Recover From My Book Duo

[maxisvk]

I have a WD My Book Duo WDBLWE0080JCH with 2 x 4TB Red Drive. It's original configured in RAID1 but for a mistake i force reconfigure it (again to RAID1) from WD Utility. After 20 second configuration complete but data partition is empty. Ok, i try with R-studio like other disk after formatting but absolute nothing is found. Check with hex editor seem that is all garbage on it except first some and end sector, take apart disk garbage is identical on both disk. Is encrypted but with different key? I try to put 2 new blank disk inside MyBook and load some sample data, every time i reconfigure raid and write sample data again is written different, is possible that encryption key change every time ? there is no unique key stored in firmware ? there is any chance to recover original data or is all lost?
Thanks

[data-medics]

I'm pretty sure R-Studio will be able to handle this case, but you can't have it still connected in a RAID 1 throught the unit when you recover it. You'll need to individually connect the drives to the computer so R-Studio can access each drive independantly, then you'll need to determine the correct RAID parameters manually to recover the data.

For a pro, this usually will take about 10-20 minutes. Doing it the first time, may take a few hours to figure it out.

[maxisvk]

I try with rstudio but if data is encoded before write to disk is already possibile? With disk direct to data port with rstudio hex seems all random data...

[Roberto]

Can you please show us sector 0 and sector 1?

[maxisvk]

sure, this is sector 0 and sector 1 plus sector 20480 the first seem contains data

Attachments

Hdd 1 Sector 20480

Hdd 1 Sector 1

Hdd 1 Sector 0

Hdd 0 Sector 20480

Hdd 0 Sector 1

Hdd 0 Sector 0

[DR-Kiev]

Once you reconfigured hash changed , and it is now encrypted different way. There is a chance if you saved SA from one of two drives before doing reconfiguration. Did you?

[maxisvk]

no, not save. from actual data on disk there is no way right, maybe also to prefessional service ?

[Roberto]

no, not save. from actual data on disk there is no way right, maybe also to prefessional service ?

If you're lucky there could be a way from actual data only.

Can you please search for the following signatures (in Hex Format) at the end of the drives:
First: 57 44 76 31
Second: 53 59 4D 57
3rd: 53 49 6E 45
4th: 57 44 01 14

[maxisvk]

not found this string, at end of disk i found wd unlock partition

Attachments

[Roberto]

not found this string, at end of disk i found wd unlock partition

The HEX-String must be there somewhere (in my opinion) but maybe I'm wrong.
I see that 4 TB are a large space for searching... but the signatures should be there.
Did you search them as a hex values?

If you cannot find them... you could try to save all modules with hddsupertool.

[Roberto]

Can you please show us the label of the HDDs?

[data-medics]

Wow, most the duo models I've seen didn't actually have the encryption enabled. I guess the newer ones are actually using it.

[Roberto]

not found this string, at end of disk i found wd unlock partition

You need a HEX-Editor... the sector view should look similar to the pictures of sector 0 and 1 you have uploaded.
Not like the picture of R-Studio you have shown.
Then you have to go nearly to the end of the drive (>90%) and search for the mentioned hex values.

Maybe someone here knows the exact locations of the key sector on a 4 TB model.
So you would not have to search for the signatures, you could jump to the correct sector straight forward.

You only need to show the correct sector, like you showed sector 0 and sector 1.
But this time the sector number is much higher than 0 or 1, it should be 7730941132 or higher.

I hope I have explained it simple and understandable

[fzabkar]

Why not begin at sector 7813974016 and save all the sectors from this point until the end of the drive? Then upload the BIN file as a ZIP. Hopefully the BIN will contain the key sector, if it exists.

[maxisvk]

Why not begin at sector 7813974016 and save all the sectors from this point until the end of the drive? Then upload the BIN file as a ZIP. Hopefully the BIN will contain the key sector, if it exists.

attached, also i search again HEX string from 90%, before i try only on last 1%

Attachments

Region 0 on WDC WD40EFRX-68WT0N0 82.7z

(2.47 MiB) Downloaded 516 times

[data-medics]

That looks to me like it's just the SmartWare partition. Is the drive direct SATA connected?

[maxisvk]

Is the drive direct SATA connected?

Yes

[fzabkar]

If you clone the first 10GB, say, of your patient drives to your new drives, and then install the new drives in your Duo, do you see the same data patterns via USB? If so, then this would suggest that the Duo may not be looking for a key sector on your drive(s), and that this key may be stored elsewhere.

[maxisvk]

If you clone the first 10GB, say, of your patient drives to your new drives, and then install the new drives in your Duo, do you see the same data patterns via USB? If so, then this would suggest that the Duo may not be looking for a key sector on your drive(s), and that this key may be stored elsewhere.

ok,
1) take disk out from mybook duo
2) clone first 10gb of disk1 to a new one
3) put disk1 on mybook duo and check data pattern (hex with rstudio) on random sector about at 1gb, 2gb, 3gb from start
4) put new cloned disk on mybook duo and check data pattern (hex with rstudio) on random sector about at 1gb, 2gb, 3gb from start
-> data pattern is completly different

[Roberto]

Can you please show us the label of the HDDs from my book duo?