All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 15 posts ] 
Author Message
 Post subject: How to recover data?
PostPosted: October 31st, 2024, 9:46 
Offline

Joined: November 25th, 2022, 15:55
Posts: 43
Location: Europe
Hard disk WD10EZRX-00A8LB0 stopped working. BIOS can see the hardisk , also Device manager in Windows but the Device manager says that the hardisk is not initialized and as a result the harddisk is not available in File Explorer.
There should be files on hardsk but now they are not accessible. How to recover files from that harddisk?
Thank you for advice and help


Top
 Profile  
 
 Post subject: Re: How to recover data?
PostPosted: October 31st, 2024, 20:49 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 16115
Location: Australia
Are you able to retrieve a SMART report?

https://www.reddit.com/r/datarecoverysoftware/wiki/index/smart/

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: How to recover data?
PostPosted: November 1st, 2024, 9:36 
Offline

Joined: November 25th, 2022, 15:55
Posts: 43
Location: Europe
Thank you for your reply.
Yes, I can retrieve a SMART report - see the attachment.
But it says the size 33 MB only. Why?
(The disk WD10EZRX-00A8LB0 is the second one from the list in the report.)

Attachment:
CrystalDiskInfo_20241101130905.txt [14.69 KiB]
Downloaded 43 times


Attachments:
CrystalDiskInfo_20241101130930.jpg
CrystalDiskInfo_20241101130930.jpg [ 103.42 KiB | Viewed 2605 times ]
Top
 Profile  
 
 Post subject: Re: How to recover data?
PostPosted: November 1st, 2024, 18:33 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 16115
Location: Australia
GigaByte BIOS bug results in loss of 1TB capacity:

https://www.hddoracle.com/viewtopic.php?f=59&t=150

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: How to recover data?
PostPosted: November 8th, 2024, 8:38 
Offline

Joined: November 25th, 2022, 15:55
Posts: 43
Location: Europe
Thank you for your advice.
Now the hard drive reports the proper size.

Attachment:
CrystalDiskInfo_20241108123131.jpg
CrystalDiskInfo_20241108123131.jpg [ 102.53 KiB | Viewed 2141 times ]


But the Device manager still reports the hardisk is not initialized and as a result the harddisk is not available in File Explorer.

Is there a solution for data rescue?

Thank you for help


Top
 Profile  
 
 Post subject: Re: How to recover data?
PostPosted: November 8th, 2024, 8:52 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 16115
Location: Australia
Can you show us the Partitions tab in DMDE?

https://dmde.com/

Did this drive come out of a My Book enclosure?

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: How to recover data?
PostPosted: November 11th, 2024, 4:52 
Offline

Joined: November 25th, 2022, 15:55
Posts: 43
Location: Europe
Please find enclosed the Partition tab.

Attachment:
HardriveImage.jpg
HardriveImage.jpg [ 334.64 KiB | Viewed 2005 times ]


Is there any chance to rescue the files?


Top
 Profile  
 
 Post subject: Re: How to recover data?
PostPosted: November 11th, 2024, 5:15 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 16115
Location: Australia
Your drive appears to be encrypted.

fzabkar wrote:
Did this drive come out of a My Book enclosure?

Well, you didn't answer my question, but it does appear that the drive was from a My Book.

Be aware that its capacity has now been reduced by 2113 sectors (= 1953525168 - 1953523055). This is Gigabyte's BIOS at work. If you now return the drive to its enclosure, the USB-SATA bridge firmware won't be able to decrypt the data because the encryption key is stored at the end of the drive, and the bridge will be looking for it at the wrong location. You need to restore the full capacity of the drive and hope that the BIOS has not overwritten the key.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: How to recover data?
PostPosted: November 11th, 2024, 7:52 
Offline

Joined: November 25th, 2022, 15:55
Posts: 43
Location: Europe
Thank you for your reply.
Yes, the customer said the hard drive was taken away from an eclosure, but she brought the drive only.
Is that enclosure necessary for files rescue?


