Question Data recovery on external WD Essentials drive

caliking92

Prominent
Apr 6, 2020
10
0
510
Hey guys,

I have recently spun up my external WD Essentials 4TB drive and found that it was not showing up in Explorer. After several steps (detailed below), I find myself now with a HD that is full of data but does not show partition, drive letter or file system.

Does anyone have an idea? > It would really mean a lot to me! Thanks!

Steps I have tried + outcomes:
1) Took apart HDD and put it into new case
Outcome: drive spins up without mechanical issues > all data seems to be there but no file system
  1. "Recuva" and "Acronis" could not get started on this, as the programs couldn't find the partition
  2. Tried "Minitool partition wizard" and "Easus Partition" and also they couldn't recover the partition > they spit out a bunch of data in weird file formats that I don't know what to do with.

4) and yes, I have searched your forum: I will now get in touch with WD, RecoveryForce and DataMedics


Thanks upfront for your support!
 

caliking92

Prominent
Apr 6, 2020
10
0
510
It is likely encrypted from the original enclosure.
https://community.wd.com/t/how-to-d...e-after-its-removed-from-the-enclosure/146588

While moving the drive to a new enclosure may have allowed it to spin up...your data is gone.
Dead enclosure = dead data.

This is when you recover the data from your backup.

Thanks for the hint and the link. Ok, I undertand that WD drives are encrypted and that I won't be able to break that encryption.

Sorry, one more questions regarding your statement: "data is gone" - does this only apply to me trying to recover the data OR is it really erased due to partition failure so even a data recovery service (or WD themselves) could not bring it back?
 

caliking92

Prominent
Apr 6, 2020
10
0
510
Guys, thank you all for the support. I am thinking of cloning it, continue to play around but bringing the original to a data recovery service for analysis.

Do you have any suggestions on how what went wrong or how to avoid partition failure in the future? From my perspective I did not do anything wrong (e.g. forceful removal of hard drive, etc.)?

Or is this something that happens a lot with WD drives?

I would like to avoid this kind of problems in the future.
 

USAFRet

Titan
Moderator
Thanks for the hint and the link. Ok, I undertand that WD drives are encrypted and that I won't be able to break that encryption.

Sorry, one more questions regarding your statement: "data is gone" - does this only apply to me trying to recover the data OR is it really erased due to partition failure so even a data recovery service (or WD themselves) could not bring it back?
Unless you can decrypt it with the link that was posted above (Post #4)...dunno...WD might be able to do it.
But that's the whole idea behind 'encryption'. It's not supposed to be easy to undo.


How to prevent this situation in the future?

Backups backups backups.
There is nothing inherently wrong with WD drives.
All drives are subject to fail. All of them.

The only real way to protect your data is to have it live on more than one drive.



The physical drive is of no consequence. Easily replaceable.
Your data on it is the critical part. Protect that.
 
Ok, I undertand that WD drives are encrypted and that I won't be able to break that encryption.
This is not correct. Certain WD external drives use encryption so if they are removed from the original casing, they will not be able to be read elsewhere. This is supposed to be for data protection, but mainly serves to frustrate users as a failed enclosure versus a failed drive can also lose data.
 
@caliking92, the reason that I asked you to describe what happens when the drive is in its original enclosure was to determine whether the enclosure was easily repairable, assuming it is faulty. The encryption key for your data is stored at the end of the drive. The USB-SATA bridge firmware (or reallymine) uses this key to decrypt the data. Therefore the simple solution would be to replace the bridge PCB in the enclosure.
 

caliking92

Prominent
Apr 6, 2020
10
0
510
@caliking92, the reason that I asked you to describe what happens when the drive is in its original enclosure was to determine whether the enclosure was easily repairable, assuming it is faulty. The encryption key for your data is stored at the end of the drive. The USB-SATA bridge firmware (or reallymine) uses this key to decrypt the data. Therefore the simple solution would be to replace the bridge PCB in the enclosure.
@fzabkar In it's original enclosure the drive spins up but is not recognized by Windows at all :/

What do you mean by "replace the bridge PCB in the enclosure"? Would that mean, replacing the platine from the case? This is the faulty piece: https://www.dropbox.com/s/kvfxfufdnszt8k8/IMG_20200408_161855.jpg?dl=0
 

caliking92

Prominent
Apr 6, 2020
10
0
510
@usas
This is not correct. Certain WD external drives use encryption so if they are removed from the original casing, they will not be able to be read elsewhere. This is supposed to be for data protection, but mainly serves to frustrate users as a failed enclosure versus a failed drive can also lose data.
Can I buy a case/enclosure from the same series and decrypt the faulty drive there if it has the same type of decryption chip (in my case symwave SW6316)?
 

caliking92

Prominent
Apr 6, 2020
10
0
510
Guys, I wanted to thank you all for the support. I wanted to give you a final update on what happened. So, after all my tinkering and my friend measuring out all electronics he also figured that the usb port was defect (@fzabkar ;-) ) buuuut that was not the case.

So after trying to decode the hard drive with linux and the tools mentioned above, we got stopped short when the hard drive would not be recognized by linux even. It shows at hdd2 but we couldn't access it.

So, I brought it to a second data recovery guy that originally (2 months ago) gave me a quote of 250€. After a more detailed review they figured out that:
(1) all the data likely is still on the hard drive
(2) but in addition to that f**** controller/PCB bridge apparently also the firmware is defect

and so the company would be charging 1.000+€.

But again, thanks for all your help!
 

caliking92

Prominent
Apr 6, 2020
10
0
510
Hey, so, they did not recover the data yet. I could not have cloned it myself but when I will buy the service, I will ask them to clone it before they get started.