WD My Book Encryption Question?

[ddrecovery]

Is this an encrypted drive? The drive has 6 heads, 5 good 1 failed. I imaged 5 successfully before the head swap but the platter under the last head is in bad shape, so I have an image, but by no means complete. The client gave me the USB bridge board (JMS538S) however this does not decrypt the drive.? I have also tried initio and asmedia chips but still do not read the drive. I think there is a way to tell the type of encryption used in one sector near the end of the drive. I cannot find it, but that may be under the last head which we didn't get. Any help would be much appreciated.

Attachments

WD10JMVW Hex.txt

(7.65 KiB) Downloaded 860 times

[labtech]

Definitely encrypted. Only that bridge model will work as that was the type it was encrypted with. Asmedia and such will not work.

[ddrecovery]

Definitely encrypted. Only that bridge model will work as that was the type it was encrypted with. Asmedia and such will not work.

Thats the confusing thing. The picture is of the bridge board that came with the drive and it says the drive is write-protected when scanned?

[fzabkar]

I have a 3TB My Book Essentials with the JMS538S bridge. The key sector is backed up in MOD 25 at offset 0x200.

[fzabkar]

"corsair6" has uploaded a complete dump of the VCD area at the end of his 3TB drive:

http://www.alexsoft.org/viewtopic.php?f ... 8&start=20

He has also experimented with passwords and recorded the changes to the key sector and MOD 25.

[ddrecovery]

I have a 3TB My Book Essentials with the JMS538S bridge. The key sector is backed up in MOD 25 at offset 0x200.

Thanks for the feedback fzabkar. This is the first time I have really worked on any encrypted drive with issues, so bear with me. At least 50% of the drives I see Seagates and that's no fun either...

I have read through the forum and understood it the best I can and am trying to relate it to my case. I have uploaded MOD25 from the original drive. It appears it does have password protection according to your comments in HDDOracle. Now bear in mind I am using a cloned drive to work with. If I connect the drive through SATA it reports the total size of the original drive of 3907029176 sectors. If I connect the drive using the clients bridge board, the capacity reports 625076223 sectors (both 512k sectors). Quite a bit of difference. The data on the drive in SATA runs through to sector 1906667712. So somehow the board is cutting the partition short (I think).

I have found the key sector on my clone at it does match MOD25 so is this just a case of using Smartware and entering in the Password? or is there something else I should be looking for?

[ddrecovery]

Thinking about this further, is the USB bridge board not seeing the key sector as the partition appears to stop at 625076223 when I know its locate at sector 3907024928?

[fzabkar]

You need to reduce the capacity of the 2TB clone to match the capacity of the original 1TB drive. To this end I would use a tool such as HDAT2 to create an appropriately sized HPA.

A capacity of 625076223 sectors equates to only 320GB. If you connect the bridge board on its own to a USB port, what do you see in USBDeview or UVCView? This should tell us if the bridge is native.

Could we see MOD 25? This will tell us the location of the SmartWare VCD and the end of the visible data area.

[ddrecovery]

Sorry, I didn't notice the site wouldn't upload a bin file. Here are both the USB report and the MOD25 file. The patient is a 2TB drive and the clone is a 3 TB drive. Setting the corresponding HPA now.

Interestingly, the USB bridge board has taken on the S/N of the clone, is that normal?

Attachments

MOD25.zip

(907 Bytes) Downloaded 875 times

[fzabkar]

Sorry, I didn't notice the site wouldn't upload a bin file. Here are both the USB report and the MOD25 file. The patient is a 2TB drive and the clone is a 3 TB drive. Setting the corresponding HPA now.

Your initial sector dump was for a WD10JMVW, so that's what made me think the patient was a 1TB drive.

If your cloned drive is a 3TB model and is being detected by BIOS as a 2TB, then that could be a consequence of a Gigabyte (or Asus) BIOS bug.

GigaByte BIOS bug results in loss of 1TB capacity:
http://www.alexsoft.org/viewtopic.php?f=59&t=150

Note that the BIOS overwrites the last 2100 sectors with its own backup. Therefore you need to check whether BIOS has touched the encryption key.

Interestingly, the USB bridge board has taken on the S/N of the clone, is that normal?

I'm not a data recovery professional, so this behaviour is news to me. :-)

Here is the header of the key sector in MOD 25:

Code:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000200  57 44 76 31 FC 40 00 00 00 88 DF E8 00 00 00 00  WDv1ü@...ˆßè....
00000210  00 00 00 00 00 00 F0 00 00 00 00 00 00 00 00 00  ......ð.........
00000220  01 00 00 00 00 00 46 50 00 00 00 00 00 00 00 00  ......FP........
00000230  00 02 FF 00 00 00 00 00 00 00 00 00 00 00 00 00  ..ÿ.............
00000240  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000250  20 00 BA 4C 00 00 00 01 00 00 00 00 57 44 76 31   .ºL........WDv1

I believe that offset 0x208 is the start of the VCD area, in which case it also represents the capacity of the visible user area.

0xE8df8800 x 0x200 = 2 000 365 289 472 bytes

0xE8df8800 = 3 906 963 456 sectors

3 907 029 176 - 3 906 963 456 = 65 720 sectors (size of VCD + security stuff)
(3 907 029 176 - 3 906 963 456) x 512 bytes = 33.6 megabytes

IIRC, the key sector should be located at around 4000 sectors from the end of the physical drive.

[ddrecovery]

I have found the key sector at 3907024928. BIOS issues aside, is this a case of basically setting the HPA so the clone has the same capacity as the patient and the USB bridge will find the key sector where it expects to? or there another step in the process?

Also from the MOD25 header it does look like it has bee a password set, but the client says it doesn't.

The Data Recovery Professional

[fzabkar]

I have found the key sector at 3907024928. BIOS issues aside, is this a case of basically setting the HPA so the clone has the same capacity as the patient and the USB bridge will find the key sector where it expects to?

ISTR that is what one of the professionals did when he had a problem with an Essentials drive.

[ddrecovery]

Thanks everyone for the professional help
Made sure the VCD was in the right place and correct.
Reset the HPA.
Drive decrypted through the USB bridge.