WD My book recovery

[BlueMooneke]

Hello everybody!

Short introduction: My name is Bjorn and I am 20 years old. I study Electronical Engineer in Belgium and love to play with the computer.

2 years ago, I bought myself an external drive: a WD My Book with a lcd display on the front side. The capacity is 1 TB.
The connection to the computer is from mini-usb to usb (2.0) and recently... the mini-usb port on the HDD just broke off...

So I took the My-Book casing from the HDD off and plugged the Green Caviar HDD with sata to my computer (windows 7)
He didn't recognize the HDD so I went to the Storage Management panel in windows and saw that he indeed found a new drive, totally empty and unallocated.

Here I think I made a big mistake... He asked me to create a MBR or a GPT and because I needed the files fast (was with some kind of customer to fix his computer), I clicked on the MBR.
Ofcourse, still no files were found... I directly understood that I made a mistake by doing that so told my customer that I would fix his computer later on.

Now, many of the files on it are very important. So I ran 2 tools to recover my files:
- Easus Data Recovery Wizard
- Stellar Phoenix Windows Data Recovery

The first program (easus) found alot of files from WD Suite (pictures of the HDD, .pdf files of the specifications,...). It found a total of 578GB. So that was promising!
I pressed "Recover" and wrote the recovered files to another external drive. Too bad most of the files where .swf files... Which I couldn't open with any program (not adobe, ...)
I saved the recovery file with the locations of the found files to be save.

The second program has a memory leak in it. It finds alot of other files (Like app, app1, app2 till app11, tar, mp3,...) But when I try to recover them, it hangs on about 1.86GB because I run out of memory. (I watched it and there is a memory leak in the software...) Also, I stopped the recovery to check the TAR files, can't open the either (with 7-zip)

So I almost gave up on it... But still, got a few questions. I hope you guys can help me out on this!

Questions:
- After all, I only changed the very first few bytes of the HDD by writing to it that it has to be a MBR right? So, why doesn't it recognizes my files? Did Windows also overwrite my partition table?
- Could the My Book "encrypt" my data?
- I formatted this drive as NTFS, why doesn't MS recognized it when I plugged it in on the sata port?

Thanks in advance!

BlueMooneke

[Cleanroom]

they are encrypted.

Need the to fix the usb connection on the sata bridge. The sata bridge holds the encryption info. And then scan the drive for deleted data since you re-initialized it with a data recovery program

you should be ok if you have not written any data to it.

Good Luck

[fzabkar]

@BlueMooneke, if you are lucky, you will only have overwritten sector 0. If so, then a tool such as TestDisk may be able to rebuild it. In fact I should be able to help you reconstruct it by hand if you need to.

Here is a similar thread, with sector dumps:
http://www.tomshardware.com/forum/29225 ... -data-loss

[pcimage]

The usb board DOES encrypt all the data by default.

If the original USB board cannot be repaired, the find another identical one and connect your drive to it and run some recovery software on it, or if you are lucky that it has only altered LBA 0 then fzabkar's suggestion of testdisk is plausible.

[northwind]

Hey Bjorn

I too agree with the above suggestions, first you need to solve the encryption problem. This can be done in two ways, either repair the original usb board or buy an identical one.

Then, you need to repair the mistake you made, either by reconstructing s0, or by running a data recovery software and recover your files (I recommend R-Studio).
DONT do anything else with the drive or you'll make things worse.

Good luck.

[BlueMooneke]

Ok, a little update...

Found a new mini-usb port and put it back on the PCB.
Connected everything again and the drive spins and is connected via usb to my computer! PHASE 1 COMPLETE!

Now, Windows 7 recognized the WD-Smart part of the disk. No other disk is displayed in "My computer"
I don't want to do anything stupid, so I stopped from just reading the WD smart part.

What is my next step?
First use a recovery tool? Or just try to read the first few sectors (like sector 0) and try if I can change something there...?


Already thanks in advance!

BlueMooneke

[fzabkar]

What is my next step?
First use a recovery tool? Or just try to read the first few sectors (like sector 0) and try if I can change something there...?

I would examine sectors 63 and 2048. Hopefully one of them will be a boot sector, in which case you will see some plain text strings, eg "NTFS" or "FAT32".

If you can upload the contents of the appropriate sector, then I will be able to help you reconstruct sector 0 by hand. IMHO that's the best approach because you can easily undo any errors. Automated data recovery software doesn't always get it right, and you are never sure what changes it makes, if any. In any case, I wouldn't allow data recovery software to write on my drive unless I knew exactly what it was doing. That's what clones are for.

[sathyan]

What is my next step?
First use a recovery tool? Or just try to read the first few sectors (like sector 0) and try if I can change something there...?

I would examine sectors 63 and 2048. Hopefully one of them will be a boot sector, in which case you will see some plain text strings, eg "NTFS" or "FAT32".

If you can upload the contents of the appropriate sector, then I will be able to help you reconstruct sector 0 by hand. IMHO that's the best approach because you can easily undo any errors. Automated data recovery software doesn't always get it right, and you are never sure what changes it makes, if any. In any case, I wouldn't allow data recovery software to write on my drive unless I knew exactly what it was doing. That's what clones are for.

@BlueMooneke
You can try r-studio, a good and easy to use recovery software tool.
If you want to be extra careful and avoid mistakes , you have to make a clone/image of the drive, and do the recovery process on that drive, leaving the original drive as it is.(But you will need another hard disk to make the clone and work with it).This will take more time and resources, but its a safe approach.

Else , you can try to reconstruct your overwritten sectors (with fzabkar's help), and recover your data(if you are lucky, u will save a lot of time and effort for scan and copy , so worth a try)

[BlueMooneke]

I'll give the sectors a try when I get back home.

I just hope reconecting the drive with it's encryption pcb didn't screw up the data...
Btw: scan the sectors 63 and 2048 with the board? Or scan it without that encryption board?

Thanks again!

[Vulcan]

Assuming that you accept responsibility for the risks of DIY (including, but not limited to, human error) then...

Btw: scan the sectors 63 and 2048 with the board? Or scan it without that encryption board?

It would be with the "encryption board", so that those sectors are decrypted and hence (hopefully) allow usable data to be seen in a hex editor. However your terminology worries me - there is no "scan" involved. The suggestion you received earlier was just to read those specific sectors (to try to identify the PBS - partition boot sector) and provide that data to fzabkar, if you want his help. Personally I'd create a full raw clone of that disk first (as already mentioned by sathyan) as insurance, but even that process carries some risk, especially for the inexperienced.

[BlueMooneke]

Assuming that you accept responsibility for the risks of DIY (including, but not limited to, human error) then...

Btw: scan the sectors 63 and 2048 with the board? Or scan it without that encryption board?

It would be with the "encryption board", so that those sectors are decrypted and hence (hopefully) allow usable data to be seen in a hex editor. However your terminology worries me - there is no "scan" involved. The suggestion you received earlier was just to read those specific sectors (to try to identify the PBS - partition boot sector) and provide that data to fzabkar, if you want his help. Personally I'd create a full raw clone of that disk first (as already mentioned by sathyan) as insurance, but even that process carries some risk, especially for the inexperienced.

Well, I lost the data anyhow... Whatever I tried before, nothing worked. So I technicaly "gave up" on the data...

And as this has happened, I'm very curious about how this things really work. I mean, I learned some of it on school but the reality is very "different".
So, I take the risks with it!

First, a identical CLONE to another HDD seems a good idea... Any tool to do it byte for byte? I got another external drive which is capable of the amount of data.
Any help about it is appreciated! I really want to learn!

PS: with the "scan" term: I just meant to read those first sectors. Didn't know there was such a difference between scan or read.

[Vulcan]

Well, I lost the data anyhow...

There seems to be a translation/language problem, as I see no evidence that you have "lost the data".

First, a identical CLONE to another HDD seems a good idea... Any tool to do it byte for byte? I got another external drive which is capable of the amount of data.

