 f8 98 07 3b f8 8a 5e fa fb |1.........;..^..|
000000e0 83 16 3b e9 c1 97 fc e2 2c 79 07 b6 a2 64 7b 78 |..;.....,y...d{x|
000000f0 30 ab 3c 79 c7 9e 55 20 a2 2c cb a3 19 6f 6f 19 |0.<y..U .,...oo.|

I also did a dump of a bunch of modules using hddsupertool and tried to grep for SInE but to no avail. However, maybe thats the wrong string to grep for when the drive is used via the interface that makes it look unencrypted...

I've more or less come to the conclusion that the key is not stored on the harddrive but in the bridge

The whole reason I'm doing this is that the drive has failed, and is now super slow so I was thinking I might get better speeds without the bridge interfering. I'm about to try the mod-patches to see if they help...

These are the kinds of errors I'm seeing while running ddrescue

[57417.984046] blk_update_request: I/O error, dev sdd, sector 137135656
[57789.354419] sd 34:0:0:0: [sdd] tag#0 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_SENSE
[57789.354422] sd 34:0:0:0: [sdd] tag#0 Sense Key : Medium Error [current]
[57789.354434] sd 34:0:0:0: [sdd] tag#0 Add. Sense: Data phase error
[57789.354438] sd 34:0:0:0: [sdd] tag#0 CDB: Read(16) 88 00 00 00 00 00 08 30 ec a8 00 00 00 80 00 00
[57789.354440] blk_update_request: I/O error, dev sdd, sector 137424040

I did not get any errors like these when I had the drive hooked up via SATA though.

Any ideas?

Best Regards
Robert

Is it possible that the drive's capacity is less than what is expected? That is, could LBA 5860533120 be beyond the drive's user area? If so, check for the existence of a HPA.

Also, when accessing the drive via USB, does it report a sector size of 512 bytes or 4096 bytes? Are you using the original enclosure for these tests?

_________________
A backup a day keeps DR away.

I am using the original enclosure to read the data yes.

Also I've now understood that non-user-sectors cannot be read while the bridge is in place...

https://github.com/themaddoctor/linux-m ... s/issues/6

That does not explain why I get the same error with the drive connected through SATA though

Deleted, misread original post.

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company

Hi, we can work with those.
you can contact me via PM or website.

_________________
Rescue IT Datarecovery service Sweden
Rescue IT Dataräddning Göteborg AB
http://www.rescue-it.se

mr_spokk, thanks for the offer, but I'm only interested in getting the decryption key to be able to mount the drive through cryptsetup.

There is nothing really vital on the drive, and since I'm able to use/read the disk (de-crypted) with the original usb-sata-interface the data isn't lost. yet.

The drive has however slowed to a crawl again:

GNU ddrescue 1.19
About to copy 1500 GBytes from /dev/sdd2 [1500000002048] to ddrescue_sdc2.dd [1499999899648].
Starting positions: infile = 0 B, outfile = 0 B
Copy block size: 128 sectors Initial skip size: 128 sectors
Sector size: 512 Bytes
Max retry passes: 0
Direct: yes Sparse: no Trim: no Scrape: no Truncate: no

Press Ctrl-C to interrupt
Initial status (read from logfile)
rescued: 315894 MB, errsize: 6662 kB, errors: 143

Current status
rescued: 395251 MB, errsize: 35564 kB, current rate: 32768 B/s
ipos: 246265 MB, errors: 584, average rate: 1482 kB/s
opos: 246265 MB, run time: 14.86 h, successful read: 0 s ago
Copying non-tried blocks... Pass 1 (forwards)

Hi, just wanted to report that I found the keysector when I connected the harddrive through an ordinary usb-sata interface.

The drive is now connected via SATA and cryptoloop setup, the progress is just as slow though, however I don't need to have a harddrive lying around out of the box looking sad.

Try the "slow fix" with HDDSuperTool (by patching modules 02 and 32).

You might also like to use HDDSuperClone in preference to ddrescue:
http://www.sdcomputingservice.com/hddsuperclone

BTW, are you connecting your drive to a Gigabyte motherboard? Gigabyte's BIOS truncates the drive's capacity by ~2000 sectors, and a lot more in some cases.

GigaByte BIOS bug results in loss of 1TB capacity:
http://www.hddoracle.com/viewtopic.php?f=59&t=150&p=275

_________________
A backup a day keeps DR away.

Hi,
Is Cryptsetup some tool you are referring to

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com

cryptsetup is the Linux tool to manage (LUKS-)encrypted partitions:
https://wiki.archlinux.org/index.php/Dm ... encryption
https://linux.die.net/man/8/cryptsetup