WD5000AAVS from WD enclosure

[pclab]

Hi

I received a WD MyStudio II, that works on RAID 0, I believe.

It has inside two WD5000AAVS and working on a Apple system.

One of the HDD developed bad sectors so the system crashes and can't get the files.

Do you think that only doing an image of both drives to another pair of HDD's will the system work?
Or it's better to create images, create the raid and the data?

The client already bought a new WD Studio 3TB. Will a image of the 500GB HD made to the 1,5TB HD will restore everything?
Thanks

[harddrivespecialist]

Hopefully you can get a good image.

[northwind]

I would image both drives, set the RAID to my machine and recover the data to that new 3TB drive.

[pclab]

Already doing it.

Thanks

[pclab]

Hi again

Something is not going very well.

So I imaged the bad drive (I imaged the bad 500GB to a Samsung 1TB HDD). Now I connected to my PC, start R-Studio and tried to create a virtual RAID with those 2 HDD's. After a Scan of the raid, I got nothing opening.
I must say that the partitions are from a Mac system (HFS+). Can't R-Studio handle it?

Thanks

[jono-ats]

Those drives are encrypted by the SATA to USB / FW800 PCB. You have to connect your drive images to this PCB to un-encrypt the data.

[pclab]

But if they were encripted, I shouldn't see anything for instance with Winhex, right??

[jono-ats]

Correct!

[dmarques]

Hi,

If you make a RAW search, you can check easily if they are encrypted or not.

[pclab]

Hi

After the Scan with R-Studio I got several RAW folders, but almost all the files were corrupted...
The image of the bad drive was 99% sucessfull and the other drive is OK.
Can this be because of the virtual RAID be wrongly made?

[dmarques]

If you got RAW results, it's not encrypted, as if it was, you wouldn't see any data.
So I think it might be wrong RAID rebuild.

[pcimage]

If you got RAW results, it's not encrypted, as if it was, you wouldn't see any data.
So I think it might be wrong RAID rebuild.

Agree

[loki]

If you cant work it out manually then you could try & see if Reclaime Free RAID Recovery can work out the settings http://www.freeraidrecovery.com/
If so then input those settings in R-Studio.

Loki

[northwind]

Weird. It looks like you set the RAID parameters wrong, and that explains why all your files are corrupted.

But on the other hand, I think Yianni is right, these are encrypted. No?
Look into the enclosure pcb and see what chip it manipulates. Also, when you connect a drive to winhex do you see scrambled data?

[einstein9]

PM Sent....

[pclab]

hi guys. this week im on holidays eheh. so next week ill continue that work.
i had put reclaimfree workink but couldnt complete on time. ill give it a second shot next week.

p.s. message sent from the beach eheheh

[harddrivespecialist]

You will see portion of the readable data thru Winhex in a beginning of the drive and rest of the drive will be scrambled.
Learn how encryption works and you will understand where you've made a mistake.

[pclab]

Hi Guys

I'm back from my holidays

So, working again on this case.

Here are some images of the drives done with Winehex.

So, if they were encrypted, I couldn't see the sectors data, right?

Thanks

Attachments

[SAjunky]

Two samples are clearly not encrypted. Other two not sure, if encrypted it would be random characters, can't say without analysing pattern.

[mr_spokk]

You will see portion of the readable data thru Winhex in a beginning of the drive and rest of the drive will be scrambled.
Learn how encryption works and you will understand where you've made a mistake.

Two samples are clearly not encrypted. Other two not sure, if encrypted it would be random characters, can't say without analysing pattern.

The two readable samples are both from Sector 0...