WD My book recovery

[dobrevjetser]

@Vulcan: i had situations where a clone from a wd drive to a non wd drive would not spin up with the decryption board attached. Cloning to a wd drive solved this problem. Thats why i suggest to clone to a wd drive.

[Vulcan]

@Dobre,

Thanks for explaining. I can see that we interpreted the likely hardware setup for the OP's (potential) cloning differently. The config which I was expecting, would never have the decryption board attached to the target of the clone, so that limitation you kindly explained would not be seen. However in the alternative hardware setup, I can see that your warning would certainly apply.

[fzabkar]

The VCD is configured with 2048 bytes per sector whereas the HDD (USB mass storage device) has 512 bytes per sector.

Using DMDE, go to sector 0 and make the following changes. You will need to select Edit -> Edit Mode and Mode -> Hexadecimal. When you are done, select Edit -> Write Changes. Make sure that you are working with the correct physical drive. You could always save sector 0 before you begin, in the same way that you saved sector 2048. That is, select Tools -> Copy Sectors and choose 0 as the First and Last Sector, and Number of sectors = 1.

After you are done, you will probably need to eject your USB drive and then reconnect it so that your OS will re-examine the file system. If your file system has no additional damage, then you should be good to go. Otherwise, if the USB connector broke off during a file transfer, or before the OS was able to flush the write cache, then you can expect some file corruption, in which case you will need to clone the drive and perform a data recovery.

Code:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
...
000001A0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001B0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20
000001C0  21 00 07 FE FF FE 00 08 00 00 00 70 5B 74 00 00
000001D0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001E0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001F0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA


[BlueMooneke]

I'm totally lost... Sorry for being so noobish!

When I get the menu in DMDE where he finds a partition called My Book on first sector 2048, I can "right click" it and click some options like:
- Insert the partition (undelete)
- Restore bootsector from the copy (replace)

Couldn't any of them work?

I ask this question because when I read sector 0 from DMDE, I get other information than from HxD...
HxD gives me a lot of 00 on sector 0, DMDE gives me like (first line)

Code:

LBA: 0       Block: 0
0000000000: 43 24 8B 29-DD 8F 2D B5-8B CA A2 2E-EA 2B 3F 1D


So if I replace this with your code, I think I mess up...

Does this makes any sense?

[fzabkar]

@BlueMooneke, with respect, it appears that this task is beyond you. Please do not mess with sector 2048 or any other menu item.

I think you should clone your drive and use data recovery software on the clone.

Sorry.

[BlueMooneke]

@fzabkar: I know... I'm very new to this. But I would like to learn about it. That's why I came here... I figured out myself that replacing the USB connector on the pcb would "solve" a part of my problem. I could run the recovery tool, nothing special about it. It's just the fact that I try to understand how to fix it the "harder" way.

I hope to get some beginner steps, so I can eventually figure it out myself. That's why I asked you the math question. That's why I ask the difference about the two programs. I would like to learn more about a HDD apart from being told: "It is divided into sectors, ..."

I still hope I can make this thread usefull. The question is: would you guys try to help me with it?

As I try to: Sector 0 contains the MBR. (This is right huh?)
Because of windows did not recognize the encrypted data (rubbish to him, so it could not read the MBR), he asked me to create one.
I clicked "YES". The rest of the HDD is not changed.

In this MBR, some of its entries are pointers to partitions on the disk. Because of overwriting it, there are NONE while in reality, they are still on the same place.
So, if I find the sector where the partition begins and I add this to the MBR, windows will recognize it and be able to read from it. As to windows, nothing happened.

My problem is: I can't work with both programs. If I select sector 0 in both HxD and DMDE, I get other hex code and can't really seem to figure out why. Probably because I select the wrong disk?
Second question is: How can I ever find the sector containing that specific partition? I guess there is some pattern which I have to look for...

I hope I made myself clear and hope you guys try to help me...

Already, thanks in advance!

BlueMooneke

[BlueMooneke]

Hoped to get some info from a community... Apparently this community doesn't want to help new user!

[labtech]

There is too much uncertainty going on. To give advice without having the drive in the hands is asking for trouble. As result the community has helped as much as possible.

[BlackST]

Hoped to get some info from a community... Apparently this community doesn't want to help new user!

Try WD forum or other newbie-for-newbie then

I suggest you to try "some" other forums with same attitude, you'll miss this one in 1 nanosecond.

Good luck.

[fzabkar]

@BlueMooneke, I have attempted to help you as best as I can. I have advised you EXACTLY what to do, and which tool to use. I do understand that you are reticent to try this procedure, so I have suggested that you play it safe and clone your drive. At the very least you will then have a backup of your data.

As for teaching you about MBRs, partition tables, boot sectors, etc, that cannot be achieved in a single thread. IMHO, the best resource is the following:

http://thestarman.pcministry.com/asm/mbr/index.html

When reconstructing your partition table, I used the information at the beginning of your boot sector:

Code:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  EB 52 90 4E 54 46 53 20 20 20 20 00 02 08 00 00  ëR.NTFS    .....
00000010  00 00 00 00 00 F8 00 00 3F 00 FF 00 00 08 00 00  .....ø..?.ÿ.....
00000020  00 00 00 00 80 00 80 00 FF 6F 5B 74 00 00 00 00  ....€.€.ÿo[t....
00000030  00 00 0C 00 00 00 00 00 FF B6 45 07 00 00 00 00  ........ÿ¶E.....
00000040  F6 00 00 00 01 00 00 00 31 C0 3A C2 D8 3A C2 12  ö.......1À:ÂØ:Â.
00000050  00 00 00 00                                      ....


I also used a utility such as the following:

CHS/LBA Conversion Utility:
http://homepage2.nifty.com/cars/misc/chs2lba.html

As for why HxD cannot see your HDD, I can't answer that question. Suffice to say that DMDE can see it, so just go ahead and use DMDE and forget about HxD.