I have written about cloning in many previous comments, as well as some of the factors which can affect your choice of cloning utility. I suggest you get a drink and sit down to do some research on the available options, starting with searching this forum about cloning.

PS: with the "scan" term: I just meant to read those first sectors. Didn't know there was such a difference between scan or read.

IMHO "scan" is a vague term, but often includes some element of searching i.e. "scan for [something]". That was not the suggestion you were given about what to do by fzabkar, to provide the information he requested - hence why I was concerned, as it seemed you may have misunderstood the previous suggestion you were given. That's all

[dobrevjetser]

Je kan een kloon maken met bvb ddrescue als je iets van linux kent. Let goed op met bron- en doelschijf !
You can make a clone with e.g. Ddrescue if you know something about linux. Watch out witch source and target drive!
Kloon naar een wd schijf of je decryptie bordje zal niet werken!
Clone to a wd drive or the decryption pcb will not work!

Dobre

[fzabkar]

@BlueMooneke, FYI the SmartWare stuff lives at the end of the drive, as a virtual CD image, beyond the user area. SmartWare files are not encrypted whereas your user data is. These SmartWare files are hidden from view when your drive is installed inside the enclosure, but are exposed when the drive is directly connected to a SATA port on your computer's motherboard.

I hope that explains the confusion.

If you show us sector 63, this will help us determine the extent of the damage to your file system. It still sounds to me like you will only need to edit about 18 bytes in sector 0. If you are not comfortable with a disc editor, then practice on a spare drive in readonly mode, or just go ahead and clone it and let your data recovery software loose on the clone. Be aware that cloning a 1TB drive at USB 2.0 speeds will take about 10 - 14 hours.

[Vulcan]

@Dobre,

Clone to a wd drive or the decryption pcb will not work!

Thanks for the reminder - I remember this is needed in some situations.

My interpretation of the situation is that the cloning would be done of the decrypted user data (i.e. with the [now repaired] encryption/decryption PCB attached) using USB, as there is no expectation of unreadable sectors and it allows the clone target to be immediately useful - so in that case, the restriction on clone target drive type doesn't apply. Perhaps my interpretation is wrong. I guess you were interpreting that the clone would be done of the encrypted data via the SATA connector on the original drive?

Both cloning options / approaches seem possible for the OP, with +ve and -ve for each option.

[sathyan]

First, a identical CLONE to another HDD seems a good idea... Any tool to do it byte for byte? I got another external drive which is capable of the amount of data.
Any help about it is appreciated! I really want to learn!

you will need another hard disk of similar or greater capacity to make a Clone.
all the data in that disk will be over written and lost.
HDD raw copy in this forum's file section or DDRESCUE are some free utilities .
You will have to clone using the USB eclnosure for the original drive (due to encryption).
IT will take a lot of time .
But you should get your data as you have only over written the partition table

[BlueMooneke]

Well, I lost the data anyhow...

There seems to be a translation/language problem, as I see no evidence that you have "lost the data".

Well, I tried a few methods to recover the data and in my opinion, all I got was rubbish. So I almost formatted the HDD... So I "lost" the data as "I couldn't get it back in it's original way".

PS: with the "scan" term: I just meant to read those first sectors. Didn't know there was such a difference between scan or read.

IMHO "scan" is a vague term, but often includes some element of searching i.e. "scan for [something]". That was not the suggestion you were given about what to do by fzabkar, to provide the information he requested - hence why I was concerned, as it seemed you may have misunderstood the previous suggestion you were given. That's all

I understood his question, so yes, just a case of language/translation error. Just meant to read the specific sectors.

About the clone: I knew it was going to take many hours to raw copy everything. So, I'll just read sector 0 and sector 63.

[BlueMooneke]

Alright, little summary from my first experience:
1) First tried Roadkil's Sector Editor, couldn't even select a drive (empty drop-down box...)
2) Tried HxD - Freeware Hex Editor and Disk Editor: Installed software, ran it. Could select 1 logical disk (named WD SmartWare (G:)) and 1 Physical disk named Optical Disk 1.
I guess it's the physical disk, so I copied the HEX code of sector 0 and sector 63 to a text file and uploaded it.

