Hello there,

I've got a faulty 2TB WD that was placed inside one of these nonsense built-in encryption WD MyBook drives. The model is WDC WD20EARX 00PASB0, and I have recovered over 300 GB raw from it (from LBA 0 to LBA 754974720, given that there's a faulty head I didn't use for the copy), but now recovery has become extremely slow it'd take years to recover all data from it. I've imaged all the data I recovered so far in a 500GB drive, hoping that "the" or "one of the" encryption keys was recovered from the faulty drive. The USB controller in the MyBook case does not mount my imaged drive, I'm not sure if due to the lack of the key or due to the fact that it's a 500 GB drive instead a 2 TB one.

Does anybody know which sector is the encryption key located in? I'm afraid I can only read about 10k LBA's before the drive eventually dies.

Thanks!

The sector is located closer to the end of the drive. Exact location depends on encryption chip.

_________________
SAN, NAS, RAID, Server, and HDD Data Recovery.

Thanks, Doomer. We had spent these last two or three hours reading the last 10.000 LBA's, and came across a portion having "WD SmartWare" and "WD Ecryption" strings. Don't know how this specific sector looks like, so I hope it's located somewhere around the portion read. I'll let you know about any success as soon as I image everything to a new 2 TB Toshiba drive - I hope the controller does not check whether it is a WD or not. Do you know about such thing, by the way?

Cheers!

You did a partial clone of a 2TB encrypted WD drive to a 500GB drive and are expecting to recover the data? I don't think that is going to work. You need to clone 2TB to 2TB (or larger with HPA set equal to source). You should clone the drive in reverse for a few million sectors, just to be sure you have what you need to decrypt. Then, connect the clone to the USB bridge to see what you have, which will likely require a full software scan for the files. The more sectors you get, the greater the chances you will recover some files.

That being said, if this is a client's drive, this might be a good time to send the drive to a professional lab before it is too late.

_________________
Luke
Recovery Force Data Recovery

Toshiba 2TB drive is actually a Hitachi drive
JMicron-based USB adapters had problems with Hitachi drives, so if your adapter is JMicron-based you might want to find another WD 2TB drive, you can also try your "Toshiba" drive first, to find out if there are any problems. Generally speaking if the drive works through WD USB adapter for about 10 minutes w/o loosing access- you are good to go

_________________
SAN, NAS, RAID, Server, and HDD Data Recovery.

If the encryption key were in the first sectors, I don't see why shouldn't it work, since it is encrypted in a block basis and, at least for now, all I've got is ~300 GB counting from LBA 0. The drive does not perform a full-read upon startup in order to make it work; it'll just read what is necessary to start decryption. That being said, given the fact that the key is stored at the end of the 2TB, yes, I need a 2 TB drive, with as much data as possible, and specifically, the keys and some bootstrap it may have.

In the mean time, I'll try to read as much LBA's as I can from it.

Cheers

Well,

I can now read the unencrypted data with that Toshiba-labeled Hitachi. Just needed to image the key portion to it.

Thanks!