FYI, inside your My Book is a USB-SATA bridge board. The firmware on this board tells your OS that your My Book actually consists of two devices, a 999.5 GB HDD plus an 0.6GB CDROM (VCD). Of course this is not really true, but that's what the OS sees. For some reason HxD can see the VCD but not the HDD.

When you remove the HDD from the enclosure and connect it to a SATA port on your computer's motherboard, the entire HDD is then visible as a single 1000.1 GB device. Your user area (999.5 GB) is encrypted, whereas the VCD area at the end of the drive is not.

[BlueMooneke]

@labtech: I know it isn't an easy task to help somebody with a HDD problem remotely. But I didn't understand what they asked me to do, so I ask again and they say I'm not capable of (which might be) instead of explaining it again, you see?

@fzabkar: Thanks again for answering my thread. I ordered a new 2TB hard disk today to clone my drive. (just for safety). I know you're doing all you can to help people out on this forum, I really appreciate everything you already did, I really do.

But as I stated before, I want to learn from this "accident".

So, if I understood correctly, sector 0 is not correct. To reconstruct it, you used sector 2048: the boot sector of the second partition (size of 999.5GB). So you want to add the location of this boot sector to the partition table at sector 0. Is this correct?

To do so, you used that CHS/LBA conversion utility (this is a part I don't understand but I will do some research).

Just tell me if I'm thinking in the right direction!

Again, much appreciation for helping me out

BlueMooneke

[loki]

Just for info:

DTI did a tutorial that might be worth you looking at:
http://www.dtidata.com/resourcecenter/2 ... ion-drive/

Here is a winhex MBR template of my My Book Essential 1Tb

MBR - Winhex.png (12.52 KiB) Viewed 16045 times

Here is sector 0 (unzip & then use winhex to view)

Sector 0.zip

(498 Bytes) Downloaded 779 times

Loki

[fzabkar]

@BlueMooneke, since you intend to clone your drive, your solution may now be a little easier. My original approach involved manually editing sector 0 so that we could easily undo any changes. That's why I initially objected to your suggestion to "insert the partition (undelete)". Ironically I did so because, like you, I was reticent to allow DMDE to make automatic changes to your data.

Now that you will have a clone, I would suggest that you manually fill sector 0 with zeros, write "55 AA" to the last two bytes, and then allow DMDE to "insert the partition (undelete)". Hopefully this will be all that you will need to do.

As for how one uses the boot sector to reconstruct the partition table, I suggest you read this page:

An Examination of the NTFS Volume Boot Record Of MS Win2K and Windows XP:
http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm

Your boot record has the following information:

File System - NTFS
Sector Size (in bytes) - 0x0200 (= 512)
Sectors per Track - 0x003F (= 63)
Number of Heads - 0x00FF (= 255)
Number of "Hidden Sectors" - 0x00000800 (= 2048)
Total Sectors - 0x745B6FFF

This is telling us that the partition begins at sector 2048 and that it has a size of 0x745B7000 (= 0x745B6FFF + 1).

The partition ID byte for an NTFS volume is 0x07.

List of partition identifiers for PCs:
http://www.win.tue.nl/~aeb/partitions/p ... pes-1.html

The following resource explains the meaning of each byte in the partition table. It also explains how to encode/decode the starting and ending CHS values.

MBR/EBR Partition Tables:
http://thestarman.pcministry.com/asm/mbr/PartTables.htm

[BlueMooneke]

@fzabkar, this is exactly what I meant! A great answer!

Can't really clone my drive right now, I ordered it yesterday, so I hope it's here quite soon.
But the explanation is really helpful. All the websites you mentioned perfectly describe what I was looking for!
I'll read through them all and by the time I got my new HDD, I hope I'm able to actually "talk" with you guys about it or even figure it out by myself!

Whatever the result will be, I'll always post it up here. After the clone, I'll firstly try the undelete option in the menu and report back what the result is.

Thanks again, really thanks!

Hope to talk to you soon!

BlueMooneke

[northwind]

DTI did a tutorial that might be worth you looking at:
http://www.dtidata.com/resourcecenter/2 ... ion-drive/

Sorry for being a little out of topic here, but I followed this link, and this link lead to another and .... are they for real?
http://www.dtidata.com/resourcecenter/2 ... ar-82-3gb/

They wrote an entire blog post demonstrating that they dont even know the IBM/Hitachi model pattern?

[BlackST]

DTI did a tutorial that might be worth you looking at:
http://www.dtidata.com/resourcecenter/2 ... ion-drive/

Sorry for being a little out of topic here, but I followed this link, and this link lead to another and .... are they for real?
http://www.dtidata.com/resourcecenter/2 ... ar-82-3gb/

They wrote an entire blog post demonstrating that they dont even know the IBM/Hitachi model pattern?

I ruined a lot of DR guys days when demostrating that if you really want, even when NOTHING matched, I got the data back. The difference on some tools is in the.... "handle".

O tempora, o mores....

[northwind]

That guy that wrote this blog post, I doubt that he has ever worked with IBM / Hitachi in his life.

[BlueMooneke]

Update:

I raw copied my entire disk to another one.
I just want to make sure I did everything correctly...

Commands in Ubuntu Destkop:
sudo dd if=/dev/sdc (size was around 1 TB, like 930GB) of=/dev/sdb (size was 1.8TB = new drive)

It copied whole night long
Could this be right?

BlueMooneke

[dobrevjetser]

yep, it sure can take that long.

Dobre

[BlueMooneke]

But the command is right?

I'll check the content when O get back home.
Btw: should I use the dmde option 'undelete' on the duplicate, or the original?

BlueMooneke