linux-mybook-tools
linux-mybook-tools copied to clipboard
themaddoctor
Orico 3259ru3 (JMS561)
Hi,
I have 2TB WD disk in Orico 3259ru3 case, i sold that case. Im trying now to open throught direct SATA that HDD but looks like its corrupted. Partition was encrypted with cryptsetup but i cant decrypt it directly from SATA. Case have JMS561 chip i dont use RAID.
There is solution for this? How can i open "properly" this HDD. Can i buy same case model? Or its writen some speacial keyblocks in EEPROM so i need same case?
When i was trying to install go get reallymine says i need to use go install reallymine but after that i cant found reallymine command.
Are you using linux? Maybe the problem is the wrong block size in the partition table. This is a common problem.
Dump your MBR (sector 0) so I can see it: sudo dd if=/dev/sdX count=1 | hexdump -C where X is the right letter for the drive.
This is what I see. The number 1953514552 is half of what I expected, and 64 is unusual.
Device Boot Start End Blocks Id System unknown1818-sector0.bin1 64 3907029167 1953514552 83 Linux
Can you hexdump the first 2050 sectors? Same command as before, but "count=2050".
Working with your hexdump is going to be too difficult. Please make a binary dump: sudo dd if=/dev/sda of=dump.bin count=4096
GitHub allows zip files, so you can zip it before uploading.
In linux, "!!" is rendered as the previous command, even in quotes. That should ruin everything.
To use a partition at a different location than in the partition table, use losetup. Something like sudo losetup -o 1048576 -f /dev/sda where the number is the offset of the partition in BYTES, not sectors. Then the device is mapped to /dev/loopX where X is some digit.
So even if the sector is wrong cryptsetup should decrypt and dmde should see raw signature files?
No. Decryption is different for each sector.
I tried starting with sector 32, 64, 128, 256, 512, 1024, and 2048, with each of the passwords, and saw nothing that I recognized as a filesystem.
the password is wrong or sectors are "moved" because orico have different sector blocks? its better to investigate password or sector sizes?
on that case i had two 2tb hdd and they are working independent i see two different hdd, you think the case by default will use some kind of keyblock to "move" different way sectors out of the box?
I really don't know how the JMS561 chip does things. If your data is important, I suggest you get the case back and use it to backup your data. I have tried everything that I can try without having the hardware.
you think it must be the same case or can i buy similar with same chip? or the "key" is in eeprom in that specific case?
your program will try to find keyblock?
The key for cryptsetup is derived from the password. I don't know what the JMS561 does.
im 100% sure its the case because i remeber i was trying something to connect hdd to different case and was not working, how we can find keyblock or determine what sectors case "cut's"
i will try to contact orico about this because its stupid when case down im gonna loose all files
i think i need to find same case with same chip https://superuser.com/questions/1649962/hard-disk-drive-is-visible-via-usb-3-0-but-not-via-sata