Cloning LAN interface encrypted - MyCloud Home

[Yehiel Malka]

Hello guys,
Recently our lab got a case with MyCloud Home 4TB LAN interface external drive.
the costumer deleted one folder and claim that he did not write anything after that.

So we open the enclosure and inside there is 4TB SATA drive, with LAN interface PCB adapter.
We took out the PCB adapter and clone it, after that, we scan with DE, UFS, and R-studio but after every scan, we got the same result - we didn't find actual data at ALL. so we believe that the PCB encrypt the drive.

BTW - if we connect it by LAN to network, put a user name and password we can see the network drive and all the data (yet, of course, can't scan it).

We did not find any method to clone the drive sector-by-sector using the PCB adapter with a LAN interface.
I attached the PCB adapter photo if anyone has an idea, (electronic idea ) we will be glad to hear it.

Thanks guys

Attachments

[fzabkar]

How about this?

take a 4TB donor HDD and zero fill it
put it in the NAS and initialise it
create a single, dummy 4TB file consisting of zeros on your host PC and download it to the NAS via the LAN
remove the donor from the NAS
locate the dummy 4TB file on the donor -- it will be encrypted, but the data pattern should be obvious, hopefully the file will be contiguous
install both patient and donor in your host PC
clone your 4TB patient drive into the 4TB dummy file area on your donor
reinstall the donor into the NAS
retrieve the 4TB "dummy" file from the NAS via the LAN -- this file will hopefully contain your decrypted disk image
run your data recovery software against the decrypted disk image

You would need to ensure that the original encryption key was maintained throughout the entire process.

An easier method would be to decrypt the patient using "reallymine", assuming it recognises the encryption.

If the drive has an encryption key at the end of the user area, as most WD products do, then you may need to clone this key separately and ensure that it occupies the same sectors on the donor.

[fzabkar]

ISTM that one should backup all the resources, including the serial flash memory on the bridge PCB. Then modify the donor drive so that it identifies in the same way as the patient (modules 0x0D and 0x02), and ensure that it has the same encryption key (modules 0x28, 0x35, "Smartware area", etc).

Since the deleted file space is not visible via the LAN, we need to move these data into an actual file that can be served up by the NAS. That's the basis of my procedure.

[einstein9]

@ Yehiel Malka

Think about ssh access...

[pepe]

Hello,

i know this is an old topic but...
these drives are not encrypted but they store the data in a tricky way. Dunno about the deleted part, but the rest can be recovered nicely.

pepe