my book 1 TB issue

[raven4d]

Hello friends , and happy easter for all ..

i got this 1 TB drive that came from a my book essential .

client claims that the drive suffered from an electrical issue , he used to use a password , but now the drive should be unprotected .

examining the hard encryption board , reveals no harm , trying to image the drive with following steps :

doing head map shows (4 heads ) >> heads test showing issues with head 3 near the 80% of the drive capacity , imaging the drive with only the 3 good heads showing data being imaged till around 62% of the drive (no mbr or MFT tables detected ) , then zeros , imaging using only head 3 to fill gaps from 0 >>62% showing data on that head (sure thing ) , 860 LBAs were un readable on that head ..

checking the empty space for data , every 100000 LBAs to verify that it doesn't hold any data , will confirm that the drive has no data after the 62% of it's capacity , unless a tiny portion near by the 99% (around 20000 LBAs) ..

imager detects ( 10800 EXE files , 1 jpg , 4 MFT records ) only ..

from my point of view , the data area has been successfully imaged , head 3 issue is not a big deal as it didn't affect the data but with those 800 LBAs , WD my book , will encrypt data by default even if no password is set ..


now , does connecting the destination drive (seagate ) to the hard encrypt board , will affect the image some how ?? does that board locked to a certain SN ?

any ideas will be appreciated , many thanks in advance

Attachments

[Alexii]

Make sure you cut the size of the destination to be exactly equal with source. Some data at the end is necessary for decryption. Connect ur destination drive to the USB/Sata bridge ( original one ) and if all is well you will see the data. So far i never had to worry about serial numbers or hard drive models when imaging encrypted WDs. Only 1 thing to remember is make sure cut the destination drives size to be equal with patient.

[labtech]

Could be wrong.. but it may be that sometimes when the destination drive (the clone drive) is a different manufacturer/model, then there may be surprises when the goal is to decrypt data via controller.

[scratchy]

If the Seagate goes offline after a few minutes or does not start at all, copy from Seagate to a WD drive and as Alexii says to set HPA so the drive is the same LBA as the original.

I have had mixed results with non-WD drives so now I always copy to a WD drive.

[raven4d]

thanks for this notice ..

connecting the destination (seagate drive) to the bridge board ..

drive spinsup fine , then drives spins down , then initialize again , data is there ,, trying to copy anything , drive will spin down again

seems the bridge is buggy

[labtech]

seems the bridge is buggy

Think about what has been told in previous posts. It will likely help you not waste your time.

[pcimage]

Use a WD green, you'll quite possible get similar issues with a WD black

[data-medics]

Make sure you cut the size of the destination to be exactly equal with source. Some data at the end is necessary for decryption. Connect ur destination drive to the USB/Sata bridge ( original one ) and if all is well you will see the data. So far i never had to worry about serial numbers or hard drive models when imaging encrypted WDs. Only 1 thing to remember is make sure cut the destination drives size to be equal with patient.

Alexii is right, you need to clone the last 100,000 or so sectors of the drive as somewhere in there is the magic sector to decrypt the data. These drives always encrypt the data and just use the password along with the encryption key stored at the end of the drive.

[data-medics]

Also you need to either image to a drive with the same LBA size or know how to set the MAX LBA size on the target drive to be the same. Seagate is usually a bigger LBA size than WD, so that can be an issue because it's looking in the wrong place for the "magic sector".

Or as an alternate method, it is possible to copy the magic sector to the corresponding one based on the LBA difference. I did this once when I was imaging to a drive that had a lba 1 higher than the orig. Just Copy/pasted the sector over one to match.

But changing the max LBA is usually easier.

[raven4d]

If the Seagate goes offline after a few minutes or does not start at all, copy from Seagate to a WD drive and as Alexii says to set HPA so the drive is the same LBA as the original.

I have had mixed results with non-WD drives so now I always copy to a WD drive.

Hello again , and really thanks for your precious info ..

i tried seagate - samsung , and WD green ( wd10ears-00y5b1 )
using the first two options gave me a view on folders , and drive will spin down once i try to copy somthing ..

using the WD drive , i thought it worked till it finished coping ~500 MB
then drive span down .. and never up again , till i repower it



will start looking for a donor bridge as well

[raven4d]

Good evening again ..

am 100% sure it's a bridge issue , i tried like 4 * 1 TB drives with that image , almost all act the same , except for the WD green , which will allow me to copy up to 800 MB ...

specially that the bridge board has some hand writings like TX , RX , B , A

so i think this drive was in some computer repair shop before reaching me , god only knows what they did test on it ..

tried to clean up the bridge by alcohol .. same result ..

seems something getting hot .. because after each time , i have to stop for 15 mins to be able to copy more ..

any helo troubleshooting this issue .. many thanks in advance

[raven4d]

hello again


no donor bridge found , am searching for a way to disable the encryption while the patient bridge is on , so after that i connect the drive directly to sata ..

anyone experienced such thing ?

many thanks

[raven4d]

hello again ,


found a way around the issue of the bridge , fixed temporary , and data in safe place now ,

many thanks to those who helped