Comparing 1st. sector with other 2 PCBs (3k/winhex) in SpyG2 Ultra

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein

Wow ,
I would assume even if the drive if Encrypted By CPU ,We could swap PCB's ,Is this what you are trying to observe in this Anwar sir .

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com

you are far Amarbir from the point

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein

Well,
You Are a League Apart Anwar Sir ...

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com

Amarbir

SpyG2 Ultra used 2 other USB3 with the same ROM written to both & gives the same Enc. pattern in sec0

means something?

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein

do you get different data from lba 0 if you turn of SED?

_________________
Adatmentés - Data recovery

Sector 0 does not look like a GPT MBR that was encrypted by WD's AES algorithm. I would normally expect to see two identical 16-byte lines in the partition table corresponding to two empty partition entries. Or am I misunderstanding something?

_________________
A backup a day keeps DR away.

on these drives encryption is salted with something lba and offset (somehing like that), so you cannot see any patterns.

_________________
Adatmentés - Data recovery

on these drives encryption is salted with something lba and offset (somehing like that), so you cannot see any patterns.
edit: sorry for the double post

_________________
Adatmentés - Data recovery

@pepe

I didn`t change the SED (am aware of this)

@ fzabkar
Yes, its Encrypted,,,


The point here is no matter what Other USB pcb you use the encrypted sectors are the same (tested on this family now but i assume the others are the same)

I hope will get the good news about those MCU locked drives

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein

This is an interesting resource:

https://www.zeroalpha.com.au/?view=article&id=124:rtfm-wd&catid=17
https://www.zeroalpha.com.au/?view=article&id=124:rtfm-wd&catid=17#section-810033
https://www.zeroalpha.com.au/?view=article&id=124:rtfm-wd&catid=17#section-810035

@einstein9, can you upload your ROM?

What is the capacity (in sectors) that is reported by the USB mass storage device?

How do these drives behave if there is no key at the end of the UA?

_________________
A backup a day keeps DR away.

@ fzabkar

attached is the ROM

"What is the capacity (in sectors) that is reported by the USB mass storage device?"
you will find it on the photo i uploaded (the inner photo top left 5TB - 9767473632)

FYI (since you are not into DR) those MCU PCBs are a must to access the data,
Original USB3 PCB >>> Data accessiable
Any other USB3 PCB (my case here) >>> whole drive encrypted (unique key inside MCU for data access)

My point is: no matter what other USB3 pcb you use >> sectors encryption is the same (as in photo to compare)
does this mean something??? maybe and may not

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein

Your original post confused me. You seemed to be suggesting that all PCBs, including the native one, produced the same encrypted result. Therefore, I was wondering whether the ROM code was ignoring the MCU key.

_________________
A backup a day keeps DR away.

I thought so,,, thats why i explained it in details on my prev. post

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein

I suspect that an explanation for this behaviour might have something to do with modules 0x181, 0x1A2, 0x1B0 and 0x1B6.

Module 0x1A2 has a 0x60-byte digital signature.


Module 0x1B0 has a 0x100-byte digital signature.


Module 0x1B0 has 3 digital signatures.

0x180-byte signature


0x200-byte signature


0x100-byte signature

_________________
A backup a day keeps DR away.

I wrote the same ROM without any modification to those USB pcbs and as i said before and others too

Unique encryption key is located inside MCU (original pcb) not related to the ROM itself only

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein

what do you get with those 2 non-native pcbs if you turn SED off ?

_________________
Adatmentés - Data recovery

you mean writing original ROM (UN-patched by 3k) to usb3 results the same encrypted pattern as in photo in my 1st. post

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein

SED off = turn it off in 02, use orig rom and the non-native pcb.
do you get the same data?

_________________
Adatmentés - Data recovery

Yes pepe the same

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein