Need help recovering data from external WD USB 3 disk

[jermy]

reallymine can't help you (I think) its user password protected.

I don't think anymore

It also does not currently handle entering passwords; if your drive is password-protected (and the bridge chip requires a password) but most of the work is already there (in kek.go); I just need to write the code that actually lets you type in a password, and then we'll be fine.

[shahij]

If the issue is not resolved, you may send your HDD to us.

We may help to recover your data.

[Golr]

@Golr, try "reallymine" (freeware).

https://github.com/andlabs/reallymine

If you need help with this tool, the author has a forum in which he is an active member.

I don't understand why your bridge is not decrypting your data, but if it is due to a missing key sector, then you can retrive it, and all the remaining firmware modules, using a HDDSuperTool script.

https://www.sdcomputingservice.com/hddsupertool
http://www.sdcomputingservice.com/hddsu ... ects=0&d=1

If your drive has a "slow responding problem", then apply this script:
http://www.sdcomputingservice.com/hddsu ... ects=0&d=1

There is no need to stop your DIY efforts just yet.

Best of luck.

Thank you for the links. Let me spend some time with the tools and get back to you with the progress status.

Best Regards,
Golr

[Roberto]

If the issue is not resolved, you may send your HDD to us.

We may help to recover your data.

An expensive data recovery is not yet required.

I'm pretty sure the case can be handled without sending the hdd to a dr company.

What would you charge for a data recovery like this one?

[Roberto]

OK... I've now had a deeper look at the Key Sector.

Your key sector is definitely not password protected.
So it looks like you didn't set a password at all.

You have done your work...
Now let's see what I can do for you

I now have everything I need to try to solve your case.
Please give me some time.

[fzabkar]

@Roberto, ISTM that the OP is using the wrong bridge, or the bridge has a problem with its ROM, or perhaps the VCD area is damaged.

[fzabkar]

If the key is used to decrypt sector 1, is the result zeros?

[Golr]

I'm wondering why DMDE identifies the bridge as "JMicron USB to ATA/ATAPI Bridge:1.0:57442D5743" instead of a WD product (57442D5743 = "WD-WC"). Also, I find it strange that the range of sectors (0-3907029167) is the same in USB mode as in SATA mode.

This is an interesting observation I forgot to mention:



and

Could the drive (WD20EARX-32PASB0) be a SED model (I suspect not)???

I am not sure. What other information can I give you to confirm this?

How does UVCView or USBDeview detect the bridge?

http://www.nirsoft.net/utils/usb_devices_view.html
http://download.microsoft.com/download/ ... ew.x64.exe
http://www.users.on.net/~fzabkar/USB_ID ... ew.x86.exe

Should I get this info connecting the PCB separately or with the drive attached?

BR.

[Golr]

OK... I've now had a deeper look at the Key Sector.

Your key sector is definitely not password protected.
So it looks like you didn't set a password at all.

You have done your work...
Now let's see what I can do for you

I now have everything I need to try to solve your case.
Please give me some time.

Thank you

[fzabkar]

reallymine can't help you (I think) its user password protected.

I don't think anymore

It also does not currently handle entering passwords; if your drive is password-protected (and the bridge chip requires a password) but most of the work is already there (in kek.go); I just need to write the code that actually lets you type in a password, and then we'll be fine.

If the drive is password protected, then the OP should be able to confirm this, otherwise he's wasting everyone's time.

I'd also like to see the part number on the bridge IC, plus the result of UVCView or USBDeview. ISTM that the OP is not telling us everything that we need to know.

[jermy]

Sorry its not user password protected (just checked) I was mistaken by the look (with initio)

[Roberto]

@Roberto, ISTM that the OP is using the wrong bridge, or the bridge has a problem with its ROM, or perhaps the VCD area is damaged.

You're right... Something seems wrong with at least one of the components.

I think there is a problem with the ROM.
If you desolder the ROM (the one for encryption) on a workig PCB you also get the same sector size over usb and over sata.

But that's all remote diagnostics
Don't know for sure what's the main problem..
It is also an combined error because the OP was initializing the mbr in sata mode:

2) After connecting it to the desktop directly in a SATA port it still showed the same thing and prompted me to initialize the disk. I didn't know what initialization would do to the disk and on an impulse went on with initializing it as MBR. Seeing it didn't help I stopped there and did not create partition or format the drive. Nothing has been written on the disk since.
Golr

So I guess the usb bridge has at least 2 combined reasons (defective ROM and wrong MBR) to "fall back" into usb-only mode.

[Roberto]

If the drive is password protected, then the OP should be able to confirm this, otherwise he's wasting everyone's time.

He already confirmed that there was no password set.

I never set a password on this drive.

I'd also like to see the part number on the bridge IC, plus the result of UVCView or USBDeview.

I'd also like to see a scan of the PCB and a picture of the hdd label.

[fzabkar]

If the drive is password protected, then the OP should be able to confirm this, otherwise he's wasting everyone's time.

