Strange First 63 Sectors...

[ddrecovery]

I have a WD20EARS from a MY Book Studio (I don't have the enclosure). The drive had head failure and have completed a head swap. Sector 0 looks like its encrypted and does not appear to have a boot record or partition table. This type of data runs through the first 64 sectors, then sectors return '00 00' for a while so I presume the drive itself is not encrypted. Looking around the drive I cannot see any readable English in Hex, but the drive is full of films so that's not surprising. I don't want to go poking around too much after the head swap and stress the drive. Also Mod 25 does not contain encryption keys and encryption cannot be detected by PC3000 so its not WD encryption. Any ideas what these 64 sectors are?

Attachments

Data.zip

(529 Bytes) Downloaded 431 times

[Green Slime]

I believe MyBook Studio is encrypted with a ROM chip on the usb bridge, if this chip fails or is lost the encryption key is gone forever.

[fzabkar]

For a discussion and photos of the original PCB, see ...
viewtopic.php?f=1&t=26831

The original PCB would probably have had an OXUF943SE controller (Oxford Semiconductor). This bridge supports encryption. Are you sure that the standard procedures for JMicron and Initio bridges also apply to the Oxford bridge? Have you examined module 38?

[thatdellguy]

Do you have the latest PC3K version? The last version had some issues with detecting decryption on some drives.

[ddrecovery]

The original PCB would probably have had an OXUF943SE controller (Oxford Semiconductor). This bridge supports encryption. Are you sure that the standard procedures for JMicron and Initio bridges also apply to the Oxford bridge? Have you examined module 38?

Unfortunately the client no longer has the bridge board so I cannot check. I have attached Mod 38, which like the other encryption mods does not look right which made me think its not encrypted. Also why does the drive change from what looks like encryption on the first 64 sectors to standard 00 00 in hex??

Do you have the latest PC3K version? The last version had some issues with detecting decryption on some drives.

Unfortunately no I don't. I have DE 5.8 with PC3000 UDMA. Support expired a few months ago and I am about to take advantage of Ace labs upgrade offer to Express which I need to do before the end of the year. Just holding off spending the money as long as I can

Thanks for the support guys.

Attachments

Mod 38.zip

(353 Bytes) Downloaded 449 times

[fzabkar]

Also why does the drive change from what looks like encryption on the first 64 sectors to standard 00 00 in hex??

It probably reflects the manufacturing process. The bare drive would have been zeroed outside the enclosure, and then formatted whilst inside the enclosure. Those zero sectors would not have been touched by the formatting/partitioning process.

[ddrecovery]

That makes sense. Thanks.

[Green Slime]

PC3000 can't find the encryption key because it's not in module 25 or 38, it's in the ROM on the usb bridge pcb. So unless they can find that I think the data is gone. You can also check the back sectors of the drive for a key just in case but I don't think you'll find one.

[thatdellguy]

Data is not gone, you just need the latest PC3K version.

[Green Slime]

The latest version does SED drives, but I don't think it can decrypt MyBook Studio....

[Green Slime]

Note that i'm assuming the data was put on the drive while still in it's enclosure, though why did the client not keep it? If it was taken out and formatted afterwards for use then it's a different story.

If not the only possible way to decrypt is brute force or find a copy of the DEK (Digital Encryption Key). Most WD will store it in a few different places, as we already know. But unfortunately with MyBook Studio the only copy is stored on the PCB.

[ddrecovery]

Thanks for the input guys. Much appreciated.