reallymine
reallymine copied to clipboard
andlabs
Decryption WD :(
please the result of hexdump -C kb.bin
00000000 57 44 76 31 8f e8 00 00 00 68 6f 74 00 00 00 00 |WDv1.....hot....| 00000010 00 00 00 00 00 00 f0 00 00 00 00 00 00 00 00 00 |................| 00000020 01 00 00 00 00 00 46 50 00 00 00 00 00 00 00 00 |......FP........| 00000030 00 02 ff 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000050 20 00 99 18 00 00 00 02 00 00 00 00 57 44 76 31 | ...........WDv1| 00000060 b0 a9 ac 07 7b 67 23 3b 44 07 8c 83 93 a1 37 7e |....{g#;D.....7~| 00000070 01 7f bb c6 4f 72 5d 97 6d ec 13 2d 3c e8 69 bc |....Or].m..-<.i.| 00000080 ff 39 47 cc 55 69 3d a8 c8 9d 4f 70 be 85 05 04 |.9G.Ui=...Op....| 00000090 e9 10 bb 5b 51 ab e0 ee ed 62 bd 45 a2 f8 2b 70 |...[Q....b.E..+p| 000000a0 ad 0d 35 9b 73 fb f0 6b 3b 7b 79 cd 0f 5d 4e 49 |..5.s..k;{y..]NI| 000000b0 ca 50 18 3b bc 70 3f 2c c9 ea 6e 4e 2b 75 bb 3a |.P.;.p?,..nN+u.:| 000000c0 9d a3 a3 44 bf fe 3a 28 94 ed ff 23 f9 38 31 be |...D..:(...#.81.| 000000d0 35 59 c4 da bd fc 13 24 a3 b9 58 fe 72 17 77 05 |5Y.....$..X.r.w.| 000000e0 50 16 00 24 8d 8d 7d 1f 51 ff 3a c1 b6 6f a7 4b |P..$..}.Q.:..o.K| 000000f0 0d 00 6f 4e 3c 78 24 16 fc b7 b4 6f 8b 6a e4 bd |..oN<x$....o.j..| 00000100 bd e7 7e 16 22 9e 4f df 9e 57 e7 12 70 52 4e 19 |..~.".O..W..pRN.| 00000110 19 16 b9 92 7b a8 4b e9 e8 5c 4f 03 9c 04 6d a1 |....{.K..\O...m.| 00000120 1a ba 38 5c 05 05 d6 a7 11 02 e0 b6 61 a6 c8 e1 |..8........a...| 00000130 81 9a 61 03 bd 3a 8c 78 c9 84 f2 84 a1 8c e9 a5 |..a..:.x........| 00000140 f5 e6 db 12 40 5f b7 33 56 5b 5c 21 d9 bf ec 31 |....@_.3V[!...1| 00000150 2e fd 23 33 05 54 1e ee 77 ad 8e 6a 8e 34 82 0c |..#3.T..w..j.4..| 00000160 79 bc bc 3a a4 49 f9 31 6f e8 0a 45 64 43 3c 25 |y..:.I.1o..EdC<%| 00000170 e2 45 90 ad 7e 8d 16 80 18 3b 8c 99 11 36 4a b8 |.E..~....;...6J.| 00000180 08 80 1f 4e 64 df 97 1c 6e 59 d5 4e 2d db 60 6b |...Nd...nY.N-.`k| 00000190 b7 87 56 84 45 00 da 68 41 93 dd bf f1 9e 7e f7 |..V.E..hA.....~.| 000001a0 3d 36 06 35 3a da f4 15 29 06 21 df 61 c3 7a 45 |=6.5:...).!.a.zE| 000001b0 bf c5 24 b1 72 93 98 2d 50 ab 7b f1 eb 56 15 50 |..$.r..-P.{..V.P| 000001c0 61 1c d4 3e 31 df 62 df 22 cc 2c 10 da fd 4b 6a |a..>1.b.".,...Kj| 000001d0 a3 d8 84 ad 38 94 93 74 3e 33 37 d1 46 75 bd 5c |....8..t>37.Fu.| 000001e0 38 fa 6f bf 3f e5 56 fa 6b 61 15 09 6b a1 5f 70 |8.o.?.V.ka..k._p| 000001f0 a3 8e a1 c0 64 ea 78 33 1e ba 7a 11 40 9b 01 b9 |....d.x3..z.@...| 00000200 does it means the whole disk encrypted ?? i have ordered new pcb with sata matched the requirement to access my data i am also using external enclosure from sata to usb to fit my laptop with ubuntu dist and vmware machine the original pcb 2060-771801-002 the new one 771823
