Data Recovery from Buffalo Drivestation Hardware Encryption

[OptimusPrime]

Hello everyone,

my Buffalo Drivestation with Hardware Encryption (HD-CX1.0TU2-EU) recently stopped working.
The power source is ok, checked with another one.
The drive doesn't start and is no more recognized when attached to a pc.
I opened the Drivestation and attached the HDD to a pc. The HDD is ok, not showing any partition.
I checked with a Hex Editor, only seeing some Buffalo Stuff (the VCD), all other Sectors -> Zero
After some research I discovered the Initio-1607E on the PCB
Is there any chance to get my data back?
Thanks in advance

Optimus

[northwind]

Yes. Find the exact same model of the external casing and attach your disk in it.

[OptimusPrime]

Ok.
Is there a chance to recover even if I accidentially initialized the drive in Windows
while it was directly attached to the pc? (I should have known better )
It was the only write to the drive.
I thought that a change of the PCB doesn't work because of the INIC-1607E.
I will give it a try. I'll search for exactly the same Model.

[OptimusPrime]

I can hear a slight 'click' voice on the PCB around the 6R3 (second picture on the right).
But the HDD doesn't start while connected to the PCB

[Vulcan]

I opened the Drivestation and attached the HDD to a pc. The HDD is ok, not showing any partition. [my emphasis]

That is expected, because you removed the encryption/decryption board, so the partition table is left encrypted on the "bare" disk.

I checked with a Hex Editor, only seeing some Buffalo Stuff (the VCD), all other Sectors -> Zero

Is there a chance to recover even if I accidentially initialized the drive in Windows

It is bad news if all sectors are zero'ed - you should have encrypted data visible. Did you really check all sectors?

Last time I checked, a normal "initialise disk" by Windows just writes a small signature to the MBR - it does not erase data. Did you really mean that you "initialized" the disk, when it was directly connected to the PC via SATA? Or did you mean that you formatted it with Windows, and if so, did the format take a few seconds (quick format), or did it take many minutes (full format)? Which version of Windows is running on that PC?

I can hear a slight 'click' voice on the PCB around the 6R3 (second picture on the right).
But the HDD doesn't start while connected to the PCB

That part of the encryption PCB (including that inductor) is a step-down switching regulator, to produce a +5V supply, from the external (probably +12V) DC input. Normally the oscillator switching frequency is so high, it cannot be heard. That "click" is likely to be the frequency briefly crossing the audible range during startup or shutdown (perhaps under fault conditions). An oscilloscope would clarify this very quickly, but I guess you don't have one... This is one example of why remote diagnosis is less efficient (takes longer) than when the equipment is in front of a suitably experienced engineer.

If you are prepared to take the risks of DIY, and have electronics skills, and have a multimeter, and understand about anti-static (ESD) precautions, then you might be able to perform further electrionics diagnosis - but I am not promising to hand-hold you through that process remotely. If I was in your situation, I would start by checking the external power supply both with no load, and under load - if that is faulty, it could produce the symptoms which you originally had.

However it is not clear whether you have now erased some / most / all of the data on the disk, by what you have done on the PC, since you report that all the disk is now zero'ed.

Edited to add: Of course if the external Buffalo power supply is OK, and if the fault is definitely on the encryption USB-SATA PCB, and if you have not erased your data, then as northwind said, it may be easier to just replace that PCB.

[OptimusPrime]

I opened the Drivestation and attached the HDD to a pc. The HDD is ok, not showing any partition. [my emphasis]

That is expected, because you removed the encryption/decryption board, so the partition table is left encrypted on the "bare" disk.

Ok

I checked with a Hex Editor, only seeing some Buffalo Stuff (the VCD), all other Sectors -> Zero

Is there a chance to recover even if I accidentially initialized the drive in Windows

It is bad news if all sectors are zero'ed - you should have encrypted data visible. Did you really check all sectors?

Last time I checked, a normal "initialise disk" by Windows just writes a small signature to the MBR - it does not erase data. Did you really mean that you "initialized" the disk, when it was directly connected to the PC via SATA? Or did you mean that you formatted it with Windows, and if so, did the format take a few seconds (quick format), or did it take many minutes (full format)? Which version of Windows is running on that PC?

I did the "initalise disk" in Windows,
no further formating or something else.

Sector 36 has data (I think the encryption key(alternating bits))
Sector 0+1 have data (see attached pictures)
The sectors where the Bufallo VCD resides have data. (too much sectors for pictures )
I'm going to buy another drive of the same model and I'll try the exchange of the PCB.
Thank you

Optimus

[Vulcan]

I just noticed that you said at the beginning:

The power source is ok, checked with another one.

