My Passport WD5000BMVW-11AJGS0 weird data recovery problem

[manager_lg]

Hello friends!

My Passport WDC WD5000BMVW-11AJGS0 (Fblite) 06.0MH with Jmicron usb bridge was stuck in BSY state. So I changed the USB bridge pcb board to compatible SATA one, swapped U12, got the SA access and fixed the problem. Then I put the USB bridge pcb board back and imaged the drive with no single bad sector. The problem is that scanning the image finds only 16Gb of files instead of needed 400 Gb. When I opened bin image with hex editor, I found that 95% of the data look as following:



I hardly believe that I faced the encryption problem coz I used the native pcb board, and I also succesfuly recovered ~5% of files. Analysing an encrypted image would not give any result at all.

So gimme a clue guys. I also checked the SA modules for corruption and all of them seem to be ok.

[lcoughey]

Here are a few possible options:

1. Client thought there was more data than there is
2. Client thought they were writing data to this drive when they were actually writing somewhere else
3. Client (or you) go the drive mixed up and you are working with the wrong drive

[manager_lg]

lcoughey, thanx very much for the reply, friend! I already asked him those questions. Client used this drive for 3 years as a backup storage device. This was the only drive he used, and he assured me that the drive was almost full of data. As for me, I am more than sure that the drive I am working with is the right one.

[manager_lg]

Any guesses are welcome, especially those who are professionals or have much experience with WD drives (Spildit, Fzabkar)

[manager_lg]

Maybe there is some other kind of encryption like maybe the client did use 3rd party tools like Truecrypt, bitlocker, etc ... to encrypt the data ?

Here you are, sir! Thanks for the reply! Client never mentioned about encryption of any kind but I will ask him this question tomorrow.

[maximus]

Here are a few possible options:

1. Client thought there was more data than there is
2. Client thought they were writing data to this drive when they were actually writing somewhere else
3. Client (or you) go the drive mixed up and you are working with the wrong drive

+1

That pattern almost certainly indicates actual zeros on the drive. I bet if you imaged it with the SATA board, those areas where you see that pattern are filled with zeros. And the most likely way those areas are filled with actual zeros is from the factory, meaning no data has been written to those areas by the person using the drive.

If the drive itself is filled with zeros, and it is read through the USB bridge, the encryption will show a pattern like that. The same is true if you fill the drive with zeros with the USB board, and then read it with a SATA board, it will show a similar pattern.

The only other possibility is that there is something weird going on where the drive is responding with zeros when it shouldn’t, but the USB bridge is not detecting any sort of error. But that would seem unlikely.

[manager_lg]

Hello friends! I apologise for taking this long to write a final report.

You guys were right that those patterns are zeros on the drive written through SATA controller.

(Same offsets in the image copied thru SATA)



I wanna tell you the whole story behind this case. This drive had been in an electronic repair shop before the client came to me for help. The soldering iron guy managed to find the correct pins on the USB pcb board to get SATA connection. The problem was that he knew nothing about the USB-bridge encryption and considering that SA problem was quite ordinary (poorly readable 11-th module), I guess that the drive somehow got RDY by itself which allowed him to get UA acess through SATA interface. As the client stated, the repair shop guy scanned the drive with R-Studio and (of course) found nothing. Then I guess he did some silly stuff like using MHDD or Victoria etc. to make the drive "healthy again" and eventually wiped out 95% of lba...

[HddDonorMarket]

Same case.
USB Bridge encryption view.

I solved this case like this>>>
https://forum.hddguru.com/viewtopic.php?f=28&t=37866