All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 8 posts ] 
Author Message
 Post subject: WDC WD15NMVW encrypted data
PostPosted: February 1st, 2019, 3:57 
Offline

Joined: August 3rd, 2012, 7:47
Posts: 394
Location: slovenija
Hello,

I convert this drive from USB to SATA.
FW backup OK.
Decrypted image dane without errors, but data are still encrypted.
I didn't remove SED checkbox. under Edit HDD ID ->security subsystem

Is it enough to remove SED checkbox, or I need to perform task again.


Attachments:
Log.log [103.99 KiB]
Downloaded 489 times
Top
 Profile  
 
 Post subject: Re: WDC WD15NMVW encrypted data
PostPosted: February 1st, 2019, 10:02 
Offline
User avatar

Joined: July 12th, 2010, 4:38
Posts: 1418
Location: Portugal
You need re-image it again with the Decrypt option active so it can read the sectors decrypted.

_________________
http://www.pclab.com.pt facebook.com/PCLAB.A.T
ACELab partner


Top
 Profile  
 
 Post subject: Re: WDC WD15NMVW encrypted data
PostPosted: February 1st, 2019, 22:26 
Offline

Joined: July 20th, 2018, 2:14
Posts: 13
Location: Oregon, United States
Data extractor has an option to decrypt after imaging, that would be the fastest course of action. If PC3K can't find the key, you need to swap back to the USB board after doing whatever repairs you need with the SATA board. The key isn't always stored on disk, sometimes it's in the board, in which case you need the USB board to decrypt it.


Top
 Profile  
 
 Post subject: Re: WDC WD15NMVW encrypted data
PostPosted: February 2nd, 2019, 3:12 
Offline
User avatar

Joined: January 28th, 2009, 10:54
Posts: 3452
Location: Greece
https://blog.acelaboratory.com/pc-3000- ... image.html

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners


Top
 Profile  
 
 Post subject: Re: WDC WD15NMVW encrypted data
PostPosted: February 5th, 2019, 15:34 
Offline

Joined: August 3rd, 2012, 7:47
Posts: 394
Location: slovenija
Thank you very much Pclab, Datahaze and Northwind for your suggestions.

As I already write, during imaging decryption was turned on(all squares was browngreen, not green).
I check in Marwel utillity and put check on remove SED.
I create new task->image to file(single file)
DE reported that physical sector size is different… and I select No.
Before I start imaging I check if files are visible and I can see folder and files structure, I can view files. So I can extract all files.

But when I create image and then I try to work with image in DE, I'm unable to see any file structure.
So if I open drive directly in DE, I can see files and folder, but if I do the same with image there is no file system visible.
I can recover everything, but created image is encrypted. Any idea, why everything is still encrypted


Top
 Profile  
 
 Post subject: Re: WDC WD15NMVW encrypted data
PostPosted: February 6th, 2019, 4:37 
Offline
User avatar

Joined: July 12th, 2010, 4:38
Posts: 1418
Location: Portugal
If it's encrypted how can you recover files?
How did you get the files then?

_________________
http://www.pclab.com.pt facebook.com/PCLAB.A.T
ACELab partner


Top
 Profile  
 
 Post subject: Re: WDC WD15NMVW encrypted data
PostPosted: February 6th, 2019, 6:29 
Offline

Joined: August 3rd, 2012, 7:47
Posts: 394
Location: slovenija
Hello pclab,

in DE you can work with drive or with image. There is an icon on top right side(green status - HDD, red status - image). Image is done 100% without errors. Everything is decrypted.
If I click explore with green status, I can see file structure and I can extract files and folders.
If i click explore with red status, when I try to expand tree I receive message for quick table or partition is empty...


Top
 Profile  
 
 Post subject: Re: WDC WD15NMVW encrypted data
PostPosted: February 6th, 2019, 10:00 
Offline
User avatar

Joined: July 12th, 2010, 4:38
Posts: 1418
Location: Portugal
Hi Jerovsek

And have you already compared some sectors by HEX to see if they really match or not?
Have you also contacted ACE support to see if there's some kind of bug?
That is strange.

_________________
http://www.pclab.com.pt facebook.com/PCLAB.A.T
ACELab partner


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 8 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Google [Bot], Google Adsense [Bot] and 65 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group