WD MYBOOK WDBFJK0020HBK - 1130 DECRYPTION

[ROb]

I had a WD MYBOOK WDBFJK0020HBK - 1130
Due to power fluctuation the USB Bridge Burnt very Badly. The Internal HDD PCB also Burnt including the ROM.
Internal HDD was WD20EZRX-00D8PB0 Ver -0010038 as the PCB was Burnt, even the ROM was Blown. I have adopted another PCB and Recovered the ROM.
Now the DISK is working perfectly.
The Challenge here is the Data looks Encrypted. PC 3k detects the encryption on sector 3908775968 of ic type JMS538S but interesting to note here is that the USB bridge has IC ASM1051W on it.
When i decry-pt it using the key found by PC 3K the data is still incorrect.
To clear my doubts i sourced same USB Bridge 3 no. and found that all the internal drives were not encrypted. Meaning none were encrypted.
When i connect this patient drive to those new bridges the disk does not give access to it.

My questions are
1) Does all the MY BOOK have encryption ?
2) Why is the drive showing wrong encryption key or it is correct ?
3) Why this disk is not being detected on the new USB Bridges.

Thanks in anticipation.

[labtech]

I had a WD MYBOOK WDBFJK0020HBK

This MDL has hardware encryption and supports smartware, so data should be encrypted.
Perhaps, manual hex analysis would be more conclusive then relying on what PC3K or USB bridge tells initially.

[northwind]

Post modules 25 and 38 here.

[fzabkar]

Could you upload a photo of the damaged bridge? If the damage is confined to the dual MOSFET switch IC, then the fix would be very simple (2 wire links).

[ROb]

This MDL has hardware encryption and supports smartware

I have similar or another WDBFJK0020HBK and WDBFJK0040HBK and surprisingly both does not any encryption on it

Post modules 25 and 38 here.

Here are both Mod 25 and 38

Could you upload a photo of the damaged bridge?

As you can see the Bridge itself is burnt so no hopes of fixing
Thanks

[fzabkar]

Internal HDD was WD20EZRX-00D8PB0 ...

The Challenge here is the Data looks Encrypted. PC 3k detects the encryption on sector 3908775968 of ic type JMS538S but interesting to note here is that the USB bridge has IC ASM1051W on it.

AFAICT, the WD20EZRX has 3907029168 user addressable sectors. Are there versions of this drive with higher capacities?

[fzabkar]

I notice that there are several versions of the Asmedia ASM1051 chip (A/L/U/E), some with encryption and others without. For example, the ASM1051A supports AES256 hardware encryption. Do your donor bridges have the same suffix as the patient?

If you can't find a software solution, would it be possible to copy your board's firmware to a compatible board? The flash memory chip appears to be below and to the left of the bridge.

[ROb]

the WD20EZRX has 3907029168 user addressable sectors. Are there versions of this drive with higher capacities?

Yes few drives i have with higher capacities.

Do your donor bridges have the same suffix as the patient?

Yes both the donor and patients bridges are of same suffix i.e W ( ASM 1051W)

would it be possible to copy your board's firmware to a compatible board?

I tried moving boards firmware from patient to donor but there is no change in status. The Donor keeps working w/o any encryption.

Here is what PC3k finds on Sector 3908775968 as encryption

[data-medics]

I've run into a few My Books and even a couple My Passports lately that had encryption chips but weren't encrypted. I know Luke from RF found one also.

Seems this is a new thing from WD that they aren't all encrypted. Might even be a defect, I had one where the donor was encrypted, but the matching patient wasn't.

[Dmitri]

is the Data looks Encrypted. PC 3k detects the encryption on sector 3908775968

What PCB you're working with: a USB or a SATA one?

Seems this is a new thing from WD that they aren't all encrypted. Might even be a defect, I had one where the donor was encrypted, but the matching patient wasn't.

This may happen due to import/export restrictions for different countries and the patient was manufactured e.g. for a country, which prohibits importing devices using encryption.

[ROb]

What PCB you're working with: a USB or a SATA one?

Well i am working with the drives Native PCB i.e. SATA.
the USB Bridge is separate one.

Can this issue due to improper LBA ?
Or something happened during the ROM Recovery as the ROM is adopted one ?
Help appreciated.