He already confirmed that there was no password set.

I never set a password on this drive.

My sincere apologies to the OP.

[Golr]

How does UVCView or USBDeview detect the bridge?

http://www.nirsoft.net/utils/usb_devices_view.html
http://download.microsoft.com/download/ ... ew.x64.exe
http://www.users.on.net/~fzabkar/USB_ID ... ew.x86.exe

Should I get this info connecting the PCB separately or with the drive attached?

BR.

OK so I have gathered the information both with the drive connected to the PCB and without.

With the drive connected:
http://s000.tinyupload.com/index.php?fi ... 3522823198
http://s000.tinyupload.com/index.php?fi ... 9280357088
http://s000.tinyupload.com/index.php?fi ... 5616213470

Without the drive connected:
http://s000.tinyupload.com/index.php?fi ... 1523021253
http://s000.tinyupload.com/index.php?fi ... 3406735075
http://s000.tinyupload.com/index.php?fi ... 6140963807

Best Regards!

[Golr]

reallymine can't help you (I think) its user password protected.

I don't think anymore

It also does not currently handle entering passwords; if your drive is password-protected (and the bridge chip requires a password) but most of the work is already there (in kek.go); I just need to write the code that actually lets you type in a password, and then we'll be fine.

If the drive is password protected, then the OP should be able to confirm this, otherwise he's wasting everyone's time.

I'd also like to see the part number on the bridge IC, plus the result of UVCView or USBDeview. ISTM that the OP is not telling us everything that we need to know.

Here's the picture of the PCB:
http://s000.tinyupload.com/index.php?fi ... 4512645431
http://s000.tinyupload.com/index.php?fi ... 3744149000
http://s000.tinyupload.com/index.php?fi ... 8650540733

I am trying to provide the information to the best of my ability and as early as I can. But some of my posts/replies are taking a little longer than expected to get approved. I think that's the reason for the delay. Regardless, my sincere apologies.

BR
Golr

[Golr]

If the drive is password protected, then the OP should be able to confirm this, otherwise he's wasting everyone's time.

He already confirmed that there was no password set.

I never set a password on this drive.

My sincere apologies to the OP.

It's no problem at all. As a matter of fact I can't thank you guys enough for going out of your way to help me with this. Much appreciated!

Golr

[Golr]

If the drive is password protected, then the OP should be able to confirm this, otherwise he's wasting everyone's time.

He already confirmed that there was no password set.

I never set a password on this drive.

I'd also like to see the part number on the bridge IC, plus the result of UVCView or USBDeview.

I'd also like to see a scan of the PCB and a picture of the hdd label.

Here's the picture of the drive:
http://s000.tinyupload.com/index.php?fi ... 2619152930
http://s000.tinyupload.com/index.php?fi ... 6708288632

I've uploaded the PCB pictures with another reply a few minutes ago.

Best Regards!

[fzabkar]

Your bridge IC appears to be a JMicron JMS538S which confirms that your bridge PCB does indeed handle the encryption.

When connected on its own, the PCB identifies as a WD My Book 1140. This means that the "ROM" must be valid.

Code:

idVendor:                        0x1058 = Western Digital Technologies, Inc.
idProduct:                       0x1140
bcdDevice:                       0x1016
iManufacturer:                     0x01
     English (United States)  "Western Digital"
iProduct:                          0x02
     English (United States)  "My Book 1140"
iSerialNumber:                     0x05
     English (United States)  "5743415A4148353037363230"

However, when the PCB is attached to your HDD, the USB mass storage device identifies as a JMicron USB to ATA/ATAPI Bridge. Therefore ISTM that there is a problem in the Smartware area at the end of the drive's user area.

Code:

idVendor:                        0x152D = JMicron Technology Corp.
idProduct:                       0x0539
bcdDevice:                       0x0100
iManufacturer:                     0x01
     English (United States)  "JMicron"
iProduct:                          0x02
     English (United States)  "USB to ATA/ATAPI Bridge"
iSerialNumber:                     0x05
     English (United States)  "57442D5743415A4148353037363230"

IIUC, your key sector would suggest that the Smartware area begins at sector 0xE8DF8800, ie LBA 3906963456.

Code:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  57 44 76 31 89 D4 00 00 00 88 DF E8 00 00 00 00  WDv1‰Ô...ˆßè....
                                  ^^^^^^^^^^^

ISTM that your best DIY approach would be reallymine. Perhaps cloning the drive with ddrescue or HDDSuperClone would be advisable. You might also consider applying the mod_02 patch with HDDSuperTool just in case the drive has a "slow responding" problem.

[lcoughey]

ISTM that way too much time has been spent on this project. I can't speak for other labs, but if it is something that is recoverable with DIY methods, it would have taken 1-2 days for a data recovery pro to have fully recovered the data at relatively low price. My lab charges $350 CAD (about $275 USD) for such cases.