dd if=/dev/sdc bs=512 skip=1953519648 count=1 of=kb.bin This is the command i was using Could you tell me which command can i use to get MBR sector 0
Same, with skip=0
sudo dd if=/dev/sdc bs=512 skip=0 count=1 of=kb.bin
00000000 7b 5c f8 b0 78 dc e2 c6 d8 a5 ca 1f 9d 80 8e 3b |{..x..........;|
00000010 b4 87 46 eb 09 76 cf f1 b3 5f 5f bb 37 5e d2 ab |..F..v...__.7^..|
00000020 d5 b6 cc f2 71 95 67 75 8d d4 62 ed 5f 69 0e 48 |....q.gu..b._i.H|
00000030 da 26 d6 ee 6a d8 1d f7 06 f8 70 19 99 c4 6c 5d |.&..j.....p...l]|
00000040 10 d9 fc e8 46 ae 32 c9 82 bf a2 6f 66 da b5 9e |....F.2....of...|
00000050 fe cd cf ea 64 aa 6f 23 b1 23 65 c1 49 08 9f f5 |....d.o#.#e.I...|
00000060 80 f4 b0 05 c1 69 77 ed 65 8f c1 6e dd 55 1b 50 |.....iw.e..n.U.P|
00000070 2f 77 19 8b 65 c5 cf cc c9 1c 59 7b 78 a5 16 fd |/w..e.....Y{x...|
00000080 4a de f9 82 92 2e e4 db 5d c0 23 b9 d9 a7 ca f7 |J.......].#.....|
00000090 89 ea dd 0c 44 d1 00 22 2d b0 4d 5b d8 d2 3c 3b |....D.."-.M[..<;|
000000a0 80 43 a3 e1 86 04 bd f6 74 2c fe e6 db 7c 78 76 |.C......t,...|xv|
000000b0 2c cb c6 b1 0f 6c b5 37 e8 d1 6b 5c 6d 64 b6 60 |,....l.7..k\md.| 000000c0 85 41 b9 bd 64 6a ab a4 81 14 5c d7 c8 c1 1b 91 |.A..dj....\.....| 000000d0 d9 03 0c e6 bb 10 ff aa 92 a9 d3 43 40 16 d2 9e |...........C@...| 000000e0 35 e4 d9 b2 9a c3 bb 3c 76 b8 70 47 37 40 4b 00 |5......<v.pG7@K.| 000000f0 ea 21 6d a5 1f 89 80 c0 74 12 9b 57 76 10 50 83 |.!m.....t..Wv.P.| 00000100 6f a3 69 50 8a 5b 5b e5 a0 e4 45 a1 10 17 6c df |o.iP.[[...E...l.| 00000110 18 c1 66 40 a8 59 40 6c 95 39 df 1b e7 27 c5 dc |[email protected]@l.9...'..| 00000120 09 32 88 6a 6d a5 d4 61 35 4d 37 d5 14 31 01 50 |.2.jm..a5M7..1.P| 00000130 b9 9c 96 14 ce 5d 65 ba 0b 36 a9 a4 d5 cd 5d 77 |.....]e..6....]w| 00000140 60 58 9f 40 01 2a a8 57 5c 24 d8 65 62 96 32 76 |X.@..W$.eb.2v|
00000150 7c c5 9e 17 65 46 d5 2a 2b c6 19 f7 f1 5f 39 f6 ||...eF.+...._9.|
00000160 3c 8a 7d e0 dd c6 fd 53 5c e9 95 d0 47 b0 27 7c |<.}....S...G.'||
00000170 7e d2 1d 92 b5 a8 bf 49 d7 8b 19 a9 f3 02 72 1e |~......I......r.|
00000180 66 14 94 68 3a e6 33 73 89 0e 5e e8 b7 88 49 d1 |f..h:.3s..^...I.|
*
000001b0 cf b7 84 84 6a cc 98 2e 84 56 bd 58 02 bd 96 5c |....j....V.X...|
000001c0 ef 63 fc 34 03 c4 5b b4 f5 6b 82 ed 3e 0a 2d 3a |.c.4..[..k..>.-:|
000001d0 66 14 94 68 3a e6 33 73 89 0e 5e e8 b7 88 49 d1 |f..h:.3s..^...I.|
*
000001f0 2d 5b cd 3e 68 87 80 45 db 03 4f d3 60 3a fc de |-[.>h..E..O.`:..|
00000200
Yes, that is encrypted. Date of manufacture? It is written on the disk's label.
actually i can't remeber it it was one of my familt members but i have tried them all , without success so after lot of search i got this method "Mouting encrypted WD drives in linux Thomas Kaeding ([email protected])" i don't know if it match my case or no ?!
