WDBAAE5000ASL-00 My Passport Firewire Encryption

[PCGuru]

This is the Firewire-800 plus USB version. Unlike the USB only Passport drives, it has a standard SATA drive plus a bridge board with an Oxford Semiconductor OXUF943SE controller that includes hardware encryption.

The owner fried the bridge board by plugging a Firewire 400 cable into his Mac upside down. If I connect just the SATA drive is reads fine, appears healthy, but all the sectors are encrypted. Another message thread here suggested that I could use the bridge board from a similar drive and it would read the key off a sector near the end of the drive. I tried this and it did not work. Then I noticed that the two drives I have here, though both say model WDBAAE5000ASL-00, and both are marked R/N C3B, they have slightly different bridge boards. The bad bridge board is 4061-705063-003 revision AB but the donor drive bridge board is revision AM.

I also noticed that the two bridge boards have a slightly different Oxford chips. The bad board has OXUF943SE-LQAG but the donor drive is OXUF943SE-LQCG.

I had hoped that it would be possible to move a small flash chip with the encrption key from the old board to the new one but I am not certain which chip would store it: is it in the U2 Winbond chip, or in one of two smaller 8 legged chips (Q3 marked 4840 and Q8 marked 4425)? And would this even work considering that they have a different revision of the controller?

In thread http://forum.hddguru.com/passport-studio-recovery-issues-due-encryption-t24767.html Dark-Sider appears to have a similar problem, and Doomer suggests that there is a difference according to year of manufacture.

Does anyone happen to have a schematic of this board? If so we might work out which chips have been damaged. has anyone had success reviving one of these bridge boards?

[jignesh]

This is the Firewire-800 plus USB version. Unlike the USB only Passport drives, it has a standard SATA drive plus a bridge board with an Oxford Semiconductor OXUF943SE controller that includes hardware encryption.

The owner fried the bridge board by plugging a Firewire 400 cable into his Mac upside down. If I connect just the SATA drive is reads fine, appears healthy, but all the sectors are encrypted. Another message thread here suggested that I could use the bridge board from a similar drive and it would read the key off a sector near the end of the drive. I tried this and it did not work. Then I noticed that the two drives I have here, though both say model WDBAAE5000ASL-00, and both are marked R/N C3B, they have slightly different bridge boards. The bad bridge board is 4061-705063-003 revision AB but the donor drive bridge board is revision AM.

I also noticed that the two bridge boards have a slightly different Oxford chips. The bad board has OXUF943SE-LQAG but the donor drive is OXUF943SE-LQCG.

I had hoped that it would be possible to move a small flash chip with the encrption key from the old board to the new one but I am not certain which chip would store it: is it in the U2 Winbond chip, or in one of two smaller 8 legged chips (Q3 marked 4840 and Q8 marked 4425)? And would this even work considering that they have a different revision of the controller?

In thread http://forum.hddguru.com/passport-studio-recovery-issues-due-encryption-t24767.html Dark-Sider appears to have a similar problem, and Doomer suggests that there is a difference according to year of manufacture.

Does anyone happen to have a schematic of this board? If so we might work out which chips have been damaged. has anyone had success reviving one of these bridge boards?

Hi Friend PCGURU

First We Want To See The Pic Of Your Burnt Board.
Plz Provide Good Clean Photo Of Your Both Damaged Pcb And Donor Pcb.So We Advice You.

Your Friend
Jignesh

[fzabkar]

I found one photo, but not of the Oxford side.

4061-705063-003 Rev P1 PCB (rear):
http://farm9.staticflickr.com/8454/8021 ... b1dd_b.jpg

The Winbond chip would be the flash memory.

Did you try accessing the external drive via the USB port? Perhaps only the Firewire chip (TI TSB81BA3D?) was damaged?

FireWire (IEEE1394) bus interface pinout:
http://pinouts.ru/Slots/ieee1394_pinout.shtml

[PCGuru]

Thank you for your attention. In this case we can see no visible damage to the drive. Yes, we tried using the USB port and device was not recognized at all.

Pictures of the damaged board attached. The other (donor) board looks physically identical except for the controller part number and revision code.

Attachments

[einstein9]

This is the Firewire-800 plus USB version. Unlike the USB only Passport drives, it has a standard SATA drive plus a bridge board with an Oxford Semiconductor OXUF943SE controller that includes hardware encryption.