Can you please explain where did you find out 1953525168
in this calculation
Quote:
2113 sectors (= 1953525168 - 1953523055)


And if understand properly the data seems to be still there. Is it so?


Top
 Profile  
 
 Post subject: Re: How to recover data?
PostPosted: November 11th, 2024, 12:21 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 16115
Location: Australia
1953525168 sectors is the IDEMA standard capacity for a 1TB storage device.

    97696368 + (1953504 x (capacity in GB – 50)) = 97696368 + (1953504 x (1000 – 50)) = 1953525168

Yes, the data is still present, but it has been encrypted by the firmware in the My Book enclosure using a key at the end of the drive. The bridge firmware hides this key from the OS by reserving a hidden area of 65K sectors. Hopefully your motherboard's BIOS has not damaged the important metadata in this area.

Ideally, you should use the original enclosure to decrypt the data. Failing that, there are freeware decryption tools such as "reallymine".

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: How to recover data?
PostPosted: November 14th, 2024, 16:53 
Offline

Joined: November 25th, 2022, 15:55
Posts: 43
Location: Europe
Thank you for the explanation.
Please find enclosed pictures of my harddrive.
Picture Before.jpg is is before I used S command from Hdat2 program.
After.jpg is after that S command was used.

So, if I understand correctly, HPA must be removed and the files should be renewed.
Is is so?
Does it mean , HPA is still present, because the Diskeditor reports smaller size of the harddrive?


Thank you for reply

Attachment:
Before.jpg
Before.jpg [ 170.34 KiB | Viewed 1736 times ]


Attachment:
After.jpg
After.jpg [ 250.69 KiB | Viewed 1736 times ]


Top
 Profile  
 
 Post subject: Re: How to recover data?
PostPosted: November 14th, 2024, 17:54 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 16115
Location: Australia
Maybe your BIOS is reverting the drive? Can you disable Express Recovery in your BIOS setup?

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: How to recover data?
PostPosted: November 15th, 2024, 4:47 
Offline

Joined: November 25th, 2022, 15:55
Posts: 43
Location: Europe
I did not find any option likeExpress Recovery in my BIOS setup.
It maybe in different words, because when I save changes to BIOS and PC restarts, there are commands at the bottom of the screen including option
F9: XPressRecovery2

All that I need to do is to remove HPA and the data should be available again. Is it so?
Thank you again for help


Top
 Profile  
 
 Post subject: Re: How to recover data?
PostPosted: November 15th, 2024, 6:14 
Offline

Joined: August 18th, 2010, 17:35
Posts: 3652
Location: Massachusetts, USA
John1 wrote:
I did not find any option likeExpress Recovery in my BIOS setup.
It maybe in different words, because when I save changes to BIOS and PC restarts, there are commands at the bottom of the screen including option
F9: XPressRecovery2

All that I need to do is to remove HPA and the data should be available again. Is it so?
Thank you again for help

Once full LBA is restored on the drive, then you need to decrypt the data by:
-Getting the native controller board from the USB enclosure the drive came out of (use the correct power adapter for it!!!) from the customer, or
-Getting a compatible controller board from somewhere else (Amazon, Ebay, friends, etc) OR buy another compatible drive you can disassemble and source the controller board, or
-Try your luck with ReallyMine, or
-Send the drive to a data recovery specialist that has PC3000 (plenty of companies in Europe you can partner with)

_________________
Hard Disk Drive, SSD, USB Drive and RAID Data Recovery Specialist in Massachusetts


Top
 Profile  
 
 Post subject: Re: How to recover data?
PostPosted: November 15th, 2024, 8:07 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 16115
Location: Australia
John1 wrote:
All that I need to do is to remove HPA and the data should be available again. Is it so?

Yes, but only if you reinstall the drive in its My Book enclosure.

Otherwise, there is reallymine:

https://github.com/andlabs/reallymine

... or this:

https://github.com/themaddoctor/linux-mybook-tools

_________________
A backup a day keeps DR away.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 15 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 2 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group