All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 7 posts ] 
Author Message
 Post subject: WD My Book drive Recovery
PostPosted: June 28th, 2018, 17:36 
Offline

Joined: June 28th, 2018, 14:54
Posts: 5
Location: San Antonio, TX
Hello everyone, I recently acquired a WD My Book 3TB drive in which the enclosure stopped working and the hard drive removed and connected to a Windows PC. The drive was quick formatted to NTFS and attempted data recovery but the data is scrambled. I am assuming this is due to the encryption.

I was able to secure a working enclosure board to connect the drive back up to and connected it to the PC. I have attempted recovery programs like Easeus and Stellar Labs Phoenix but am only getting the scrambled data.

I know for sure that I have a Symwave chipset and also have a backup of the drive to use for testing purposes. At this point I am lost and unsure of what to do. Can anyone assist?

Also, I understand that it is not guaranteed to recover the data, I am doing this as a side project and am comfortable if the data is lost forever.


Top
 Profile  
 
 Post subject: Re: WD My Book drive Recovery
PostPosted: June 28th, 2018, 18:56 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9981
Location: Portugal
Ups ... I did just reply to your other post !!!

- What is the full model of the drive ?
- The drive does have a SATA PCB, correct ? When connected to the PC does it work properly ? Can you scan the full surface with MHDD/VICTORIA/ETC ?
- If so CLONE the drive with hddsuperclone or ddrescue and work with the clone !
- Are you sure the drive is realy ok and the problem is with the enclosure only ? If so did you try to buy an equal enclosure PCB and mover ROM from old/damaged enclosure to the new one ? Does the drive or the clone work on the new enclosure ?


If you did already clone the drive sector by sector you can try reallymine NO THE CLONE to attempt decryption ! - http://www.hddoracle.com/viewtopic.php?f=22&t=1488

You can also try this - http://www.hddoracle.com/viewtopic.php?f=36&t=2228

Or you can try to contact @Roberto for help (and pay) - viewtopic.php?f=1&t=35048

The fact that you did FORMAT the drive (encrypted) might have cause way more damage now. But with some luck it might still be possible to extract the keys, force decryption and recover at least partialy the data with logic data recovery software ...

Good luck.

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: WD My Book drive Recovery
PostPosted: June 28th, 2018, 19:11 
Offline

Joined: June 28th, 2018, 14:54
Posts: 5
Location: San Antonio, TX
I was about to reply to your reply on the other post!

- WDBACW0030HBK-01 - full model number
- Correct, it does have a SATA PCB. When connected to the drive I am able to see the drive. I have not attempted to use MHDD or Victoria as I have not yet heard of those.
- I have a cloned version of the drive through DDRescue
- I'm 99% confident that the issue was with the enclosure. With the old board the drive wouldn't stay on/connected for more than a few minutes at a time. Since swapping the PCB with a duplicate it connects and stays connected. No clicking issues with the drive.

Something to note, when I attempted to use some software like DMDE or RStudio and use the cloned copy, the partition shows "My Book" which was the original name for the drive. This leads me to believe that I may still be able to access the files but I am not 100% bought in and understand they may be lost.

I'm familiar with running reallymine through Ubuntu but not familiar with what you were referring to as far as 'NO THE CLONE'. Is there a way to decrypt the already copied image? Ill be honest, I'm just now reading the link that you included so I may find my answer but I figured I'd ask just in case I'm miss understanding. For reference, when I have run reallymine before I simply ran `sudo reallymine decrypt /dev/sda /media/user/disk1/backup.img'

Also the PCB has a chip ASM1051W which I noticed was referenced in one of the links that you provided indicating that the drive may not be encrypted? I'm still muddling my way through all the info but figured I'd share with what I could.

I appreciate the reply as well! I apologize for posting in another thread. Was not my intention to mix issues.


Top
 Profile  
 
 Post subject: Re: WD My Book drive Recovery
PostPosted: June 28th, 2018, 19:39 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9981
Location: Portugal
Ok :

- Can you tell me the full model of the drive INSIDE THE ENCLOSURE ? The drive itself must have a sticker with a model.

- COOL, if you do have a FULL clone done with ddrescue were you able to clone the ENTIRE drive ? If so forget about MHDD/VICTORIA. You already have all the sectors copies out.

- Did you FORMAT the main drive or the clone ? Do you have a drive in the ORIGINAL condition ? Without FORMAT to NTFS ?

- Check the ENCLOSURE PCBs. The one that you did use for replacement have the same NUMBER than the original one ? It should. Also try to move the ROM CHIP from the ENCLOSURE PCB (original) to the new one.

- Volume name will not be encrypted so you can see the "My Book" name of the drive.

- The best option is to FIX the enclosure or replace the PCB + ROM and make it work again either with the original drive or clone. If you can't do it you can try to decrypt the image with reallymine.

- Most likely it will be encrypted but you might have as well a sector size problem so idealy you would use the fixed enclosure....

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: WD My Book drive Recovery
PostPosted: June 28th, 2018, 20:41 
Offline

Joined: June 28th, 2018, 14:54
Posts: 5
Location: San Antonio, TX
- I can't tell you at this very moment as I am currently at work. Later this evening I will be able to provide you the exact information of the drive itself.

- Forgetting about MHDD/VICTORIA.

- Originally the drive was formatted to NTFS, at this point the drive is not in original condition unless I run DISKPART and Clean the disk to make it non-initialized. Otherwise the drive was quick formatted to NTFS.

- Do not have the original enclosure PCBs as the original owner tossed it. As far as I can tell the information should be the same but I honestly could not tell you.

- Gotcha. High hopes for me, haha.

- Since I do not have the original enclosure and therefore unable to use the fixed one, I take it my chances are dwindling?


Top
 Profile  
 
 Post subject: Re: WD My Book drive Recovery
PostPosted: June 28th, 2018, 20:46 
Offline

Joined: October 16th, 2013, 13:21
Posts: 717
Location: Brazil
It seems to me he has a clone of the formatted drive.

Just for thoughts : when connecting the drive directly through sata, does it shows the full LBAs, and when through the usb bridge, it shows a little less because it reserves some space for the virtual cd ? That is, depending on the sizes, and even on512/4k alignment, could it be that he partitioned and formatted over the sectors that used to contain the decryption key ?


Top
 Profile  
 
 Post subject: Re: WD My Book drive Recovery
PostPosted: June 30th, 2018, 12:36 
Offline

Joined: June 28th, 2018, 14:54
Posts: 5
Location: San Antonio, TX
The model number of the drive that was in the inclosure is WD30EZRX.

Also at the moment, I am currently running reallymine in an attempt to get a decrypted img to attempt file recovery. Beyond that, is there anything else I can attempt doing to attempt recovery of the data.

At the moment only 60.8 GB has been decrypted in the last 24+ hours that I have been running it. Seems like I may be waiting a while for the decryption to complete.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 7 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Google [Bot] and 20 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group