Thanks

[ROb]

Hello,
Can any one study and Mod 25 and Mod 38 and suggest some solution.

Thanks

[Hary]

I don't think yours 25 and 38 modules store any useful information for decryption.
If it had, You coluld probably find inside copy of your sector 3908775968, already found by pc3k utility.
pc3k utility suggest that those modules stores Encryption Information, just because inside in older WD passport drives there was a copy of key sector from the end part of user data.
My suggestion is find the working USB bridge with ASMEDIA chip ASM1051W, but comming from encrypted WD My Book drive and try to connect to Your patient drive, it should decrypt Your drive, but only if the key sector is stored in correct place counting from the last sector.
By the way I am working on similiar case, but my drive had missing configuration (parameter) module 02, so I also have no information about original capacity in LBAs. As these drives seems to have slightly different numbers of addressable sectors then 3907029168, can You post how many sectors has your drive?

[michael chiklis]

Hi, i've this drive:
WD My Book WDBFJK0030HBK-04 - 1230
USB bridge: ASMEDIA ASM1051W BNF2502783

I attached the drive directly to my MoBo via sata, i would expect that windows was not able to detect partition due to HW encryption, but this time his behavior was a bit different. Windows detected the partition but as corrupt (it asked me to format).
Woow that's strange, usually when i attach My Book drives directly to the sata, windows is not able to detect any partition, but this time it detect somehow!

So i thought that maybe it wasn't really encrypt but had corrupt filesystem, so i opened R-Studio:

With my surprise i found that R-Studio is able to see and recover all files and folders if i double press on 'Partition1', it shouldn't be able even to detect partition if there was a real HW encryption!
What's strange also is that R-Studio detects 2 partitions, but this drive i know that it has only 1 partition (maybe R-Studio is not detecting 2 partitions but just 2 pieces of 1 partition).

Ok, so i guess it is not HW encrypted this drive, but why windows doesn't detect the partition?
Another pic about what 'disk management' show:

Now i have mounted the drive on his MyBook enclosure, it is detected without any problem on windows.
This is what 'disk management' see now that the drive is again mounted on his enclosure:

and R-Studio:

Here i attached also mod 25 and 38

MOD 25 - 38.rar

(664 Bytes) Downloaded 809 times

[Hary]

This topic was started one year ago, so now we know more about those drives,
So, You are right, there is no HW encryption,
there is nothing to do with asmedia chip,
( this one works only as transparent bridge )
theese drives are so called "SED" drives (Self Encryption Drive) so the encryption/decryption procedure is done by
processor on drive PCB and drive firmware itself.

[drHDD]

What's strange also is that R-Studio detects 2 partitions, but this drive i know that it has only 1 partition (maybe R-Studio is not detecting 2 partitions but just 2 pieces of 1 partition).

Ok, so i guess it is not HW encrypted this drive, but why windows doesn't detect the partition?

Now i have mounted the drive on his MyBook enclosure, it is detected without any problem on windows.

There is one answer for all your questions - box uses 4k sector for read\write operations (instead of regular 512b sector in windows).

[fzabkar]

Seagate's and WD's 3TB external drives are configured with 4KB LBAs. When you remove the drive from its enclosure, you expose its native 512e LBAs. This means that the OS now sees a 4Kn file system on a 512e physical drive, rendering the file system inaccessible.

The reason that Seagate and WD do it this way is to enable a legacy OS such as Windows XP to work with the drive in MBR mode. When the drive is connected to a SATA port, Disk Management sees a single MBR partition. The capacity of this partition is 349 GiB (= 3TB / .

[michael chiklis]

Thank you all, i understood!
What i'm really surprised about, is that i found this MyBook not encrypted (my first unencrypted MyBook).
Until yesterday i knew that all MyBooks had HW encryption

[Hary]

Thank you all, i understood!
What i'm really surprised about, is that i found this MyBook not encrypted (my first unencrypted MyBook).
Until yesterday i knew that all MyBooks had HW encryption

Not quite like this. This one also has encryption, but as long as its original firmware works correctly, You will see your data in decrypted form (making You think drive is not encrtpted ).
Encryption/decryption process can be switch on and off by changing one byte in drive parameter module.

[michael chiklis]

Thank you Hary, good explanation.