Always work with the clone.

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners

Try all operations on the Clone/duplicate copy.
(including running recovery softwares like R-studio)

Update2:

I connected the clone to my computer (windows) and ran DMDE on it. I did this without the encryption board.
DMDE told me he found a 2TB disk, I checked sector 0 and found an unencrypted sector ending with 55 AA. This is totally correct.
Rest of the HDD was encrypted

Now, wanted to try the DMDE option: undelete, but this only works (ofcourse) when the encryption board is in place.
So, took the clone HDD, mounted the encryption board and connected it with windows.
Windows did recognize a VCD (Yej!) but is unable to read it... (no permission)
Ran DMDE again, found 1 VCD (700MB) and 1.8TB HDD
Selected the HDD but then got a message that sector 0 has no write permissions. Clicked "Ignore", same for sector 2,....
Selected "Ignore all" and went to sector 2048. Everything was 00. When clicking that sector, again the message: No write permission.

This looks not really good. Luckily, it's just the clone drive!
What did happen to me:
I do not get write permission, nor read. Because I can read the drive without encryption board.
The VCD is not working properly, so the device isn't configured right (drivers?)

Looks like I got 2 options left:
1) Try to get the VCD working and hope that this will fix the "No permission" problem
2) Format the clone drive, raw copy my original drive again but now, as an Image and try to fix the problem on the original drive. If this fails, I just recopy the .img file to the original drive again. (not as an image ofcourse)

Hope to get some extra information on this!

Already thanks in advance,

BlueMooneke

Compare the first dozen or so sectors between the two drives when they are outside the enclosure. Then compare the last sector of the source drive against the same sector on the clone. This should tell you whether the cloning process was correct.

If all is OK, then the problem could be that the bridge firmware is looking for a special decryption sector in the wrong place on the drive. I have seen one other post that described a similar problem. In that case the solution was to reduce the reported capacity of the clone to match the capacity of the original drive. To this end you could use a tool such as HDAT2 or MHDD. The reported capacity (ie the total number of 512-byte sectors) should be what is reported outside the enclosure, not inside. The reported capacity inside the enclosure will be reduced by the size of the VCD.

_________________
A backup a day keeps DR away.

Alright, this is what I did:

I did not check whether the clone was successful. I borrowed a 1 TB HDD from a friend of mine (no WD, but Hitachi) and retried the whole process.
Same as before, it recognizes a VCD, but the disk is inaccessible due to corruption. Still unable to read the HDD with encryption board because of no permission.

But after all, it's strange it only detects like 930GB to copy...? Where did the other ~90GB went to?

Next thing I'm doing:
Copying the partition with the DATA (thus the original HDD with encryption board) via USB to a 2TB HDD. I could then use the "undelete partition" option in DMDE because it's the unencrypted data, so the actual readable data by the OS. Fact is that it will take a lot longer to copy it over USB...

Will report back when it's done.

Thanks again in advance,

BlueMooneke.

PS: When I checked the 2nd 1TB HDD (from friend), GPartition in Ubuntu told me they where the same size. (original HDD and the Hitachi HDD) But when raw copying the data via sata (so without encryption board), at the end the dd command gave me an "error": device has no free space left. But it passed it and copied the whole 930GB.

Drive displays a smaller capacity than the indicated size on the drive label:
http://wdc.custhelp.com/app/answers/detail/a_id/615

Difference between Gibibyte and Gigabyte:
http://en.wikipedia.org/wiki/Gibibyte
http://en.wikipedia.org/wiki/Gigabyte

_________________
A backup a day keeps DR away.

Last update:

copied everything via usb with encryption board to another HDD, connected it with windows and ran DMDE.
As before, it recognized a NTFS partition "My book". Nulled the sector 0 and added 55 AA to the end of this sector. Reconnected the HDD
Now, when he found the NTFS "My book", I right-clicked it and chose the option: Undelete.
Applied the changes and reconnected the HDD. Windows recognized the HDD and no data is damaged!

Next thing I did, took another fully empty HDD (2 TB) and connected the encryption board to it. Connecting this to my windows gave me the same results as when I raw copied my data on the disk. It found a VCD but this one is inaccessible due corruption and DMDE cannot read/write to it.

After all, I got my data back! Thanks to this community!

Still want to know how the encryption board works...


Thanks!

BlueMooneke

On the USB bridge board is a chip that is near the USB port. This encryption chip will be either a Symwave, Initio or JM chip. Putting it very basically your data that you want to write to the hdd goes through the USB port to the encryption chip that encrypts it on the fly & then this encrypted data gets written to the platters. When you want to read the encrypted data is read from the platters & passes through the encryption chip that then decrypts it & then is presented to you as readable data.

Loki

job well done