The owner fried the bridge board by plugging a Firewire 400 cable into his Mac upside down. If I connect just the SATA drive is reads fine, appears healthy, but all the sectors are encrypted. Another message thread here suggested that I could use the bridge board from a similar drive and it would read the key off a sector near the end of the drive. I tried this and it did not work. Then I noticed that the two drives I have here, though both say model WDBAAE5000ASL-00, and both are marked R/N C3B, they have slightly different bridge boards. The bad bridge board is 4061-705063-003 revision AB but the donor drive bridge board is revision AM.

I also noticed that the two bridge boards have a slightly different Oxford chips. The bad board has OXUF943SE-LQAG but the donor drive is OXUF943SE-LQCG.

I had hoped that it would be possible to move a small flash chip with the encrption key from the old board to the new one but I am not certain which chip would store it: is it in the U2 Winbond chip, or in one of two smaller 8 legged chips (Q3 marked 4840 and Q8 marked 4425)? And would this even work considering that they have a different revision of the controller?

In thread http://forum.hddguru.com/passport-studio-recovery-issues-due-encryption-t24767.html Dark-Sider appears to have a similar problem, and Doomer suggests that there is a difference according to year of manufacture.

Does anyone happen to have a schematic of this board? If so we might work out which chips have been damaged. has anyone had success reviving one of these bridge boards?

could you post here the hdd model (from inside)
not the WDBAAE5000ASL label from outside

[PCGuru]

fzabkar, thank you for your comments but I don't see a TI chip. I attach a close up of the main chip markings: the OXUF943SE-LQAC controller apparently combines FW, USB, SATA and encryption. http://www.plxtech.com/products/consumer/oxuf943se But then I don't see why they needed the LSI FW843 chip, which is also apparently a FW800 controller?

Attachments

[PCGuru]

could you post here the hdd model (from inside)
not the WDBAAE5000ASL label from outside

It is a standard 500 GB SATA drive WD5000BEVT-00A0RT0.

I looked at it with a hex editor and start of drive is clearly encrypted.

But the very last sector on drive is probably not: it starts with signature wdDI and ends with bytes AAh, 0Ah.
At end-16 (and at end-32) is a sector that contains Unicode string "VIDEOS 09"
At end-18 (and end-35) is a sector starting "wdHS" ending with bytes 09h, A7h
At end-36 (and end-37) sector starting "wdMP" ending with bytes 63h, 27h

There is some unencrypted data near the end of the drive (presumably the CD image that someone mentioned) as I can see text such as "Flash Player". This ends with a long block filled with FFh in sector 976125731 (end-647437) followed by a sector starting with "H+". After that there are a lot of zero filled sectors until end-37.

[Doomer]

fzabkar, thank you for your comments but I don't see a TI chip. I attach a close up of the main chip markings: the OXUF943SE-LQAC controller apparently combines FW, USB, SATA and encryption. http://www.plxtech.com/products/consumer/oxuf943se But then I don't see why they needed the LSI FW843 chip, which is also apparently a FW800 controller?

There is a version of similar PCB but with two FW800 ports (Revision 705110-002)
Per my understanding Oxford has only one FW port, so probably WD decided to do FW ports on LSI because it supports more than one FW800 port

[Doomer]

I had hoped that it would be possible to move a small flash chip with the encrption key from the old board to the new one but I am not certain which chip would store it: is it in the U2 Winbond chip, or in one of two smaller 8 legged chips (Q3 marked 4840 and Q8 marked 4425)?

Winbond is the flash chip that includes encryption key

[fzabkar]

There is a version of similar PCB but with two FW800 ports (Revision 705110-002)

I don't know if it's the same number, but I found this while I was searching for the OP's PCB:
http://farm9.staticflickr.com/8458/8021 ... c1c6_b.jpg

[fzabkar]

I had hoped that it would be possible to move a small flash chip with the encrption key from the old board to the new one but I am not certain which chip would store it: is it in the U2 Winbond chip, or in one of two smaller 8 legged chips (Q3 marked 4840 and Q8 marked 4425)?

I wasn't able to read all the chip markings, but AFAICT there is a 5V switchmode regulator consisting of Q3 (AO4840), a 4R7 coil (L19), and U4 (NX2838DS). I'm guessing that this regulator is only needed when the drive is powered from the Firewire port, otherwise the power is provided via USB.

Q8 (AO4425) is a MOSFET. I suspect that it switches +5V power to the drive's SATA power connector under control of the Oxford bridge.

U7 and U6 apear to be 3.3V regulators, possibly switchmode, although I can't positively identify their associated coils. They look like NX4110 parts.

