Western Digital MyBook PCB identification

[quadfour]

To cut a long story short, my girlfriend's MyBook stopped working a while back. The drive wasn't spinning up. I couldn't see any issues with the drive, so turfed the case and everything. At that point I had no idea that the bridge board was used for encryption.

I later plugged in the drive direct to my PC, and found garbage. Didn't take me long to figure out that the drive was encrypted... I should have figured it out given the amount of electronics in the original case, which normally isn't present in a simple USB to SATA controller.

In order to retrieve the data, I need to figure out which PCB/chip was in use in the original housing. This is all I have to go on:

- 1Tb Western Digital drive - model WD10EARS - 00Y5B1
- WD MyBook Essentials, purchased somewhere mid 2010
- No password was set in addition to the encryption

I know it was purchased in 2010, and I've attempted recover with a Symwave PCB ( 4061-705089-001 Rev AF ) which failed:

[11761724.222325] sd 19:0:0:0: [sdd] Sense Key : Data Protect [current]
[11761724.222327] sd 19:0:0:0: [sdd] Add. Sense: Logical unit access not authorized

So given I've caused this headache by throwing out the original case, I need to fix this and recover the data. Before I go purchase more PCB variants, is there anything I can do ( including checking out the drive contents ) to identify which one I need?

Cheers!

[jono-ats]

If it's a 2010, it's probably an Initio 1607E, but that's just a guess.

[labtech]

Go to wdc.com, put in the drive's SN in for warranty checkup, it will show you the model of the external it came out of. Then use that info.

Or send to a pro, a real one.

[quadfour]

Thank you so much, exactly the info I needed

For reference, it's out of a WDBAAF0010HBK.

[quadfour]

Last question before I go acquire one of the correct PCBs, will it work? I've read a few stories of people having to transplant ROMs. Perhaps that's only when passwords are in use?

The part number I need is apparently 4060-705059-001.

Cheers

[labtech]

No guarantees, but it's your best bet, of course all of this under the assumption there is nothing wrong with the drive itself.

[SAjunky]

If there is any suspicion that drive itsefl is failing, clone the entire drive first, connecting it directly to PC SATA controller. During cloning you will see if anything is wrong with the drive.
Then try to decrypt from the clone.

[quadfour]

I've received the replacement PCB ( 4060-705059-001 Rev A ).

Plugging it in, the WD SmartWare partition opens up no problems. I take that as evidence that I have the right PCB.

However, the data partition ( which I note starts some ways in on the platters ) remains unreadable. It's not locked ( according to WD SmartWare, it's not readable ). Looking at it with a hex editor, I see something I've seen described before:

0000000 75f3 519d 2cc8 2566 972f 663a d5c1 44de
0000010 84bb dea6 b247 69d9 516b d5be d08f b964
= snip =
00001c0 0ef0 498d 3eeb 8b74 36ab 5090 6ea8 89e5
00001d0 2fb5 1b7e 0793 2cb6 b9d4 273e 07d2 d9d4
*
00001f0 fb5a 808f 763f 137d 6a34 593c 3176 7bc7
0000200 2fb5 1b7e 0793 2cb6 b9d4 273e 07d2 d9d4
*

So from position 0x1d0 and 0x200, the same 16 byte sequence occurs over and over. I believe this may be part of the original AES key. I also understand that the PCB may have some form of ROM, which I understand is used with the key on the drive in order to decrypt data.

Some posts elsewhere suggest that I may be able to recover data with a partial key above ( assuming it is, of course ). Can anyone shed any more light on this?

[loki]

How does disk management show the device?
Can you see an unencrypted MBR using winhex?
If the MBR or partition is corrupted then you could try dr software like Runtimes GDB for NTFS http://www.runtime.org/data-recovery-software.htm or R-Studio software http://www.data-recovery-software.net/ & scan the drive?

Loki

[quadfour]

The actual data partition looks like a regular 930GB partition - of unknown type. The MBR is as partially mentioned. It looks ok, just gibberish. Reading past the first sector showed the recurring 16 byte pattern as shown before. I also note that such reads are slow... Suggesting that the decryption process is having difficulties. Having said that, I didn't look too far in, as I believe the existence of the data at 0x200 indicates that the partition is encrypted...

