WD FBLte - Encryptions Issue

[Amarbir[CDR-Labs]]

Hello To All,

    I have this case and i am stuck on the issue that i am unable to decrypt this drive  ,The drive is question is the following

WDC WD10JMVW-11AJGS4

What are the modules ,sectors and places were i need to check ,I have issues in reading FW of head 01 but FW for head 00 is all ok ,Even Head 01 reads sectors fine ,I am attaching FW for this Case In The Post .Even If we are not able to do this can we come to a concluson why this is not possible please  .Is there a possibility that the encryption was tied up with the sata to usb chip and its rom and the older lab has changed the pcb but used same native rom in pcb 

The Link - > https://drive.google.com/file/d/1Oq09y0xbxQmyobrWrp_2pdhszKggjFav/view?usp=sharing

[pbzcbf...@gmail.com]

To answer this question, show us detailed photos of the ROM, the drive label and the PCB. If the date codes differ significantly, this will tell us that the PCB is most probably not native.

[Amarbir Dhillon]

Hello,

    Thak You ,Today is Sunday and a off day for me.Tomorrow i will click these pics and post here ,Meanwhile i do have remote access to the my office machine with PC 3000 UDMA and this Case On Channel 1 if there is something to check in the meanwhile i can do that

Regards

Amarbir Singh Dhillon

CEO - Chandigarh Datarecovery Labs " @ CDRLabs  , India

Website  :  www.chandigarhdatarecovery.com

Facebook : https://www.facebook.com/chandigarhdatarecovery/

Youtube : https://www.youtube.com/channel/UCbIeLFJWxTux8TQu_QSCsgQ?view_as=subscriber

--
Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to a topic in the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/datarecoverycertification/hHEmypP50hI/unsubscribe.
To unsubscribe from this group and all its topics, send an email to datarecoverycertif...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/c24dc2fa-ab3b-401b-860a-4edebfdd6877n%40googlegroups.com.

[Amarbir[CDR-Labs]]

Hello ,

     Please Find The Photos ,Looks OK To Me .Here are the photos - >  https://drive.google.com/file/d/1Tp5-I2RTtPedFcwFf2WNwCU_VWzHwCLK/view?usp=sharing

[pbzcbf...@gmail.com]

1652 (week 52 of 2016) - SDRAM

705 (week 5 of 2017) - motor controller

1650 (week 50 of 2016) - bridge

1709 (week 9 of 2017) - MCU

0717 (week 7 of 2017) - PCB

11 May 2017 - HDD label

That's a difference of 2 months between the manufacture of the MCU and the manufacture of the drive.

I suppose that's plausible, but it seems like a long time. WD normally doesn't keep inventory for that long. You could check your donor drive's date codes for comparison.

[jol qwerr]

the WWN is a match!

[pbzcbf...@gmail.com]

That just tells you that the ROM is native. It doesn't tell you if the PCB is native (because the ROM data could have been transferred to a donor PCB).

On Tuesday, June 18, 2024 at 12:44:54 AM UTC+10 jol qwerr wrote:

the WWN is a match!

[Extreme Solutions Parthipan]

PCB serial must be XLGZ05PG6HF00074407

sticker or QR code in PCB

--

Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---

You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/a2131a56-6402-471b-8a24-b8e255c86bc9n%40googlegroups.com.

[jol qwerr]

PCB sn (XLGZ05PG6HF00074407) is also a match

[Amarbir Dhillon]

Hi ,

   Everyone so assuming pcb is a match rom is a match what modules lbas should i look for possible encryption ,PC3K cannot find anything ,Can you tell me what else to check

Regards

Amarbir Singh Dhillon

CEO - Chandigarh Datarecovery Labs " @ CDRLabs  , India

Website  :  www.chandigarhdatarecovery.com

Facebook : https://www.facebook.com/chandigarhdatarecovery/

Youtube : https://www.youtube.com/channel/UCbIeLFJWxTux8TQu_QSCsgQ?view_as=subscriber

On Mon, Jun 17, 2024 at 8:32 PM jol qwerr <qjol...@gmail.com> wrote:

PCB sn (XLGZ05PG6HF00074407) is also a match

--

Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---

You received this message because you are subscribed to a topic in the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/datarecoverycertification/hHEmypP50hI/unsubscribe.
To unsubscribe from this group and all its topics, send an email to datarecoverycertif...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/CAKfZW8X5W7FFOz1NSJvGFDwybt7xEzXMf5Dhacj_5EDHMsBA8g%40mail.gmail.com.

[pbzcbf...@gmail.com]

I guess you're looking in SA module 02?

Offset(h) 00   02   04   06   08   0A   0C   0E

000000F0       0001 5744 2D57 5854 3141 3337 4336    ..WD-WXT1A37C6
00000100  354E 5900 0000 0000 0053 0057 5854 3141  5NY......S.WXT1A
00000110  3337 4336 354E 5920 2020 2020 2020 2058  37C65NY        X  <--
00000120  4C47 5A30 3550 4736 4846 3030 3037 3434  LGZ05PG6HF000744  <--
00000130  3037 2037 334A 474F 4C32 3051 4538 4135  07 73JGOL20QE8A5
00000140  2020 2020 2020 20                              

[Amarbir[CDR-Labs]]

Well,

      That Makes Sense ,So Can you folks guide what i need to check to decrypt ,What should be available at what location like a module some lba locations etc

[pbzcbf...@gmail.com]

The keys in modules 0x25 and 0x38 appear to be empty.

