Stuck - Decrypt Data from WD MyBook 1TB

[Pruiki]

trafficstars

Hi,

Hope one of you guys can help me, because I am stuck. And I really want my photo's back.

As you can read in the header I have a 1TB MyBook which has become unreadable sinice I thought it was broken. So I removed it from the case and put it directly into my PC via SATa connectors.Immediately I saw something was wrong, because the disk showed up as RAW and had 2 partiitiions (32GB FAT32 and 889.5GB RAW data). I directly used some recovery tools and got some back foto's until 2012, but everything after was gone. After doing some research (google) I found out that the Disk might be encrypted by WD MyBook...

In the mentime I was able to fix my WD MyBook (don't ask..) and put back the Disk into the casiing and it's up and running again, but unfortunately nothing was visible anymore and the partitiion was still RAW. So I deleted the FAT32 partition to see if that fixes everything, but now all is ~931.5gb RAW...

So I continued reading on recovery sites and found an article on EasUS stating I sould make the RAW an NTFS with DISKPART without loosing all my data: CMD DISKPART (select drive) clean create partition primary format fs=ntfs

So stupid me did this... Now the drive was indeed not RAW anymore, but a NTFS drive.

As from now nothing was visible anymore, not even with disc recovery tools. (Stellar, Minitool, EaseUS, Klennet Carver, etc.)

Few days later I stumbled upon linux-mybook-tools and found andlabs/reallymine and was hoping this might fix the problem (if even still possibile)

So I ran ReallyMine on Ubuntu, with the following commands: $ reallymine getdek /dev/sda1 ---- But after a full day of waiting nothing happened and decided to stop...

$ reallymine decrypt /dev/sda1 /dev/sdb1/decrypted.img ---- It started and created the 'decrypted.img' But after 2 days I decided to stop this... Since the file wass still 0 Kb.

Did I not wait long enough? Or is it simply become impossible to recover the data now?

Hope one of you can help me out here and tell me if it is still possible to recover any of my data

[themaddoctor]

The fact that you recovered some photos would mean that it was not encrypted.

The OXUF chip usually hides the keyblock somewhere else, so ReallyMine cannot find it. It might be in the service area of the disk or it might be stored in a memory chip on the board.

You said not to ask how you repaired the disk, so I'll never know if you did something wrong. If you had really repaired it, you should be able to use data recovery tools on it again. Whatever you did changed something important.

[themaddoctor]

I don't know exactly what this means: CMD DISKPART (select drive) clean create partition primary format fs=ntfs

But if you formatted the partition that you made, then you damaged your data even more.

[Pruiki]

Yes I did format it, unfortunately. Was a big mistake. The Board of the diisk was not broken, but the adapter was. So all could have been prevented.

To bad to hear ReallyMine can't help fixing this.

Thanks!

[meerank]

Hello :)

I have the same problem as most of people who come here. I'm trying to save the data from WD MyBook Essentials. If I would only know that the drive is encrypted when I was buying it... Anyway, I've managed start decrypting it but it seems slow. By that I mean aprox. 2,5 GB/h. So for 1 TB drive this is aprox. 400 hours, which makes almost 17 days.

When I've made

reallymine getdek /dev/... it said reverse decrypt reverse, if this matters for the speed.

So, what are your experiences with the speed? I am not complaining I'd just like to know if mine's really slow and there something wrong or is such speed normal for this kind of operations.

Thanks. Miran