WD5000AAVS-00ztb0

[vormov]

I have a WD5000AAVS-00ZTB0 500gb external HD (Mybook external thingy). There is data on it that I desperately need (Reason song project files (*.rns) that I have months and months of work in). I've tried working with testdisk and some other tools to recover the data, but after a long time of scanning and trying to recover the partition, I gave up.
I'm very computer savvy, but HD recovery hasn't ever been something I've done (other than simple undeletes or deleted/formatted partitions).

Any tips you could give me before I ship it off for professional recovery? (I am absolutely done buying WD hard-drives).

-It reads in BIOS
-It is able to be scanned using testdisk
-I do not hear clicking noises
-I am using a SATA bridge to connect it via USB
-Sometimes it shows up in Windows (but is inaccessible)

[dmarques]

Hi,

There's 2 things that might help understand better your problem.
You said you could scan the drive right? The problem is that took a long time, right? But did it find anything?
When you say that sometimes it shows up in Windows, but it's not accessible I would think about a FW issue, but that would contradict what you've said before that you could scan the drive.

Can you try to open up the drive with an hex viewer and tell us what do you see in sector 0?

[vormov]

as in this?

[pcimage]

I bet the USB connection isn't the original USB board from the external device, right?

[dmarques]

Or that or the MBR is stuffed.
At least seems that your drive doesn't suffer from any hardware issue.
Can you scroll down by all the sectors?

[jono-ats]

I think the drive is encrypted, using the USB adapter that is native to the WD Book, and that is why you can't find any files.

What happened to the original enclosure and circuit board?

[vormov]

now this is what im getting:




No, it is not the same USB as it came with (I removed it from the enclosure a long time ago).

[vormov]

I'm not sure if i still have the original enclosure/USB. The HD didn't work when connected to the enclosure either.

[pcimage]

I think the drive is encrypted, using the USB adapter that is native to the WD Book, and that is why you can't find any files.

You read my mind Jon

[vormov]

I was able to get into the folder i needed using winhex. But the eval version only does files under 200k, and now it wont even let me browse to that folder (It'll let me see it, but i cannot open the folder--it just brings up hex code).

I was also able to recover a bunch of txt documents that I wanted.

[dmarques]

Strange.
Can you show us sector 63 ?

[Vulcan]

@vormov:

I was able to get into the folder i needed using winhex.

You don't say if you were using the original USB-SATA bridge to do that, or not.

Based on the data pattern in LBA 0 then, as pcimage and jono-ats pointed out, the original enclosure seems to be one that uses an "Initio" chip to encrypt data - however the all-zeros pattern that you seem to be showing immediately after LBA 0 (i.e. LBA 1), is not normal for an encrypted drive, when it is being accessed without the correct USB-SATA bridge.

So in short, I see conflicting evidence. I suspect that there is something in the history of this situation that will help it make sense, but we haven't heard the full story yet...

I was also able to recover a bunch of txt documents that I wanted.

So is that it - are you finsihed and we can close the thread?

If not, then I suggest for all the readers of the thread, you need to very clearly explain, in chronological order, what happened originally, what you did (testing, any h/w & s/w changes, reformatting etc.), up to now.

The HD didn't work when connected to the enclosure either.

I suspect there were/are 2 problems: (a) Something happened (which you need to explain to us) which caused you to start this recovery attempt in the first place. That fault/problem/whatever hasn't been solved, and could be causing some of the problems that you're still seeing - hence your comment above. (b) You've then unknowingly added to the problem, by not using the original USB-SATA bridge board.

Therefore, if you need more help from the readers of the thread - give us the full story from the beginning, please.

Also, be aware that if there is, as I suspect, an underlying problem that you haven't yet mentioned which occurred at the beginning of the story, then you could be using the valuable last minutes of the drive, in your recovery attempts...

[vormov]

I was able to recover all the files I needed. You can close the thread.
When I loaded the disc with winhex I was able to see the Partition, but 3-4 tries to browse to the folder i needed were unsuccessful (the program would just float when i clicked to open the folder). This time it randomly worked and I got my files off. Thank you for the hex editor suggestion, I would not have thought to do that.

What happened was, the USB connector on the original enclosure started shorting out or something (kept having to move it around to get it to read in windows). Then the enclosure stopped working all together, so I got a new one, and it worked fine for awhile. Then the hard drive stopped working, wouldn't read in windows, but read in BIOS. I suspected it to be damage to the disc (towards the end of the HDs life, it would freeze up when i browsed certain directories).

I left it sit for months before I tried to recover anything. I started by using testdisk to try to rebuild boot sector/partition table, but every time it would get mostly through the scan and show no results for partitions.

Months later (now), I bought a usb sata bridge , so I thought I'd give the HD one last try for recovery. I browsed tons of web, and tried some different tools (Recuva, Restoration, PC inspector file recovery--basically tools i saw on a pcmag help page or something).

Sorry if I wasn't so specific earlier.

[dmarques]

Ok.
Congratulations.

[Vulcan]

@vormov: Thanks for the info.

That LBA 0 data sure looks strange, but I looked up some old examples and, although quite similar, the pattern in your LBA 0 is not exactly like the encrypted pattern of an Initio chip for groups of hex 00 bytes (we'd expect a few groups of them, whether the disk was bootable and had MBR code or not).

So the only conclusion I can reach which seems to fit the info is:
- your drive itself was/is sick (i.e. that was the original problem and caused the intermittent read failures you've mentioned, even when not using an enclosure);
- the original USB-SATA bridge wasn't an encrypting one (but we were misled by the strange pattern in LBA0);
- as dmarques suggested, the result of reading LBA63 would have been a good data point to force a re-evaluation of the hypothesis of the encrypted data, and as I mentioned, we also had the clue with the unexpected LBA1 contents (if it had been an encrypted drive being read through a normal USB-SATA bridge);
- and something wrote that strange data (which looks similar to a FAT???) into LBA0.

At least you got your data - thanks again for the follow-up and thanks to the other members on this thread, I learned something too.