All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 8 posts ] 
Author Message
 Post subject: WD decrypt sectors after reading
PostPosted: July 8th, 2016, 10:33 
Offline

Joined: November 17th, 2014, 13:18
Posts: 75
Location: roma,italia
Hello gurus,
in your opinion is possible to decrypt read sectors after reading?
Specifically, i have read one bad WD drive and after data-extraction process none of the files works good, so after checking better, i have discovered that this damn drive is encrypted.
Strange thing in this case because without decryption i could read the MFT correctly, therefore i haven't thinked that the drive was crypted.

Thanks in advance for any help.


Top
 Profile  
 
 Post subject: Re: WD decrypt sectors after reading
PostPosted: July 8th, 2016, 12:00 
Offline

Joined: August 18th, 2010, 17:35
Posts: 3314
Location: Massachusetts, USA
If can read files in the MFT, then most likely there is no full disk or volume level encryption. If anything, maybe file based encryption.

_________________
Hard Disk Drive, SSD, USB Drive and RAID Data Recovery Specialist in Massachusetts


Top
 Profile  
 
 Post subject: Re: WD decrypt sectors after reading
PostPosted: July 12th, 2016, 10:19 
Offline

Joined: November 17th, 2014, 13:18
Posts: 75
Location: roma,italia
I think the same, in general cases if i have some encryption on a drive i can use the decryption option from dataextractor, but without dataextractor how can i decrypt an encrypted drive?
Currently i'm working on a dd of the encrypted drive and not on the damaged media, i'm struggling on how to decrypt it.
Any ideas?


Top
 Profile  
 
 Post subject: Re: WD decrypt sectors after reading
PostPosted: July 12th, 2016, 11:37 
Offline
User avatar

Joined: February 9th, 2009, 16:13
Posts: 2215
Location: Ontario, Canada
I haven't played with it, but ReallyMine might work.

Https:github.com/andlabs/reallymine

If anyone tries it, be sure to report back your findings.

_________________
Luke
RAID Data Recovery


Top
 Profile  
 
 Post subject: Re: WD decrypt sectors after reading
PostPosted: July 12th, 2016, 12:06 
Offline

Joined: December 8th, 2010, 11:37
Posts: 648
Location: Ottawa, Canada
If it's file encryption (MFT is not encrypted), ask the customer what they used to encrypt the files.

_________________
Sabo Computer Repairs & Data Recovery


Top
 Profile  
 
 Post subject: Re: WD decrypt sectors after reading
PostPosted: July 12th, 2016, 15:45 
Offline

Joined: August 18th, 2010, 17:35
Posts: 3314
Location: Massachusetts, USA
We don't have any sort of understanding of how the the drive is encrypted to be able to say how to decrypt.

Need more.details about the drive and config circumstances.

_________________
Hard Disk Drive, SSD, USB Drive and RAID Data Recovery Specialist in Massachusetts


Top
 Profile  
 
 Post subject: Re: WD decrypt sectors after reading
PostPosted: July 12th, 2016, 20:52 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 11620
Location: Australia
lcoughey wrote:
I haven't played with it, but ReallyMine might work.

Https:github.com/andlabs/reallymine

If anyone tries it, be sure to report back your findings.

"jordash" reports success:

reallymine: WD MyBook/MyPassport decryption :
http://www.hddoracle.com/viewtopic.php? ... 488&p=7870

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: WD decrypt sectors after reading
PostPosted: July 13th, 2016, 13:32 
Offline
User avatar

Joined: April 3rd, 2011, 0:19
Posts: 1925
Location: Providence, RI
It could also be that the customer initialized the drive after removing it from a WD My Book enclosure. I've seen that plenty of times.

If it is the WD built in encryption, DE can process the sectors after the fact just fine. You just need to create a submap of the green sectors and then run the option to process decryption on the submap. I've had to do it a couple times myself.

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 8 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 4 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group