Module 0x25

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000200  57 44 76 32 E8 46 00 00 00 68 6F 74 00 00 00 00  WDv2èF...hot....
00000210  00 00 00 00 00 00 F0 00 00 00 00 00 00 00 00 00  ......ð.........
00000220  01 00 00 00 00 00 46 50 00 00 00 00 00 00 00 00  ......FP........
00000230  00 02 FF 00 00 00 00 00 00 00 00 00 00 00 00 00  ..ÿ.............
00000240  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000250  30 00 00 00 00 00 00 00 00 00 00 00 57 44 76 32  0...........WDv2

Module 0x38

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00010200  57 44 76 32 E8 46 00 00 00 68 6F 74 00 00 00 00  WDv2èF...hot....
00010210  00 00 00 00 00 00 F0 00 00 00 00 00 00 00 00 00  ......ð.........
00010220  01 00 00 00 00 00 46 50 00 00 00 00 00 00 00 00  ......FP........
00010230  00 02 FF 00 00 00 00 00 00 00 00 00 00 00 00 00  ..ÿ.............
00010240  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00010250  30 00 00 00 00 00 00 00 00 00 00 00 57 44 76 32  0...........WDv2

[pbzcbf...@gmail.com]

What data do you see in sector 4, 5, 6 ...? Do you see zeros or some repeating 16-byte pattern?

[Amarbir Dhillon]

So ,

     Is this is gone case  ,It has passed hands via a data recovery company before me ,As its a USB what other things can we cross check in this case please

Regards

Amarbir Singh Dhillon

CEO - Chandigarh Datarecovery Labs " @ CDRLabs  , India

Website  :  www.chandigarhdatarecovery.com

Facebook : https://www.facebook.com/chandigarhdatarecovery/

Youtube : https://www.youtube.com/channel/UCbIeLFJWxTux8TQu_QSCsgQ?view_as=subscriber

--
Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to a topic in the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/datarecoverycertification/hHEmypP50hI/unsubscribe.
To unsubscribe from this group and all its topics, send an email to datarecoverycertif...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/2c4af24d-3181-4a6a-acc2-9a155acb8c58n%40googlegroups.com.

[pbzcbf...@gmail.com]

Is there a SED bit in module 02 ???

[Amarbir[CDR-Labs]]

Hi,

   Well the SED enable Disable bit might have been toggled many times to see how the drive behaves in enabled and disabled scenarios

[pbzcbf...@gmail.com]

Convert the drive to SATA and perform a reverse search for "WDv2". If there is a key sector, you should find it within the last 65000 sectors or so.

[Amarbir[CDR-Labs]]

Hello,

     i will do this today and let you know please thanks

[jol qwerr]

Im thinking...

It might be a WD Smartware password protected

[Amarbir Dhillon]

Well,

      How to check if it indeed is ,I can check that too

Regards

Amarbir Singh Dhillon

CEO - Chandigarh Datarecovery Labs " @ CDRLabs  , India

Website  :  www.chandigarhdatarecovery.com

Facebook : https://www.facebook.com/chandigarhdatarecovery/

Youtube : https://www.youtube.com/channel/UCbIeLFJWxTux8TQu_QSCsgQ?view_as=subscriber

On Tue, Jun 18, 2024 at 11:57 AM jol qwerr <qjol...@gmail.com> wrote:

Im thinking...

It might be a WD Smartware password protected

--

Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to a topic in the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/datarecoverycertification/hHEmypP50hI/unsubscribe.
To unsubscribe from this group and all its topics, send an email to datarecoverycertif...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/CAKfZW8X%3Djs3QKahxxzREnhbaVTGCBu%2BB_6BCDjhPmLJUGuh%2Bng%40mail.gmail.com.

[jol qwerr]

the quickest way is to check with your client isnt it

[juanvd...@gmail.com]

I suspect that I have the same issue on the same model drive, stopped responding due to slow errors then after SATA swap and SLOW fix the drive gets ready with a few read errors and I did a full sector clone but all data is encrypted. Swapping USB board back then drive stays struggles to get sector access and can`t image or mount and only mounts in SATA mode.

DFL WD decryption fails and suspect the drive is encrypted with WD Smartware but the client does not know anything about Smartware enabled. It might be that the client enabled the Smartware on day one and never had to refer back to it because she is using the same Mac and only the one Mac.

You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.

To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/CAB61eee62kOjf7HR-snnUcV4b6dxj3WWSmzOJzfTt454VmazPw%40mail.gmail.com.

[Amarbir Dhillon]

Well,

     Clients Remembers Nothing  ....

Regards

Amarbir Singh Dhillon

CEO - Chandigarh Datarecovery Labs " @ CDRLabs  , India

Website  :  www.chandigarhdatarecovery.com

Facebook : https://www.facebook.com/chandigarhdatarecovery/

Youtube : https://www.youtube.com/channel/UCbIeLFJWxTux8TQu_QSCsgQ?view_as=subscriber

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/001601dac183%242b996280%2482cc2780%24%40gmail.com.

[jol qwerr]

can you upload a few sectors?

[pbzcbf...@gmail.com]

Yeah. I would dump the first 10 sectors in SATA mode and USB mode. If they are the same in both modes, then the bridge isn't decrypting the data.