PBA Accesss [ SMR WDC HDD's ]

[Amarbir[CDR-Labs]]

My Friends ,
I wanted to give you a scenario ,i am unable to recover any data using PC3k 7.0.32

1 : Charger HDD 2TB Formatted
2 : ROM Removed ,Read Using External Programmer + Saved in .BIN Format
3 : .BIN File Programmed Into SATA Unlocked Board
4 : Reading MBR Resulted in Encryption , Using Decryption option also Its Encrypted
5 : Me Assuming Keys are in MCU of Original USB Board
6 : No Point in Using PBA Accesss

7 : ROM Code That was Read Was Send To My Student With Version 7.1 PC3K utility
8 : I received Unlocked Code , Code Programmed In ROM chip And Soldered Into USB PCB
9 : 4 Capacitors Removed From USB Board And Converted To SATA
10 : Full SA Access And Sector Access To MBR indeed Gave MBR Code
11 : Me Assuming due to native CPU encryption is defeated
12 : I tried PBA access and still i cannot find any Video ,Photos
13 : What the hell is going on .....

[DR-Kiev]

Some chargers use CPU unique keys encryption (VUUS models for example), some - not.
PBA access doesn't involve CPU level decryption.
Same rule for different SMR WD drives.

[Amarbir[CDR-Labs]]

Some chargers use CPU unique keys encryption (VUUS models for example), some - not.
PBA access doesn't involve CPU level decryption.
Same rule for different SMR WD drives.

Hello,
My drive is " WDC WD20SDRW-11VUUS0 " so its VUUS . What i have understood is that PBA access does not take into account CPU level Keys and hence it will not work in my case ,How about i make a Mod 190 out of a donor with lba pattern writing and use that in utility ,I did try this that also did not work ,i mean i could not see any data although i did get access to sectors

Thanks

[DR-Kiev]

Some chargers use CPU unique keys encryption (VUUS models for example), some - not.
PBA access doesn't involve CPU level decryption.
Same rule for different SMR WD drives.

Hello,
My drive is " WDC WD20SDRW-11VUUS0 " so its VUUS . What i have understood is that PBA access does not take into account CPU level Keys and hence it will not work in my case ,How about i make a Mod 190 out of a donor with lba pattern writing and use that in utility ,I did try this that also did not work ,i mean i could not see any data although i did get access to sectors

Thanks

Decryption depend on "sector number", if you use not original 190mod , sector numbering will be confused.

[Amarbir[CDR-Labs]]

Some chargers use CPU unique keys encryption (VUUS models for example), some - not.
PBA access doesn't involve CPU level decryption.
Same rule for different SMR WD drives.

Hello,
My drive is " WDC WD20SDRW-11VUUS0 " so its VUUS . What i have understood is that PBA access does not take into account CPU level Keys and hence it will not work in my case ,How about i make a Mod 190 out of a donor with lba pattern writing and use that in utility ,I did try this that also did not work ,i mean i could not see any data although i did get access to sectors

Thanks

Decryption depend on "sector number", if you use not original 190mod , sector numbering will be confused.

Well,
i do have a case were i was able to recover the data using PBA , I will try my generated Mod 190 and see the results

[pepe]

not original T2 will conflict SMR zones and likely result in debugstop...

[Amarbir[CDR-Labs]]

not original T2 will conflict SMR zones and likely result in debugstop...

Pepe Sir ,
What if I have a Sequential T2 0 to end sector

[Doomer]

1. LBA sectors are not written sequentially
2. Encryption is AES-XTS that uses LBA number (not PBA number) to encrypt data, if LBA sector number is mismatched then data will not be decrypted
3. This model uses keys from CPU to decrypt user data, so the only way to decrypt the data is to read it, by original LBA numbers, with original PCB
4. Because original T2 is gone you cannot read original LBAs using non-original T2
5. I can still recover this case if you want to outsource.

[Amarbir[CDR-Labs]]

1. LBA sectors are not written sequentially
2. Encryption is AES-XTS that uses LBA number (not PBA number) to encrypt data, if LBA sector number is mismatched then data will not be decrypted
3. This model uses keys from CPU to decrypt user data, so the only way to decrypt the data is to read it, by original LBA numbers, with original PCB
4. Because original T2 is gone you cannot read original LBAs using non-original T2
5. I can still recover this case if you want to outsource.

