Hi! my problem is that when you connect the WD my book drive via USB to a laptop. it displays the information that, the disk must be formatted, the drive is visible in the system, but you can not do it access the file format is RAW.

I tried to find the mbr by testdisk and DMDE and others software but unfortunately nothing.

But anyway...

My situation is a little different than all described here, because the damage has been caused by the user...
So it was that, after connecting the user disk to a USB port, showed up information from windows the disk must be formatted, and then user accidentally pressing the button formating now......., but the drive quickly disconnected. (I know it's too late)

I forgot to tell first, discs had established a password, but it is known, so it remains only a matter of encryption SED.

actually the problem lies in the fact that the disk visible in winhex includes all hex values, so formatting is not removed everything, otherwise you can see there that the record is in the form of encrypted.

it seems to me that a defective entry responsible for initialization VCD because it does not appear already a message asking you to enter a password.

I think i must try to restore correctly VCD and later will be able to decrypt all files. I tried to install the firmware but unfortunately it did not restore a virtual drive.

I know everyone of you had a different experience with these hdd and it's different answer sometimes.

maybe someone is able to do to help? eager to present all the results and values her.

I have also one more a disk my book essential 1TB WD "green" unfortunately he has an older version of USB bridge. So I think that nothing will change some of the bridge, etc., it seems to me, however, that my USB bridge is not damage and it was not his fault.

I hope someone can advise something....

When you press format it is actually just changing encryption keys. And drive needs for it just seconds. So most likely keys were changed and what is why you don't see message about password. I think your only hope someone who can hack encryption.

Can you see this article http://www.tomshardware.com/answers/id- ... d-hdd.html

_________________
I am from cuudulieuocung.org and I am currently banned from this forum for creating multiple accounts to promote my crappy website.

Quick question. How was this "format" performed? Are we talking about just a Windows format, or through the WD SmartWare utility? Makes a huge difference from a data recovery perspective.

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company

I'm sorry if I wrote wrong , after connecting the hard drive to USB computer port, that was running Windows 10 was displayed information "You need to format the disk in drive H: before you can use it"

Then...

It was pressed accidentally format the disk, and then quickly disconnected your from the power supply.

because he did not know how to stop or disable this process.

If the formatting didn't took a long time as you explained... then a data recovery should be possible for this drive.
But as far as I know there are no "open" solutions for this type of problem.
So I guess it will not work with Do-It-Yourself.

One of your options would be to send the drive to someone who has the ability to decrypt the drive.
I could try to solve your case if you want.

Best Regards,
Roberto

Thanks Roberto, I must say that I have tried the software to restore data but does not do anything because the data is encrypted, tried DMDE, testdisk, r-studio and the other, but unfortunately they can not find an NTFS partition or mbr who is responsible for the start. My suggestion to fix VCD to load wd program and enter the password to decrypt the data in the result. and then recover them using the software recovery...

Try "reallymine":
https://github.com/andlabs/reallymine

That said, I expect that it will fail to decrypt your data if it is password protected. However, it should at least tell you if the encryption key is still present on the drive. The author is active in his own forum, so you should get some help there.

If the original key has been overwritten, then it may be possible to retrieve a copy from the System Area (SA) on the platters. HDDSuperTool should be able to do this.

_________________
A backup a day keeps DR away.

Of course this would theoretically fix the problem.... but I don't believe it's "easy" to fix the missing parts.


That's also my fear because the drive was partially formatted.


The encryption key should be still on it's place, because it's on the end of the drive.


Yes I also think you can retrieve the key from the System Area...
In my opinion there is no reason why the information should have been gone.
But is HDDSuperTool definitely working with this model?

And of course there is the risk of overwriting the backup in the service area when "playing" around with reallymine.
Therefore here is the need of extreme caution, so the Thread Starter should know what he does with reallymine.
If you make a mistake then the data is gone forever!


A "safe" way would be to read out the key and then decrypt a taken image of the drive.
But this can normally not be done with Do-It-Yourself, because you need much knowledge about how to "extract" the encryption key.
And of course you must have programming skills for that because I don't believe someone is doing so much work manually.
I don't know if the said is possible with reallymine because I haven't tried it yet, but I don't think so.
Maybe the author of reallymine can correct me if I'm wrong?

Here is a set of tutorials that may help the OP:
viewtopic.php?t=34028&p=237854#p237854

_________________
A backup a day keeps DR away.

IF the key is altered in the PEK sector by formatting/re-initialising, it's also updated in the SA

_________________
PC Image Data Recovery
http://www.pcimage.co.uk

New!! HDD-PCB.COM for all your PCB and donor HDD requirements!

1) Users don't tell full truth usually
2) If user didn't use smartware unlock feature once he plug in the drive than he couldn't do proper format with windows option.
3)Original keys encrypts with user key

Most probably he perfomed formatting of VCD area which is accessable under windows , and smartware unlock features gone, thats why , now you don't have options to unlock the drive in order to get decrypted user space

My guess , the case is solvable untill you do any other stupid actions.

You need to check is there a key stored at the end and if yes , easy to activate lock/unlock system again. and BTW there is no access to key's area via USB .


Incase if customer made formatting with smartware option (not windows one), than he should say goodbye to his data.

_________________
Angel Data Recovery

I don't think the key sector was altered, there are many reasons for this:
1. The owner of the drive said that the formatting was only a very short time because he disconnected the drive.
2. If the drive is not connected over sata than you cannot even change the key sector by formatting.
Except, of course the drive was not formatted by windows but deleted by smartware.
3. The Key sector is on the end of the drive, so even if the owner had access to the full hdd area (maybe because of a firmware failure) than it should still be fine.
Requirement of course is that the owner tells the truth.

So I guess the Key Sector is still in original condition.

I agree with your opinion.


Yes normally... but if you look deeper in the matter there should still be the possibility to get the data from the area which was not formatted.
But this means it is much more difficult and involves a lot more work.

In fact there is almost no case in which you cannot rescue data from "broken" raw passport data.

ISTR that there was a thread where a user inadvertently truncated his Essentials drive by connecting it to a SATA port on a GigaByte motherboard which stored a backup of the BIOS code at the end of the drive. This caused the drive's capacity to shrink by 2113 sectors, which then caused the bridge firmware to look for the key sector in the wrong place.

I would verify that the drive's full native capacity is still being reported correctly via SATA. Perhaps an examination of the SMART report might also be in order to confirm that there are no issues with bad sectors.

_________________
A backup a day keeps DR away.

@mem-tech

Are you still on this forum?
Any news in this case?

Sorry, I haven't looked at this thread in a while. If all the OP did is as he describes connecting the drive via USB, hitting format in Windows, and then unplugging the drive. I don't think the WD encryption would have been altered or changed in any way. That only happens if the format is done through the Smartware.

At this point, it might still be just a quick format type of case (unless he's not telling us something). However, given the comedy of errors that seem to be compounding the issue, I'd still recommend that it be given to a professional who has the tools and equipment to properly diagnose and extract the data.

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company

@mem-tech
It is very astonishing that there are no further posts from you...
I could solve your case... but it looks like there is no need of this or the data was not so important as assumed.