WD My Book Decryption

This is an article I have been meaning to do for some time and discusses the odd occurrence where if the first sector a WD MyBook external hard drive fails the decryption does not engage and the drive becomes unreadable. While there are off the shelf tools to perform decryption I will be using open source software to solve this problem. I don’t want to get into a discussion about which tools I have used but for those that are interested see the following link.

Most WD 3.5 inch MYBOOK essentials have their data encrypted to provide security should your drive go missing. This can create issues when data recovery is necessary.

After we disassemble the enclosure we are left with the hard drive below left and the usb – sata PCB BRIDGE, see below right.

Highlighted on the USB-SATA bridge is a chip the sole purpose of which is to scramble/encrypt the data written to the hard drive. So if we were to plug in the drive to a computer without the bridge the drive would appear as empty and devoid of data. The first sector on any hard drive contains information about the number of partitions on that drive and their location. Should this sector fail then the decryption fails to engage and the drive remains encrypted but unreadable.

For the purposes of this article I will be using a more modern WD MY Passport portable see picture below left. The drive’s electronics , see middle picture below, has the encryption chip soldered to the printed circuit board and I have replaced this PCB with equivalent electronics with a sata interface and no encryption. This then for the purposes of our discussion is an exact analog of the WD MY Book.

Before we get further in I need to acknowledge the author of the document contained in this link

Now to decrypt the drive we need to obtain the disk encryption key or DEK and this located at a specific sector on the hard drive and this location changes depending on the type of encryption chip.

JMicron JMS538S chip

500 GB 976769056

750 GB 1465143328

1 TB 1953519648

1.5 TB 2930272288 *

2 TB 3907024928

3 TB 5860528160

4 TB 7814031392

Symwave SW6316 chip

500 GB 976770435

750 GB 1465144707

1 TB 1953521027

1.5 TB 2930273667 *

2 TB 3907026307

3 TB 5860529539

4 TB 7814032771 *

If all of this is starting to look complicated then would be right but this is where another free tools saves the day.

REALLYMINE is a program that decrypts the encrypted WD hard drives. It will in fact decrypt the whole drive automatically however it is slow and will fall over when it tries to read bad sectors which makes it unusable with drives that have bad sectors.

It does however have a great tool which not only gives us the DEK it also informs us of the encryption type used.

We can see in the picture it delivers the DEK and the fact the drive as a SYMWAVE encryption chip.

Now that we have the DEK, we can set up the encryption filter. In my example, the drive was at /dev/sdb

So the following filter can implemented in BASH under linux , in the following command I have placed the DEK in the file dek.hex.

cat dek.hex | xxd -p -r | sudo cryptsetup -d – –hash=plain \

–key-size=256 -c aes-ecb create wd /dev/sdb

With our filter in place the drive is automatically decrypted and we can see the results in the picture below. I am using R-STUDIO to read the drive as it handles the NTFS better than Linux. WE could then using RSTUDIO extract the files to another drive or location.

Given we are possibly working with drives with bad sectors it may be you will need to make an image of this drive in which case DDRESCUE is the answer. The cloning of the drive with applied filter will also mean the clone is decrypted.

References

https://github.com/themaddoctor/linux-mybook-tools

https://github.com/andlabs/reallymine

https://www.r-tt.com/

https://www.centos.org/

Some of our Reviews

     Excellent  
     Based on 17 reviews 
    
 
 
   
 
 
        
   Rob Pennefather 
 2023-12-22
 
 
  Lost coverage of my Samsung 3g phone when vodafone chopped the 3g network coverage . Data Recovery Perth with their amazing knowledge and tech skills reconnected my phone to the 4g network saving me from buying or upgrading a new phone ! Highly recommend Data Recovery Perth for all your computer phone and IT issues !!!
  
 
       
   Virginie Chetty 
 2023-11-16
 
 
  Digby completely saved my business by recovering important files from my failed laptop
  
 
       
   Ian Brodie 
 2023-11-16
 
 
  Lost data on a failed hard drive. It seemed to be gone for good but after a weeks work Digby recovered it all. Excellent work. Recommended.
  
 
       
   Rose Reilly 
 2023-07-29
 
 
  Great service from Digby . Very knowledgeable and helpful in fixing my IT issues
  
 
       
   Vaughan 
 2023-07-14
 
 
  I've used Data Recovery Perth to recover some files that I was told by another business were irrecoverable.  I not only had these files fully recovered but was very happy with the cost to perform this.  Speedy recovery and excellent service, definitely recommend.
  
 
       
   plumboss 
 2023-07-12
 
 
  Hi Digby,
I would like to thank you for retrieving files from my hardrive.
The files are very important to my work.
I\'m taking your advise and investing in a new hardrive.
Thank you
John Abrahams
  
 
       
   Bill E 
 2023-07-08
 
 
  Data Recovery Perth recovered some critical data from a failed laptop that I thought was totally lost, great job.
  
 
       
   Nathan Davis 
 2023-06-23
 
 
  I had a old Raid 10 computer that failed and which had photos and videos on it that I didn't want to loose. I searched for data recovery services and all the places I found charged exorbitant prices. Came across Digby and found his price was very reasonable and he got all my data back! So I would say to anyone needing data recovery use Digby's services and not the other places as he gets the job done for a fair price.
  
 
       
   Milan Adrijasevic 
 2023-06-15
 
 
  Recently I had a hard drive die on one of my work computers . Data Recovery Perth got all my data back and had me working in no time.
  
 
       
   Stuart 
 2022-12-10
 
 
  I recently used Digby's data recovery service and was impressed by his intelligence and helpfulness.

He was able to recover data from my network HDD that I thought was lost forever, and did so with a level of expertise and attention to detail that was truly impressive.

I am so grateful for his help, and would highly recommend him to anyone in need of data recovery. Thank you, Digby!