... and I realise you were talking about the external PSU.

Therefore, assuming that the other PSU which you tried is definitely OK, then this first stage of troubleshooting has been done. Next step depends on your skill / experience / risk decision of doing DIY (compared to the value of the data), regarding further troubleshooting of that USB-SATA PCB, or just whether you decide to replace it.

Also needed is clarification of what you did exactly with that disk in the PC, and why you report that the disk is now all zero'ed....

[OptimusPrime]

I wrote a reply for clarification but it's in approval

Both PSUs are definitly ok, checked with another Buffalo Product (sadly no the same model).
I'm going to buy a replacement product, though the DIY seems to be an option (studying Electrical Engineering)

I did only "initialise Disk" in Windows 7 Disk Management (sad enough),
no further writing or formating.
There's still data on the Disk, in Sectors 0,1 and 36 and the (a lot of) Sectors with the Buffalo VCD.
The rest of the Sectors are Zero (due to the missing decryption from the Initio Chip).

[drc]

The rest of the Sectors are Zero (due to the missing decryption from the Initio Chip).

Sectors that are encrypted, when viewed apart from the USB bridge, should look like garbled data, not zeroes. The decryption algorithm (a complex mathematical function) is just going to apply to what is present on the platters. If your input is zero, then your output is not going to be usable data.

[Vulcan]

@OptimusPrime:

The rest of the Sectors are Zero (due to the missing decryption from the Initio Chip).

In my experience, missing decryption of previously written (encrypted) data, does not cause sectors to be read as (hex) zero. From the encryption chip's viewpoint, sector 36 (for example) is not special or treated differently from others - so according to your theory, why do that show encrypted data, but other sectors are zero'ed "due to missing decryption"? That does not make sense... Somehow, there is a communication problem about this situation.

I suspect that when you are talking about the VCD, perhaps you are mistaken and that is really your encrypted data and not the VCD.

Anyway, since you have decided on the next step, I will stop here. Good luck

Edited to add: @drc - snap!

[OptimusPrime]

Ok,

thanks for your answers.
I'll post again when I got a replacement for the PCB.

[Vulcan]

@OptimusPrime:

Just FYI, from your (now approved and visible) post showing the contents of sector 0, we can see that Windows wrote a whole new MBR when you initialised the disk connected via SATA (probably because Windows (correctly) did not recognise the original encrypted MBR as being valid).

That means you have also overwritten the old (correct, encrypted) partition table, so unfortunately more recovery work (and risk) will now be necessary, even if a new USB-SATA encryption board does fix the original problem.

[OptimusPrime]

Today I ordered a new drive.
Maybe if the encrypted drive runs with the new USB-SATA Bridge it's possible to rewrite MBR/Partition Table using Testdisk.
I'll give it a try after a backup of the encrypted drive.
Is there a tool you can advise for doing a full drive backup other than Acronis Sector-by-Sector?

[Vulcan]

Maybe if the encrypted drive runs with the new USB-SATA Bridge it's possible to rewrite MBR/Partition Table using Testdisk.

Yes, perhaps, although I prefer to modify only a copy of the original disk - I see you are going to take a backup first, which is good.

I'll give it a try after a backup of the encrypted drive.
Is there a tool you can advise for doing a full drive backup other than Acronis Sector-by-Sector?

This depends what you feel comfortable using. I mainly use Linux/Unix so I would just use dd (with a large blocksize) to copy the raw device.

There are many possible Windows utilities (including a port of dd to Windows), which you could investigate - e.g. CloneZilla, HDClone, DMDE etc, but I don't know all the pros and cons of each one, since I don't use them now (some will default to only copying valid filesystems, so may not be suitable for your purpose, until configured to do a full / raw clone). I expect that some other members will be more familiar with Windows utilities than I am, so you might get more suggestions from them.

[einstein9]

OptimusPrime

next time, i suggest to upload ur images using the forum upload better than damn Ads.

#2 based on what you mentioned, you might have a faulty (electronics) problem with the USB-Encryption adapter which you uploaded, buying new one (same model) might 80-90% work with you ONLY
and ONLY if the partition is the same.

Last Question for you here:
Is it a Seagate hdd inside?

[OptimusPrime]

Thanks for your reply einstein9,

next time I'll use the forums picture upload.
Yes it is a Seagate drive. Is it good or even worse?

[einstein9]

heheh

i hate SEAGATE drives really, but trying hard to master them
@ the end they are all the same hdd`s

i suggest to clone it 1st. try HDClone bootable its good and work with the clone drive

(prefer WD)

[OptimusPrime]

Damn good news:
The replacement is here and it works
All data is accessible (Acronis is running )
Thank you all for your support!