3) Tried DMDE (DM Disk Editor and Data Recovery). Very straight forward program, easy to use. Scared to trash my data, I eventually clicked cancel but the software found several things: Found a Physical Drive of 1TB and I clicked it. Asked me a question about initial disk size, available disk size and selected disk size. Clicked YES on the question "Probably not entire volume is accessible".

Next screen told me this:
"There are partitions in MBR table which require the disk size not to be less than (3.11TB). Current disk size is 1TB. There may be errors in MBR table or driver can't acces entire disk". ==> Clicked OK
Next popup screen showed me some information about that Physical drive. He found a volume named "My Book" [<= that's what I'm looking for!!], file system is NTFS, size 1TB and first and last sector.

I clicked close here to make sure I didn't do anything wrong. I could click MBR on/off etc... But didn't know that was a good idea...

Hope this is a good explanation of what I did.

Attachments

HxDResults.txt

(19.14 KiB) Downloaded 1079 times

[fzabkar]

I don't use Roadkil, but I do use HxD and DMDE.

Your HxD sector dump appears to be of the SmartWare VCD (virtual CD). The sector size is 2048 bytes, which is consistent with a CDROM.

0x0001F800 / 63 = 2048

http://www.google.com.au/search?q=0x000 ... in+decimal

DMDE confirms that the data in sector 0 is gibberish. That's why it cannot make any sense of the partition table. Moreover, the fact that its finds a decrypted NTFS boot sector tells us that the original boot sector is intact. So our initial suspicion that only sector 0 has been damaged appears to be confirmed.

To locate the boot sector, the easiest way is to select Tools -> Search For Special Sector -> Boot Sector. DMDE should find it within a few seconds.

To save this sector to a file, select Tools -> Copy Sectors. The First and Last Sectors in the Source pane should be the same (eg 63), and the number of sectors should be 1. Select File in the Destination pane and click Save. Then upload the saved file.

As for safety, both HxD and DMDE start up in readonly mode. As long as you don't switch to edit mode (Edit -> Edit mode), no changes can be saved to your drive. In any case DMDE will prompt you before making any changes.

[BlueMooneke]

Alright,

did exactly what you told me to do.

Here is the uploaded file. It's a img file but the forums didn't allow me to upload it (even not a bin file)
so I zipped it!

I don't use Roadkil, but I do use HxD and DMDE.

Your HxD sector dump appears to be of the SmartWare VCD (virtual CD). The sector size is 2048 bytes, which is consistent with a CDROM.

0x0001F800 / 63 = 2048

http://www.google.com.au/search?q=0x000 ... in+decimal

DMDE confirms that the data in sector 0 is gibberish. That's why it cannot make any sense of the partition table. Moreover, the fact that its finds a decrypted NTFS boot sector tells us that the original boot sector is intact. So our initial suspicion that only sector 0 has been damaged appears to be confirmed.

To locate the boot sector, the easiest way is to select Tools -> Search For Special Sector -> Boot Sector. DMDE should find it within a few seconds.

To save this sector to a file, select Tools -> Copy Sectors. The First and Last Sectors in the Source pane should be the same (eg 63), and the number of sectors should be 1. Select File in the Destination pane and click Save. Then upload the saved file.

As for safety, both HxD and DMDE start up in readonly mode. As long as you don't switch to edit mode (Edit -> Edit mode), no changes can be saved to your drive. In any case DMDE will prompt you before making any changes.

As I try to understand your explanation, the 0x0001F800 is the offset? So that means that if you divide the offset of sector by its sector-number (63), you get the size of the sector? Seems legit to me. But, I took for example sector 4688, which has as offset 0x00928000, this divided by 4688 gives me again 2048 bytes. Which is again the size of a CD. I also looked at sector 209852 and it has the same result...

The 2048 bytes only describes the sector size, which is set for the whole HDD... Or did I made some kind of a mistake? Correct me! How can you confirm that this was a sector dump of the SmartWare?

Attachments

lba_2048_1.zip

(618 Bytes) Downloaded 874 times