All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 20 posts ] 
Author Message
 Post subject: Unable to retrieve data after PCB swap
PostPosted: May 31st, 2018, 18:16 
Offline

Joined: May 31st, 2018, 17:43
Posts: 3
Location: United States
Hello all!

New to the forum, but not new to hard drives :P

So I'm having a really hard time with this hard drive. It's a Western Digital Caviar Green (WD10EARS) that was pulled from a 1TB external drive. I am working on this project for a customer. I diagnosed the drive as having a faulty motor controller, so I ordered a new PCB for swap. (An identical 2060-701640-002 Rev A). I transferred U12 (firmware chip), installed on the drive, and it sprung to life as soon as it was plugged in. Customer did not indicate whether this drive was being used on a Mac or PC, so I just initialized the drive as NTFS and ran a deep scan on Recuva. It found data, but the only data that was recovered was the data that comes on the drive (WD application installers, user manuals, etc). I called the customer and she indicated that this drive was being used on a Mac. Brought it over to my Mac station, re-initialized as APFS and scanned the drive with Data Rescue overnight. Same result. Tried exFAT just to be sure, same result. I have now transferred over U2 (flash chip, just for giggles really) and am going to let that run overnight. I am not very familiar with newer WD drives. Is it possible that there is some firmware data stored in U5 (MCU) and it needs to be transferred as well? Why am I able to pull factory application data and nothing else?


Top
 Profile  
 
 Post subject: Re: Unable to retrieve data after PCB swap
PostPosted: May 31st, 2018, 18:33 
Offline
User avatar

Joined: April 3rd, 2011, 0:19
Posts: 1863
Location: Providence, RI
uniquegeek wrote:
It's a Western Digital Caviar Green (WD10EARS) that was pulled from a 1TB external drive


Then your drive is almost certainly encrypted as nearly all WD externals are if you pull them from the external.

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company


Top
 Profile  
 
 Post subject: Re: Unable to retrieve data after PCB swap
PostPosted: May 31st, 2018, 18:35 
Offline
User avatar

Joined: April 3rd, 2011, 0:19
Posts: 1863
Location: Providence, RI
uniquegeek wrote:
Brought it over to my Mac station, re-initialized as APFS and scanned the drive with Data Rescue overnight.


That was a terrible idea. Now, you've got a brand new partition table and file system overwriting your encrypted one.

Time for you to outsource this to a professional now and perhaps time to rethink whether you really have the skills to offer such a service. Your client should sue you for the serious complications you've caused now.

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company


Top
 Profile  
 
 Post subject: Re: Unable to retrieve data after PCB swap
PostPosted: May 31st, 2018, 18:40 
Offline
User avatar

Joined: April 3rd, 2011, 0:19
Posts: 1863
Location: Providence, RI
Actually, if you're able to recover the WD files it's probably not the WD encryption messing you up. You derailed the case when you first initialized the drive. It probably had an Apple Filevault encrypted partition on it. There is never EVER EVER EVER EVER EVER any reason to do that. Anyone who told you to do that is a moron.

Good luck rebuilding that partition table now. No software can automate finding lost FileVault partitions. It has to be done 100% manually.

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company


Top
 Profile  
 
 Post subject: Re: Unable to retrieve data after PCB swap
PostPosted: May 31st, 2018, 18:58 
Offline

Joined: May 31st, 2018, 17:43
Posts: 3
Location: United States
data-medics wrote:
It probably had an Apple Filevault encrypted partition on it.


Now that's something I didn't think of. Thanks!


Top
 Profile  
 
 Post subject: Re: Unable to retrieve data after PCB swap
PostPosted: May 31st, 2018, 19:24 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 10867
Location: Australia
data-medics wrote:
Actually, if you're able to recover the WD files it's probably not the WD encryption messing you up.

The user area is encrypted, but the "SmartWare" area ("WD files") is not. The OP needs to reinstall the drive in its original enclosure, assuming it is not damaged. Only then can data recovery software hope to find anything.