Yesterday you posted in this thread https://github.com/themaddoctor/linux-mybook-tools/issues/44 that it was encrypted by a former employee who was extorting you for money.
actually i don't know what happened and what crime i have done here i swear it's my own hard disk i didn't steal it from any one is that what you mean ?!!
Send Kaeding proof of ownership and he can send you the key.
Here's your decrypted MBR, by the way:
00000000 33 c0 8e d0 bc 00 7c fb 50 07 50 1f fc be 1b 7c |3.....|.P.P....||
00000010 bf 1b 06 50 57 b9 e5 01 f3 a4 cb bd be 07 b1 04 |...PW...........|
00000020 38 6e 00 7c 09 75 13 83 c5 10 e2 f4 cd 18 8b f5 |8n.|.u..........|
00000030 83 c6 10 49 74 19 38 2c 74 f6 a0 b5 07 b4 07 8b |...It.8,t.......|
00000040 f0 ac 3c 00 74 fc bb 07 00 b4 0e cd 10 eb f2 88 |..<.t...........|
00000050 4e 10 e8 46 00 73 2a fe 46 10 80 7e 04 0b 74 0b |N..F.s*.F..~..t.|
00000060 80 7e 04 0c 74 05 a0 b6 07 75 d2 80 46 02 06 83 |.~..t....u..F...|
00000070 46 08 06 83 56 0a 00 e8 21 00 73 05 a0 b6 07 eb |F...V...!.s.....|
00000080 bc 81 3e fe 7d 55 aa 74 0b 80 7e 10 00 74 c8 a0 |..>.}U.t..~..t..|
00000090 b7 07 eb a9 8b fc 1e 57 8b f5 cb bf 05 00 8a 56 |.......W.......V|
000000a0 00 b4 08 cd 13 72 23 8a c1 24 3f 98 8a de 8a fc |.....r#..$?.....|
000000b0 43 f7 e3 8b d1 86 d6 b1 06 d2 ee 42 f7 e2 39 56 |C..........B..9V|
000000c0 0a 77 23 72 05 39 46 08 73 1c b8 01 02 bb 00 7c |.w#r.9F.s......||
000000d0 8b 4e 02 8b 56 00 cd 13 73 51 4f 74 4e 32 e4 8a |.N..V...sQOtN2..|
000000e0 56 00 cd 13 eb e4 8a 56 00 60 bb aa 55 b4 41 cd |V......V.`..U.A.|
000000f0 13 72 36 81 fb 55 aa 75 30 f6 c1 01 74 2b 61 60 |.r6..U.u0...t+a`|
00000100 6a 00 6a 00 ff 76 0a ff 76 08 6a 00 68 00 7c 6a |j.j..v..v.j.h.|j|
00000110 01 6a 10 b4 42 8b f4 cd 13 61 61 73 0e 4f 74 0b |.j..B....aas.Ot.|
00000120 32 e4 8a 56 00 cd 13 eb d6 61 f9 c3 49 6e 76 61 |2..V.....a..Inva|
00000130 6c 69 64 20 70 61 72 74 69 74 69 6f 6e 20 74 61 |lid partition ta|
00000140 62 6c 65 00 45 72 72 6f 72 20 6c 6f 61 64 69 6e |ble.Error loadin|
00000150 67 20 6f 70 65 72 61 74 69 6e 67 20 73 79 73 74 |g operating syst|
00000160 65 6d 00 4d 69 73 73 69 6e 67 20 6f 70 65 72 61 |em.Missing opera|
00000170 74 69 6e 67 20 73 79 73 74 65 6d 00 00 00 00 00 |ting system.....|
00000180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000001a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000001b0 00 00 00 00 00 2c 44 63 15 3f 02 00 00 00 00 20 |.....,Dc.?..... |
000001c0 21 00 07 fe ff ff 00 08 00 00 00 60 6f 74 00 00 |!..........`ot..|
000001d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000001e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa |..............U.|
Thanks , but i think there's miss understood i don't know what it is i will looking for receipt Here's your decrypted MBR, by the way: does it required in any step to access the data ?
In the meantime, tell me please how you happen to have an encrypted 1TB Passport, just like tarekhallal, and managed to read the raw data after you removed the controller board, if you are not him and are not an IT specialist?
now i got your point looks some one ask for special service from you and didn't pay for it and you are sure that was me with similar case i can send you copy of my passport and can prove i am non it field of providing any service related to computer also can open came to check that pic identical for ID does i am right ? about removing the case of HDD it was mentioned from all post here https://community.wd.com/t/how-to-decrypt-a-wd-mybook-drive-after-its-removed-from-the-enclosure/146588 and also article go HW crypto and alot of posts on github
... and yet, the photo you posted is from a Passport, not a MyBook. Hmm...?