Hello everyone, I recently acquired a WD My Book 3TB drive in which the enclosure stopped working and the hard drive removed and connected to a Windows PC. The drive was quick formatted to NTFS and attempted data recovery but the data is scrambled. I am assuming this is due to the encryption.

I was able to secure a working enclosure board to connect the drive back up to and connected it to the PC. I have attempted recovery programs like Easeus and Stellar Labs Phoenix but am only getting the scrambled data.

I know for sure that I have a Symwave chipset and also have a backup of the drive to use for testing purposes. At this point I am lost and unsure of what to do. Can anyone assist?

Also, I understand that it is not guaranteed to recover the data, I am doing this as a side project and am comfortable if the data is lost forever.

I was about to reply to your reply on the other post!

- WDBACW0030HBK-01 - full model number
- Correct, it does have a SATA PCB. When connected to the drive I am able to see the drive. I have not attempted to use MHDD or Victoria as I have not yet heard of those.
- I have a cloned version of the drive through DDRescue
- I'm 99% confident that the issue was with the enclosure. With the old board the drive wouldn't stay on/connected for more than a few minutes at a time. Since swapping the PCB with a duplicate it connects and stays connected. No clicking issues with the drive.

Something to note, when I attempted to use some software like DMDE or RStudio and use the cloned copy, the partition shows "My Book" which was the original name for the drive. This leads me to believe that I may still be able to access the files but I am not 100% bought in and understand they may be lost.

I'm familiar with running reallymine through Ubuntu but not familiar with what you were referring to as far as 'NO THE CLONE'. Is there a way to decrypt the already copied image? Ill be honest, I'm just now reading the link that you included so I may find my answer but I figured I'd ask just in case I'm miss understanding. For reference, when I have run reallymine before I simply ran `sudo reallymine decrypt /dev/sda /media/user/disk1/backup.img'

Also the PCB has a chip ASM1051W which I noticed was referenced in one of the links that you provided indicating that the drive may not be encrypted? I'm still muddling my way through all the info but figured I'd share with what I could.

I appreciate the reply as well! I apologize for posting in another thread. Was not my intention to mix issues.

- I can't tell you at this very moment as I am currently at work. Later this evening I will be able to provide you the exact information of the drive itself.

- Forgetting about MHDD/VICTORIA.

- Originally the drive was formatted to NTFS, at this point the drive is not in original condition unless I run DISKPART and Clean the disk to make it non-initialized. Otherwise the drive was quick formatted to NTFS.

- Do not have the original enclosure PCBs as the original owner tossed it. As far as I can tell the information should be the same but I honestly could not tell you.

- Gotcha. High hopes for me, haha.

- Since I do not have the original enclosure and therefore unable to use the fixed one, I take it my chances are dwindling?

It seems to me he has a clone of the formatted drive.

Just for thoughts : when connecting the drive directly through sata, does it shows the full LBAs, and when through the usb bridge, it shows a little less because it reserves some space for the virtual cd ? That is, depending on the sizes, and even on512/4k alignment, could it be that he partitioned and formatted over the sectors that used to contain the decryption key ?

The model number of the drive that was in the inclosure is WD30EZRX.

Also at the moment, I am currently running reallymine in an attempt to get a decrypted img to attempt file recovery. Beyond that, is there anything else I can attempt doing to attempt recovery of the data.

At the moment only 60.8 GB has been decrypted in the last 24+ hours that I have been running it. Seems like I may be waiting a while for the decryption to complete.