A detailed photo of the PCB in the enclosure might help.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Unable to retrieve data after PCB swap
PostPosted: May 31st, 2018, 19:28 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9695
Location: Portugal
Did you place the drive back to it's ORIGINAL enclosure ? Most likely the external enclosure does have a bridge board that converts SATA to USB and ENCRYPTS all the data on it's way.

But ... If you were ble to get the WD manuals from the drive then you can at least decrypt some data so most likely it's a Apple Filevault issue or any other MAC encryption, etc ....

As stated if that is the case you are in for pain now ...

DO NOT SWAP ROM CHIPS AGAIN, THIS DOESN'T HELP !!!

If the drive is working and you can scan the LBA space and you can get access to theuser manuals on the drive then the ROM CHIP is NOT THE PROBLEM as the drive is initializing properly !!!! Don't mess it up even further.

Just make sure the drive is working on the original external enclosure to decrypt the data and use the correct sector size if AF is an issue and then deal with the specific file system in use and possible Apple Filevault encryption, etc ...

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Unable to retrieve data after PCB swap
PostPosted: May 31st, 2018, 19:30 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9695
Location: Portugal
fzabkar wrote:
data-medics wrote:
Actually, if you're able to recover the WD files it's probably not the WD encryption messing you up.

The user area is encrypted, but the "SmartWare" area ("WD files") is not. The OP needs to reinstall the drive in its original enclosure, assuming it is not damaged. Only then can data recovery software hope to find anything.

A detailed photo of the PCB in the enclosure might help.


Agree !!!

But things might get way more dificult if the OP did mess up the partitions and if 3rd party encryption like Apple Filevault was used on the drive ...

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Unable to retrieve data after PCB swap
PostPosted: May 31st, 2018, 19:31 
Offline

Joined: May 31st, 2018, 17:43
Posts: 3
Location: United States
fzabkar wrote:
data-medics wrote:
Actually, if you're able to recover the WD files it's probably not the WD encryption messing you up.

The user area is encrypted, but the "SmartWare" area ("WD files") is not. The OP needs to reinstall the drive in its original enclosure, assuming it is not damaged. Only then can data recovery software hope to find anything.

A detailed photo of the PCB in the enclosure might help.



The drive came after a trip to Geek Squad, who advised the customer that the drive was done for. Geek Squad also threw away the enclosure and circuit board, not knowing it could be an important part of the drive. Forgot to mention also that I cloned the drive immediately after the PCB swap to another WD 1TB (Purple, all I had lying around...) Will a replacement enclosure PCB get the data, assuming I can even find a suitable model, or are they per-drive as well?

Also, who's Rambo up there? :lol:


Top
 Profile  
 
 Post subject: Re: Unable to retrieve data after PCB swap
PostPosted: May 31st, 2018, 20:49 
Offline

Joined: December 6th, 2012, 8:49
Posts: 205
Location: españa
uniquegeek wrote:
I diagnosed the drive as having a faulty motor controller, so I ordered a new PCB for swap.


If your diagnosis was correct, what made you think the file system was corrupted??

Why initialize a disk to recover data? I think you missed the first class of DR and now the file system if it's corrupted


Top
 Profile  
 
 Post subject: Re: Unable to retrieve data after PCB swap
PostPosted: June 1st, 2018, 2:04 
Offline

Joined: January 8th, 2008, 5:21
Posts: 840
Location: uk
colanco wrote:
uniquegeek wrote:
I diagnosed the drive as having a faulty motor controller, so I ordered a new PCB for swap.


If your diagnosis was correct, what made you think the file system was corrupted??

Why initialize a disk to recover data? I think you missed the first class of DR and now the file system if it's corrupted

The first lesson in data recovery is 'create a full backup image of the device'!!!


Top
 Profile  
 
 Post subject: Re: Unable to retrieve data after PCB swap
PostPosted: June 1st, 2018, 11:42 
Offline

Joined: May 28th, 2016, 9:16
Posts: 128
Location: Karlsruhe / Germany
dick wrote:
The first lesson in data recovery is 'create a full backup image of the device'!!!

