Hello everyone,

I found in a one of my drawers a WD Passport Essential which is containing photos, and financial informations. It was untouched for many years until today and of course, I don't remember the password.
After many researches, I found out that this drive has an Initio INIC-1607E and there is a vulnerability which would maybe let me recover the data. To perform the decryption, I need to extract the encrypted DEK (encryption key) at the sector 1465143304 (because it is the 750Gb drive) to bruteforce it (which is possible because of the vulnerability). To do so, I removed the capacitors C13/C18/C31/C33 and soldered wires to E71/E72/E73/E75 and the ground. I then connected the sata port and the USB (for the power) to a computer and nothing. On two different motherboards, the drive isn't detected in the bios or in linux with fdisk -l. I can hear it spinning but nothing from the reading head. I checked my connections and nothing weird. What do you suggest?

I join pictures to show you the situation.

I haven't checked your wiring, but you could use the following SATA PCB, with the same MCU, to follow the tracks from MCU to SATA connector.

https://images-na.ssl-images-amazon.com/images/I/71MqebSA8aL._SL1296_.jpg

_________________
A backup a day keeps DR away.

Bruteforcing DEK on INIC-1607E it's not as easy as it sounds, it's actually very hard.
Although you can try to bruteforce the password, which should be easier, especially if you can guesstimate lists of possible password you might have used.

_________________
SAN, NAS, RAID, Server, and HDD Data Recovery.

I think those wires are too long, they've to be very short (less than 4 cm).

_________________
My firmware database:
https://mega.nz/folder/O01DkBRI

Hello,

@Michael Thanks for that suggestion, I will try this solution when I'll have a bit more time.
What should I see in Linux ? Something which looks like as a normal WD drive ?

@Doomer According to what you say, I might have possibly misunderstood this research: https://eprint.iacr.org/2015/1002.pdf
At the page 26: "This currently leaves us with a bruteforce attack to predict any on-device DEK key material from INIC-1607E with a complexity of 2^10 ∗ 2^15 = 2^25 .
This has been implemented as a PoC and multiple tests verify the complexity."

It seems to me that the complexity isn't that huge.
What do you suggest to implement the brute force attack on the password? Generate a "random" password, hash it to create a KEK and try it to decrypt the DEK ?

Thanks.

You could send a message to member “kaeding” (author of a dedicated tool called reallymine), who is very knowledgeable about that kind of issue with encrypted WD drives, and not greedy when it comes to the pricing of his services. If he were to help you he would request a proof of ownership.

Hi! Well I'm a NOOB so I can only say what I'd try and what's worked for me in the past...

Firstly, Hiren's Boot Disc. That's got some excellent password removal tools on it. It's a free download, easily google-able.

Secondly - and I am NOT an affiliate or have anything to do with this lot, mods! - Stellar Data Recovery's a good tool for recovering data from passworded drives. I use it but am nothing to do with the company.

Another great utility, which I've also nothing to do with, is A-FF Repair Station. It's a VERY fast - on the whole - password remover. Again, I've used it loads.

Hope this helps!

Yours respectfully

Chris.

2^25 is a little bit wishful thinking
Because you would need to overcome GetTickCount delta problem. After of course you actually implement the algo for GetTickCount and HW RNG32, which is also one hell of a research to do.


Moving back to Algorithm 7, the inner for loop has a call to GetTickCnt() for each iteration. So we
need to measure how many opcodes are executed in each iteration of the loop. This turned out to vary
within a narrow interval, and it turns out that different calls to HW RNG32() adds different tick deltas,
based on the state of the RNG



I suggest you grab a list of passwords you might have used and try them

_________________
SAN, NAS, RAID, Server, and HDD Data Recovery.

Thanks for all your comments and information.