WD decrypt sectors after reading

[livetheenergy]

Hello gurus,
in your opinion is possible to decrypt read sectors after reading?
Specifically, i have read one bad WD drive and after data-extraction process none of the files works good, so after checking better, i have discovered that this damn drive is encrypted.
Strange thing in this case because without decryption i could read the MFT correctly, therefore i haven't thinked that the drive was crypted.

Thanks in advance for any help.

[labtech]

If can read files in the MFT, then most likely there is no full disk or volume level encryption. If anything, maybe file based encryption.

[livetheenergy]

I think the same, in general cases if i have some encryption on a drive i can use the decryption option from dataextractor, but without dataextractor how can i decrypt an encrypted drive?
Currently i'm working on a dd of the encrypted drive and not on the damaged media, i'm struggling on how to decrypt it.
Any ideas?

[lcoughey]

I haven't played with it, but ReallyMine might work.

Https:github.com/andlabs/reallymine

If anyone tries it, be sure to report back your findings.

[LarrySabo]

If it's file encryption (MFT is not encrypted), ask the customer what they used to encrypt the files.

[labtech]

We don't have any sort of understanding of how the the drive is encrypted to be able to say how to decrypt.

Need more.details about the drive and config circumstances.

[fzabkar]

I haven't played with it, but ReallyMine might work.

Https:github.com/andlabs/reallymine

If anyone tries it, be sure to report back your findings.

"jordash" reports success:

reallymine: WD MyBook/MyPassport decryption :
http://www.hddoracle.com/viewtopic.php? ... 488&p=7870

[data-medics]

It could also be that the customer initialized the drive after removing it from a WD My Book enclosure. I've seen that plenty of times.

If it is the WD built in encryption, DE can process the sectors after the fact just fine. You just need to create a submap of the green sectors and then run the option to process decryption on the submap. I've had to do it a couple times myself.