How to recover data?

[John1]

Hard disk WD10EZRX-00A8LB0 stopped working. BIOS can see the hardisk , also Device manager in Windows but the Device manager says that the hardisk is not initialized and as a result the harddisk is not available in File Explorer.
There should be files on hardsk but now they are not accessible. How to recover files from that harddisk?
Thank you for advice and help

[fzabkar]

Are you able to retrieve a SMART report?

https://www.reddit.com/r/datarecoverysoftware/wiki/index/smart/

[John1]

Thank you for your reply.
Yes, I can retrieve a SMART report - see the attachment.
But it says the size 33 MB only. Why?
(The disk WD10EZRX-00A8LB0 is the second one from the list in the report.)

CrystalDiskInfo_20241101130905.txt

(14.69 KiB) Downloaded 430 times

Attachments

[fzabkar]

GigaByte BIOS bug results in loss of 1TB capacity:

https://www.hddoracle.com/viewtopic.php?f=59&t=150

[John1]

Thank you for your advice.
Now the hard drive reports the proper size.

But the Device manager still reports the hardisk is not initialized and as a result the harddisk is not available in File Explorer.

Is there a solution for data rescue?

Thank you for help

[fzabkar]

Can you show us the Partitions tab in DMDE?

https://dmde.com/

Did this drive come out of a My Book enclosure?

[John1]

Please find enclosed the Partition tab.

Is there any chance to rescue the files?

[fzabkar]

Your drive appears to be encrypted.

Did this drive come out of a My Book enclosure?

Well, you didn't answer my question, but it does appear that the drive was from a My Book.

Be aware that its capacity has now been reduced by 2113 sectors (= 1953525168 - 1953523055). This is Gigabyte's BIOS at work. If you now return the drive to its enclosure, the USB-SATA bridge firmware won't be able to decrypt the data because the encryption key is stored at the end of the drive, and the bridge will be looking for it at the wrong location. You need to restore the full capacity of the drive and hope that the BIOS has not overwritten the key.

[John1]

Thank you for your reply.
Yes, the customer said the hard drive was taken away from an eclosure, but she brought the drive only.
Is that enclosure necessary for files rescue?


Can you please explain where did you find out 1953525168
in this calculation

2113 sectors (= 1953525168 - 1953523055)

And if understand properly the data seems to be still there. Is it so?

[fzabkar]

1953525168 sectors is the IDEMA standard capacity for a 1TB storage device.

97696368 + (1953504 x (capacity in GB – 50)) = 97696368 + (1953504 x (1000 – 50)) = 1953525168

Yes, the data is still present, but it has been encrypted by the firmware in the My Book enclosure using a key at the end of the drive. The bridge firmware hides this key from the OS by reserving a hidden area of 65K sectors. Hopefully your motherboard's BIOS has not damaged the important metadata in this area.

Ideally, you should use the original enclosure to decrypt the data. Failing that, there are freeware decryption tools such as "reallymine".

[John1]

Thank you for the explanation.
Please find enclosed pictures of my harddrive.
Picture Before.jpg is is before I used S command from Hdat2 program.
After.jpg is after that S command was used.

So, if I understand correctly, HPA must be removed and the files should be renewed.
Is is so?
Does it mean , HPA is still present, because the Diskeditor reports smaller size of the harddrive?


Thank you for reply

[fzabkar]

Maybe your BIOS is reverting the drive? Can you disable Express Recovery in your BIOS setup?

[John1]

I did not find any option likeExpress Recovery in my BIOS setup.
It maybe in different words, because when I save changes to BIOS and PC restarts, there are commands at the bottom of the screen including option
F9: XPressRecovery2

All that I need to do is to remove HPA and the data should be available again. Is it so?
Thank you again for help

[labtech]

I did not find any option likeExpress Recovery in my BIOS setup.
It maybe in different words, because when I save changes to BIOS and PC restarts, there are commands at the bottom of the screen including option
F9: XPressRecovery2

All that I need to do is to remove HPA and the data should be available again. Is it so?
Thank you again for help

Once full LBA is restored on the drive, then you need to decrypt the data by:
-Getting the native controller board from the USB enclosure the drive came out of (use the correct power adapter for it!!!) from the customer, or
-Getting a compatible controller board from somewhere else (Amazon, Ebay, friends, etc) OR buy another compatible drive you can disassemble and source the controller board, or
-Try your luck with ReallyMine, or
-Send the drive to a data recovery specialist that has PC3000 (plenty of companies in Europe you can partner with)

[fzabkar]

All that I need to do is to remove HPA and the data should be available again. Is it so?

Yes, but only if you reinstall the drive in its My Book enclosure.

Otherwise, there is reallymine:

https://github.com/andlabs/reallymine

... or this:

https://github.com/themaddoctor/linux-mybook-tools

[Swiftdata]

Depending on the bridge I believe UFS explorer is also able to decrypt some of these outside of the enclosure

[Hardcore Games]

Disks yanked from MyBook need to be formatted before being useful

MyBook disks are also substandard in my experience as they cannot handle 24 hour a day operation