FW843, LSI, IEEE 1394b Bilingual Three-Cable Transceiver-Arbiter:
http://www.lsi.com/downloads/Public/139 ... _FW843.pdf (Product Brief)
http://www.lsi.com/products/networkingc ... FW843.aspx

NX2838DS, Microsemi, SINGLE SUPPLY HIGH FREQUENCY ADJUSTABLE SYNCHRONOUS PWM CONTROLLER WITH A 3.3V/700mA LDO:
http://www.microsemi.com/document-porta ... 6-nx2838ds

AO4840, Alpha & Omega, 40V 6A Dual N-Channel MOSFET:
http://aosmd.com/pdfs/datasheet/AO4840.pdf

AO4425, Alpha & Omega, 38V 14A P-Channel MOSFET:
http://aosmd.com/pdfs/datasheet/AO4425.pdf

NX4110, Microsemi, 1A SYNCHRONOUS BUCK SWITCHER WITH FET ON BOARD:
http://www.microsemi.com/document-porta ... 4110ds-pdf
http://datasheet.eeworld.com.cn/pdf/MIC ... 0CZ1TR.pdf

Last edited by fzabkar on April 2nd, 2013, 18:35, edited 2 times in total.

[PCGuru]

I just took another look at the data area of this drive and noticed something very strange. This drive does not have a user password, so maybe it would be different if a password were in use.

Some sectors (which i assume are sectors that have never been written to) are all zero. Others (especially the header sectors) contain exactly the same pattern of 16 bytes repeated over and over (it occurs over a million times in just the first 400,000 sectors). It appears that zero bytes, regardless of which sector they occur in, have been replaced by this same 16 byte sequence!

My understanding was that hardware disk encryption should vary the encryption key for each sector but this does not seem to. Instead the same encryption appplies to every sector. Perhaps it is not really encrypted but simply a quick substitute cipher?

Of course anything more complicated than a simple XOR would still be hard to figure out without knowing the exact algorithm used.

Attachments

[fzabkar]

AIUI, 128-bit AES encryption applies the same encryption key to each group of 16 bytes (= 128 bits) throughout the entire user area.

When the drive is manufactured, it is first zero-filled. It is then placed inside the enclosure and partitioned and formatted via USB.

[Doomer]

There is a version of similar PCB but with two FW800 ports (Revision 705110-002)

I don't know if it's the same number, but I found this while I was searching for the OP's PCB:
http://farm9.staticflickr.com/8458/8021 ... c1c6_b.jpg

That's PCB for 3.5" drives

[Doomer]

Perhaps it is not really encrypted but simply a quick substitute cipher?

No
These drives use AES256 or AES128(less common) encryption in ECB mode. AES ECB is the basic implementation of AES encryption algorithm where data is divided on 16-byte pieces and encrypted with the same key w/o any further modification.
That's why you see this pattern. It's "decrypted", zero-filled unoccupied drive space.

[Randy]

I'm sure, you already done that, but, did you checked this burnt board for blown fuses, zero ohm resistors, torn inductor coils?
Does ICs on the board powered with correct voltage, and ground pins still connected to the ground? Is they abnormally hot, while board is powered?
On a first foto i can see some DC/DC converter IC with it's coil and diode on the other side. If it so, is it working correct?

Maybe, it will be more easy to repair this burnt board (if it possible), instead of trying decrypt the data with the good one?

[einstein9]

I'm sure, you already done that, but, did you checked this burnt board for blown fuses, zero ohm resistors, torn inductor coils?
Does ICs on the board powered with correct voltage, and ground pins still connected to the ground? Is they abnormally hot, while board is powered?
On a first foto i can see some DC/DC converter IC with it's coil and diode on the other side. If it so, is it working correct?

Maybe, it will be more easy to repair this burnt board (if it possible), instead of trying decrypt the data with the good one?

Agree with you here, chances are more.

good luck

[PCGuru]

Thank you all for so much input. When I received this job I Googled for "firewire inserted upside down" and the consensus was that it would have fried the Firewire controller, which I thought was the same chip as the USB, SATA and encrption. However we have now learnt that this board uses a separate LSI chip for FW, so the damage could be elsewhere. I will follow your suggestions and test further.

[fzabkar]

Could it be that the FW843 chip was the only culprit and that the Oxford bridge is hanging while looking for it?

If you examine the firewire pinout, a connector reversal would apply power to the FW843 signal pins.