I thought, that the first lesson in DR is: Don't drop the drive ;)

Does anyone have any information about FileVault?
Or is there any way to play with it without installing MacOS on an external drive and apply FileVault on it? Is it the same if I create an encrypted Volume in OS X?


Top
 Profile  
 
 Post subject: Re: Unable to retrieve data after PCB swap
PostPosted: June 1st, 2018, 12:29 
Offline
User avatar

Joined: April 3rd, 2011, 0:19
Posts: 1863
Location: Providence, RI
D_R wrote:
Is it the same if I create an encrypted Volume in OS X?


Yes, Filevault is just what Apple calls their OS encryption scheme. The data will just look like complete jibberish in the encrypted partition. Rebuilding the partition table can be a pain, especially if the encrypted partition doesn't start at the usual offset. I had to pretty much learn to write GPT from scratch for one case, but it's been a handy skill to have since then.

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company


Top
 Profile  
 
 Post subject: Re: Unable to retrieve data after PCB swap
PostPosted: June 1st, 2018, 15:46 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 10867
Location: Australia
uniquegeek wrote:
Forgot to mention also that I cloned the drive immediately after the PCB swap to another WD 1TB (Purple, all I had lying around...) Will a replacement enclosure PCB get the data, assuming I can even find a suitable model, or are they per-drive as well?

Go to WD's warranty checker web page and plug in your drive's serial number. That should tell you the product name of the enclosure. A replacement enclosure should be enough to retrieve your data, albeit with a corrupted file system.

Alternatively, there are freeware tools that should be able to decrypt your drive.

reallymine: WD MyBook/MyPassport decryption:
http://www.hddoracle.com/viewtopic.php?f=22&t=1488

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Unable to retrieve data after PCB swap
PostPosted: June 1st, 2018, 16:08 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9695
Location: Portugal
Not necessarly with a damaged file system as the OP claims to have a clone of the drive !!!

:D :D :D

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Unable to retrieve data after PCB swap
PostPosted: June 1st, 2018, 16:09 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9695
Location: Portugal
If you manage to get the correct enclosure and decrypt the original drive you should be able to decrypt the clone as well... To be on he safe side you can even re-clone the drive to another one just to make sure that you will not mess it up while attempting the decryption ...

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Unable to retrieve data after PCB swap
PostPosted: June 1st, 2018, 21:55 
Offline

Joined: December 6th, 2012, 8:49
Posts: 205
Location: españa
uniquegeek wrote:
Also, who's Rambo up there? :lol:


It is not about being "Rambos", but you have to be careful when working with third party data (customers). His sequence of actions indicates that he has a very basic knowledge of data recovery.

Don't take this the wrong way, everyone can be wrong and everyone has something to learn, but in my country there is a saying that says, "if you don't know, why do you get into?".

As spildit told you, if you get the SATA-USB bridge right and have the clone (???) you have probably solved the problem, or you can use Fzabkar's suggestion "reallymine".


Top
 Profile  
 
 Post subject: Re: Unable to retrieve data after PCB swap
PostPosted: June 2nd, 2018, 2:17 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 10867
Location: Australia
colanco wrote:
uniquegeek wrote:
Also, who's Rambo up there? :lol:


It is not about being "Rambos", ...

I'm not sure, but the OP could be referring to Don Quixote in my avatar. :?

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Unable to retrieve data after PCB swap
PostPosted: June 2nd, 2018, 9:11 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9695
Location: Portugal
colanco wrote:
(...)
As spildit told you, if you get the SATA-USB bridge right and have the clone (???) you have probably solved the problem, or you can use Fzabkar's suggestion "reallymine".


And if you want to pay $$$ there is also "@Roberto" method here - viewtopic.php?f=1&t=35048

:D

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Unable to retrieve data after PCB swap
PostPosted: June 2nd, 2018, 9:11 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9695
Location: Portugal
fzabkar wrote:
I'm not sure, but the OP could be referring to Don Quixote in my avatar. :?


:shock: :shock: :shock:

:lol:

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 20 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: jerovsek and 25 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group