Doomer Sir ,
I ver 7.2 of PC3K Tool they have added the capability to generate Mod 190 is this kinda stuff possible now with cpu encrypted drives .Because now we do not need to access drive in pba mode imho

[gps31]

1. LBA sectors are not written sequentially
2. Encryption is AES-XTS that uses LBA number (not PBA number) to encrypt data, if LBA sector number is mismatched then data will not be decrypted
3. This model uses keys from CPU to decrypt user data, so the only way to decrypt the data is to read it, by original LBA numbers, with original PCB
4. Because original T2 is gone you cannot read original LBAs using non-original T2
5. I can still recover this case if you want to outsource.

Doomer Sir ,
I ver 7.2 of PC3K Tool they have added the capability to generate Mod 190 is this kinda stuff possible now with cpu encrypted drives .Because now we do not need to access drive in pba mode imho

In Demo video they exampled only Palmer which has no Unique encryption in MCU. So that will work. But in charger in this case there is unique key in MCU and decryption will good with correct lba.

In PC3K they create T2 with linear Method that means they are arranging PBA sectors by considering Defects and generate T2 in Linear Method. It is nothing but we access sectors in PBA in the name of Linear LBA Scheme but it is not original LBA. so decryption my not good.


The above is only my observation , May be my view is wrong.

[Amarbir[CDR-Labs]]

1. LBA sectors are not written sequentially
2. Encryption is AES-XTS that uses LBA number (not PBA number) to encrypt data, if LBA sector number is mismatched then data will not be decrypted
3. This model uses keys from CPU to decrypt user data, so the only way to decrypt the data is to read it, by original LBA numbers, with original PCB
4. Because original T2 is gone you cannot read original LBAs using non-original T2
5. I can still recover this case if you want to outsource.

Doomer Sir ,
I ver 7.2 of PC3K Tool they have added the capability to generate Mod 190 is this kinda stuff possible now with cpu encrypted drives .Because now we do not need to access drive in pba mode imho

In Demo video they exampled only Palmer which has no Unique encryption in MCU. So that will work. But in charger in this case there is unique key in MCU and decryption will good with correct lba.

In PC3K they create T2 with linear Method that means they are arranging PBA sectors by considering Defects and generate T2 in Linear Method. It is nothing but we access sectors in PBA in the name of Linear LBA Scheme but it is not original LBA. so decryption my not good.


The above is only my observation , May be my view is wrong.

Well,
i would only blow my money for update if this actually works ,Can someone with Ver 7.2 and a mcu encryption based drive actually confirm this please

[Amarbir[CDR-Labs]]

Hi,
To All My Seniors ...

Today Again i Tried Using PC3K 7.2 T2 Linear Functions

1 : HDD is Western Digital Palmer 1TB Model : WDC WD10SDRW-11A0XS1 , Serial : WD-WXT2AA0R4Z25 ,Firmware : 01.01A01
2 : Case Is With CPU Level Encryption
3 : USB Rom Read , Unlocked Using PC3K 7.2 , Programmed Back Into USB PCB
4 : USB Board Converted To SATA
5 : PC3K Able To Access Firmware And All Sectors Are Good " But ZERO " Due To Formatting
6 : Tried To Use PBA Access Method "I Could Not Get Any RAW Data "
7 : Used PC3K 7.2 New Mod 190 To T2 Linear Access Generation And Then Programming That Modded Mod 190 To SA
So That We Have Fast PBA Type Access To The Drive
8 : Work is In Progress But Still No Data Found " Why Did Acelab Make This Function Then ? " , Will CPU Level Encryption Drives
Still Not Work With This New Acelab Function ?

[pepe]

do you get the same data using pba and the linear translator?

[Amarbir[CDR-Labs]]

do you get the same data using pba and the linear translator?

Pepe Sir ,
Very Good Observation ,I Will cross Check And Revert Back Tommorow

[Amarbir[CDR-Labs]]

do you get the same data using pba and the linear translator?

Pepe Sir ,
Out of curiosity ,Lets assume it does or does not ,In my experiment above i at least still cannot recover this type of drives ,Do you have a idea what i can do or might can you share a point from where i can start experimenting