Hello gurus,
in your opinion is possible to decrypt read sectors after reading?
Specifically, i have read one bad WD drive and after data-extraction process none of the files works good, so after checking better, i have discovered that this damn drive is encrypted.
Strange thing in this case because without decryption i could read the MFT correctly, therefore i haven't thinked that the drive was crypted.

Thanks in advance for any help.

If can read files in the MFT, then most likely there is no full disk or volume level encryption. If anything, maybe file based encryption.

_________________
Hard Disk Drive, SSD, USB Drive and RAID Data Recovery Specialist in Massachusetts

I think the same, in general cases if i have some encryption on a drive i can use the decryption option from dataextractor, but without dataextractor how can i decrypt an encrypted drive?
Currently i'm working on a dd of the encrypted drive and not on the damaged media, i'm struggling on how to decrypt it.
Any ideas?

I haven't played with it, but ReallyMine might work.

Https:github.com/andlabs/reallymine

If anyone tries it, be sure to report back your findings.

_________________
Luke
Recovery Force Data Recovery

If it's file encryption (MFT is not encrypted), ask the customer what they used to encrypt the files.

_________________
Sabo Computer Repairs & Data Recovery

We don't have any sort of understanding of how the the drive is encrypted to be able to say how to decrypt.

Need more.details about the drive and config circumstances.

_________________
Hard Disk Drive, SSD, USB Drive and RAID Data Recovery Specialist in Massachusetts

"jordash" reports success:

reallymine: WD MyBook/MyPassport decryption :
http://www.hddoracle.com/viewtopic.php? ... 488&p=7870

_________________
A backup a day keeps DR away.

It could also be that the customer initialized the drive after removing it from a WD My Book enclosure. I've seen that plenty of times.

If it is the WD built in encryption, DE can process the sectors after the fact just fine. You just need to create a submap of the green sectors and then run the option to process decryption on the submap. I've had to do it a couple times myself.

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company