Otherwise, the partition should be fine. The drive was not modified etc. as evident by the WD smartware being available on the drive.

[fzabkar]

The repeating 16-byte pattern is indicative of 128-bit encryption.

The SmartWare "partition" is an unencrypted virtual CD image at the end of the user area.

AIUI, your best chance for data recovery is to obtain a bridge PCB from an identical product of the same capacity.

[quadfour]

The repeating 16-byte pattern is indicative of 128-bit encryption.

The SmartWare "partition" is an unencrypted virtual CD image at the end of the user area.

AIUI, your best chance for data recovery is to obtain a bridge PCB from an identical product of the same capacity.

I have already obtained such a bridge board... I looked up the serial number with WD to get the enclosure model, then looked up the PCB, as per the model mentioned.

[fzabkar]

AIUI, if the PCB came from a 2TB My Book, for example, then there could still be encryption problems. I'm not a data recovery professional, though. ISTR that even in this case you could edit a particular sector before the virtual CD to accommodate the capacity difference, but the procedure was not specified.

[loki]

Just for note:

The bridge boards do have firmware.

A quick searck on Ebay http://www.ebay.co.uk/itm/1-PCB-4061-40 ... 2ebd98b273

As you can see this supports Rev. A, AA, AG and A1, the AF, AE, AB, AC, P, P1, P2, and P3 ect,supported

Also the bridge board should be inter changeable between hdd drive sizes

It is possible that the sector that holds the encryption key has changed. ie wrong key = no decryption

Loki

[quadfour]

Hang on a sec. If the virtual CD partition is at the end of the drive, then wouldn't it confirm that this pcb is able to read the drive in full? It wouldn't make sense that the hard drive itself contains any size info which the PCB used.

[quadfour]

Just for note:

The bridge boards do have firmware.

A quick searck on Ebay http://www.ebay.co.uk/itm/1-PCB-4061-40 ... 2ebd98b273

As you can see this supports Rev. A, AA, AG and A1, the AF, AE, AB, AC, P, P1, P2, and P3 ect,supported

Also the bridge board should be inter changeable between hdd drive sizes

It is possible that the sector that holds the encryption key has changed. ie wrong key = no decryption

Loki

You've linked the exact pcb which I bought. Anything else you can think of?

[loki]

You mention "I also note that such reads are slow... Suggesting that the decryption process is having difficulties"
Or the drive has bad sectors or the heads are weak etc.
What does smart say?
You can use MHDD to test the read access times of the sectors but remember that DIY has risks especially if you have'nt cloned the drive

You also mention "To cut a long story short, my girlfriend's MyBook stopped working a while back. The drive wasn't spinning up"
More info about the drives history would be helpful ie was it knocked, dropped, wrong power supply fitted, power cut, was it running slow etc

It is possible that the sector that holds the encryption key has changed but that's not something you can check without specialist tools that can access the hard drives system area + knowledge of these drives & research.

If the data is important & warrants the cost then you should look at a DR Pro.

Loki

[quadfour]

The drive itself is fine. It's not been dropped or knocked etc. And SMART tells the same story. And when I said that reads are slow, that was a manual read of the raw Disk with dd. It wasn't that slow in real time, just slower than raw reads from other devices. Might be due to the PCB, or just the USB interface. I should mention, I only use Linux.The power supply appeared to have failed in the original enclosure. I'm not worries about the drives condition.

Unless another PCB has a better chance of working - considering I bought the one linked before - then I'm out of ideas.

[quadfour]

Just to save anyone reading this thread some time, no go. I tried multiple PCBs of the right capacity / model etc. So do be an idiot ( like me ) and throw out the PCB to begin with

[Bruno-S]

fzabkar, Hi, I think, you are very knowing about WD Mybook.
I have here one of this encrypted drive. The small PCB looks working well, the HDD is ok (only encrypted by USB-Bridge (i having tested with port-tool). When connected to the usb-brige, the HDD is Spinning on correcly, but the LED "D1" is lighting very fast, and the drive is not recognice by the PC.
Do you having any sugestions?
Bruno