Hi Guys,
I got an external WD Elements 2.5" 500 GB(USB Interface) from a
customer.
He said that suddenly the drive is not recognized.
No one done anything with it, just happened suddenly.
I started to diagnose it:
1. under windows --> Disk Management, disk is recognized by its right
description and size.
2. I scanned it with several DR suites (R-STUDIO, Stellar-Phoneix and
more), and it find nothing - no partition and no files.
3. In R-STUDIO it gave an interesting message says its write protected
- what is that?
was thinking to connect it to hd doctor and maybe try to see if
suddenly the disk has password but it has a usb interface on the pcb.
any thoughts and suggestions would be great,
oded

99% disk is encrypted.

Open drive in winhex and check inside. Do you see scrambled data? If so, disk is encrypted...

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners

That sound logical when you mention it.
In case it is password protected and i get the password from the client, how do i set it up on my PC to be able to decrypt/access it?

Thanks for your help

is its possible that the disk is password protected and not encrypted?
Does it worth soldering the PCB to SATA and examine with HD Doctor?

If you have the password, just install smartware utility and run Unlock.exe. It will ask you for password.

I don't think you should go to the next step, ie. adapt sata board, just yet. First you need to determine what's wrong with the drive.

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners

I spoke with the customer and he advised that no password was set.
I installed Smartware but it can't see the drive.
I tried to open it with few different DR apps and it gives me a message that the drive is write protected.
see attached screenshot from Winhex.

Any thoughts?

Hi,
This WD Elements is using Initio or Symwave chip?

It is an Initio chip mate

Check your PM, hopefully useful

I have the same problem but my chip is Symwave and HD is 2TB. May be you can put the solution and to my PM?

Hi, Are you sure your problem is same as OP ? can I see screenshot with Winhex as post #6 above ?

I make the screenshot but maybe you need the sector 3907026307 as well?
This is link to sector
http://dl.dropbox.com/u/48034438/sect_3907026307_23402
The disk never worked with password and I made 100% image of sectors. The problem is now to decrypt data

I posted the picture but it must be adopted by moderator
Here the link to picture and to the sector 3907026307 with key
The disk copied via SATA 100%, user never set a password
Is it possible to do something?
picture, sector

How exactly did you create the image? Describe the drive interfaces for both source and destination and hardware/software used.

_________________
Hard Disk Drive (HDD), Solid State Drive (SSD, SATA, NVMe, etc), USB Flash Drive and RAID Data Recovery Specialist in Massachusetts

We did the soldering, usb to SATA to the PCB.
Looks good, imaging the drive as we speak, it looks like the drive wasn't using the Initio at all, it is not encrypted.

Thanks for your help

Your problem is more difficult than OP. Your drive is really encrypted by Symwave chip. OP's drive wasn't.

What is the brand and model of your destination/clone drive ?

Very glad to know

I cloned the original disk via SATA to another WD. The original had some problem but it was copied 100% at the end.
We bought two more the same as previous USB3 box and each one can read disk from another. But none can read the first disk and its image as well. And even old box cannot read from new disks (maybe it's broken?). So I have only one method to read data is to find a key and decrypt with some program the sectors I read.

I think you have already found out the solution yourself. Read your own post carefully

Don't waste your time to decrypt the drive using software..........

yes mate, i know the answer, i can already see the file system. just mentioned it for everyone knowledge here, it seems that the Initio is not used in this Elements model.
Thx