All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 11 posts ] 
Author Message
 Post subject: My Passport WD5000BMVW-11AJGS0 weird data recovery problem
PostPosted: December 27th, 2018, 17:03 
Offline

Joined: September 15th, 2017, 4:48
Posts: 36
Location: Ukraine, Lugansk city
Hello friends!

My Passport WDC WD5000BMVW-11AJGS0 (Fblite) 06.0MH with Jmicron usb bridge was stuck in BSY state. So I changed the USB bridge pcb board to compatible SATA one, swapped U12, got the SA access and fixed the problem. Then I put the USB bridge pcb board back and imaged the drive with no single bad sector. The problem is that scanning the image finds only 16Gb of files instead of needed 400 Gb. When I opened bin image with hex editor, I found that 95% of the data look as following:

Image

I hardly believe that I faced the encryption problem coz I used the native pcb board, and I also succesfuly recovered ~5% of files. Analysing an encrypted image would not give any result at all.

So gimme a clue guys. I also checked the SA modules for corruption and all of them seem to be ok.


Top
 Profile  
 
 Post subject: Re: My Passport WD5000BMVW-11AJGS0 weird data recovery probl
PostPosted: December 27th, 2018, 17:27 
Offline
User avatar

Joined: February 9th, 2009, 16:13
Posts: 2155
Location: Ontario, Canada
Here are a few possible options:

1. Client thought there was more data than there is
2. Client thought they were writing data to this drive when they were actually writing somewhere else
3. Client (or you) go the drive mixed up and you are working with the wrong drive

_________________
Luke
RAID Data Recovery


Top
 Profile  
 
 Post subject: Re: My Passport WD5000BMVW-11AJGS0 weird data recovery probl
PostPosted: December 27th, 2018, 17:57 
Offline

Joined: September 15th, 2017, 4:48
Posts: 36
Location: Ukraine, Lugansk city
lcoughey, thanx very much for the reply, friend! I already asked him those questions. Client used this drive for 3 years as a backup storage device. This was the only drive he used, and he assured me that the drive was almost full of data. As for me, I am more than sure that the drive I am working with is the right one.


Top
 Profile  
 
 Post subject: Re: My Passport WD5000BMVW-11AJGS0 weird data recovery probl
PostPosted: December 27th, 2018, 18:03 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 10526
Location: Portugal
Maybe there is some other kind of encryption like maybe the client did use 3rd party tools like Truecrypt, bitlocker, etc ... to encrypt the data ?

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: My Passport WD5000BMVW-11AJGS0 weird data recovery probl
PostPosted: December 27th, 2018, 18:04 
Offline

Joined: September 15th, 2017, 4:48
Posts: 36
Location: Ukraine, Lugansk city
Any guesses are welcome, especially those who are professionals or have much experience with WD drives (Spildit, Fzabkar) :D :D :D


Top
 Profile  
 
 Post subject: Re: My Passport WD5000BMVW-11AJGS0 weird data recovery probl
PostPosted: December 27th, 2018, 18:09 
Offline

Joined: September 15th, 2017, 4:48
Posts: 36
Location: Ukraine, Lugansk city
Spildit wrote:
Maybe there is some other kind of encryption like maybe the client did use 3rd party tools like Truecrypt, bitlocker, etc ... to encrypt the data ?

Here you are, sir! Thanks for the reply! :) Client never mentioned about encryption of any kind but I will ask him this question tomorrow.


Top
 Profile  
 
 Post subject: Re: My Passport WD5000BMVW-11AJGS0 weird data recovery probl
PostPosted: December 27th, 2018, 23:25 
Online

Joined: January 29th, 2012, 1:43
Posts: 526
Location: United States
lcoughey wrote:
Here are a few possible options:

1. Client thought there was more data than there is
2. Client thought they were writing data to this drive when they were actually writing somewhere else
3. Client (or you) go the drive mixed up and you are working with the wrong drive

+1

That pattern almost certainly indicates actual zeros on the drive. I bet if you imaged it with the SATA board, those areas where you see that pattern are filled with zeros. And the most likely way those areas are filled with actual zeros is from the factory, meaning no data has been written to those areas by the person using the drive.

If the drive itself is filled with zeros, and it is read through the USB bridge, the encryption will show a pattern like that. The same is true if you fill the drive with zeros with the USB board, and then read it with a SATA board, it will show a similar pattern.

The only other possibility is that there is something weird going on where the drive is responding with zeros when it shouldn’t, but the USB bridge is not detecting any sort of error. But that would seem unlikely.

_________________
http://www.sdcomputingservice.com
Home of HDDSuperClone and HDDSuperTool


Top
 Profile  
 
 Post subject: Re: My Passport WD5000BMVW-11AJGS0 weird data recovery probl
PostPosted: December 28th, 2018, 14:51 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 10526
Location: Portugal
Yeah ... agree .... That pattern does look like "encrypted" sectors with zeros typical on those WD drives...

Strange ...

Maybe your client did try something that ended up clearing data on the drive ?

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: My Passport WD5000BMVW-11AJGS0 weird data recovery probl
PostPosted: December 28th, 2018, 14:54 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 10526
Location: Portugal
Uhhh .... Try to image the drive with SATA board first and check if you do get errors. Also check the encrypted data and confirm that the pattern that you see is the same (for zeros) on LBA range near the middle and end of the drive ...

Maybe while you were cloning over USB something went wrong and the drive start sending zeros instead of actual data ? Maybe PCB is not working as expected and you end up cloning empty sectors instead of actual data ?

If you clone the drive with the SATA PCB and if the LBAs do have data the pattern of the encrypted sectors will change and will not look like the same as the sectors will contain diferent random data and not zeros ...

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: My Passport WD5000BMVW-11AJGS0 weird data recovery probl
PostPosted: December 30th, 2018, 12:32 
Offline

Joined: September 15th, 2017, 4:48
Posts: 36
Location: Ukraine, Lugansk city
Hello friends! I apologise for taking this long to write a final report.

You guys were right that those patterns are zeros on the drive written through SATA controller.

(Same offsets in the image copied thru SATA)

Image

I wanna tell you the whole story behind this case. This drive had been in an electronic repair shop before the client came to me for help. The soldering iron guy managed to find the correct pins on the USB pcb board to get SATA connection. The problem was that he knew nothing about the USB-bridge encryption and considering that SA problem was quite ordinary (poorly readable 11-th module), I guess that the drive somehow got RDY by itself which allowed him to get UA acess through SATA interface. As the client stated, the repair shop guy scanned the drive with R-Studio and (of course) found nothing. Then I guess he did some silly stuff like using MHDD or Victoria etc. to make the drive "healthy again" and eventually wiped out 95% of lba...


Top
 Profile  
 
 Post subject: Re: My Passport WD5000BMVW-11AJGS0 weird data recovery probl
PostPosted: January 4th, 2019, 16:39 
Online
User avatar

Joined: June 16th, 2018, 12:09
Posts: 127
Location: Turkey
Same case.
USB Bridge encryption view.

I solved this case like this>>>
https://forum.hddguru.com/viewtopic.php?f=28&t=37866

_________________
A Recovery Service In Turkey . Veri Kurtarma Türkiye https://www.digitalverikurtarma.com
Donor Drives hdddonormarket.com


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 11 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Exabot [Bot], HddDonorMarket and 10 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group