| HDD GURU FORUMS http://forum.hddguru.com/ |
|
| WD decrypt sectors after reading http://forum.hddguru.com/viewtopic.php?f=11&t=33748 |
Page 1 of 1 |
| Author: | livetheenergy [ July 8th, 2016, 10:33 ] |
| Post subject: | WD decrypt sectors after reading |
Hello gurus, in your opinion is possible to decrypt read sectors after reading? Specifically, i have read one bad WD drive and after data-extraction process none of the files works good, so after checking better, i have discovered that this damn drive is encrypted. Strange thing in this case because without decryption i could read the MFT correctly, therefore i haven't thinked that the drive was crypted. Thanks in advance for any help. |
|
| Author: | labtech [ July 8th, 2016, 12:00 ] |
| Post subject: | Re: WD decrypt sectors after reading |
If can read files in the MFT, then most likely there is no full disk or volume level encryption. If anything, maybe file based encryption. |
|
| Author: | livetheenergy [ July 12th, 2016, 10:19 ] |
| Post subject: | Re: WD decrypt sectors after reading |
I think the same, in general cases if i have some encryption on a drive i can use the decryption option from dataextractor, but without dataextractor how can i decrypt an encrypted drive? Currently i'm working on a dd of the encrypted drive and not on the damaged media, i'm struggling on how to decrypt it. Any ideas? |
|
| Author: | lcoughey [ July 12th, 2016, 11:37 ] |
| Post subject: | Re: WD decrypt sectors after reading |
I haven't played with it, but ReallyMine might work. Https:github.com/andlabs/reallymine If anyone tries it, be sure to report back your findings. |
|
| Author: | LarrySabo [ July 12th, 2016, 12:06 ] |
| Post subject: | Re: WD decrypt sectors after reading |
If it's file encryption (MFT is not encrypted), ask the customer what they used to encrypt the files. |
|
| Author: | labtech [ July 12th, 2016, 15:45 ] |
| Post subject: | Re: WD decrypt sectors after reading |
We don't have any sort of understanding of how the the drive is encrypted to be able to say how to decrypt. Need more.details about the drive and config circumstances. |
|
| Author: | fzabkar [ July 12th, 2016, 20:52 ] |
| Post subject: | Re: WD decrypt sectors after reading |
lcoughey wrote: I haven't played with it, but ReallyMine might work. Https:github.com/andlabs/reallymine If anyone tries it, be sure to report back your findings. "jordash" reports success: reallymine: WD MyBook/MyPassport decryption : http://www.hddoracle.com/viewtopic.php? ... 488&p=7870 |
|
| Author: | data-medics [ July 13th, 2016, 13:32 ] |
| Post subject: | Re: WD decrypt sectors after reading |
It could also be that the customer initialized the drive after removing it from a WD My Book enclosure. I've seen that plenty of times. If it is the WD built in encryption, DE can process the sectors after the fact just fine. You just need to create a submap of the green sectors and then run the option to process decryption on the submap. I've had to do it a couple times myself. |
|
| Page 1 of 1 | All times are UTC - 5 hours [ DST ] |
| Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group http://www.phpbb.com/ |
|