[SOLVED] Decryption of a WD Hard Disc - I'm really confused.

[clairerobb1]

Hello,

This is Claire here. Would just like to start out by saying that I am not involved in the recovery business in any way, and so I apologise if this is the wrong place for a layperson like me to be posting. I see that most posts here and from and for technically knowledgable folks from within the highly intricate world of data recovery, but I am at a loss in a particular situation and my lack of knowledge is the very reason I am here, so would greatly appreciate someone helping me out. I am describing my current conundrum below.

I am a photographer who had data lost in an external Hard Disc due to water damage in my office in May of 2020. I did have a backup, but unfortunately, made the cardinal sin of keeping it in the same physical room, and hence both copies were damaged - one more than the other. While one HD was completely beyond help since it was in a low storage unit, the other was kept on a desk and was only partially in water. Both were external Hard Discs.

MODEL NAME - Western Digital 4TB My Passport Portable External Hard Drive, Blue - with Automatic Backup, 256Bit AES Hardware Encryption & Software Protection purchased in FEBRUARY of 2020 (attaching a screenshot of image of HD)

Model Number - WDBPKJ0040BBL

I immediately contacted a recovery team which asked me to send over the disc, which I did. They took a few days to run tests etc, then gave me a two month timeline for recovery. It has now been nearly a year and all I have received from then on have been more timelines saying that the data is all secure and there, just that there is an issue with the decryption. I have left the disc with them since I know one thing about such situations - the more hands it goes into, the more chances of something going wrong. I don't want to take it to a team to tinker with something, then say they can't help, then go back to the original guys and for them to say "well the other team has done something we can't fix now". This is where the matter rests.

I apologize for the long post but I will try and get to the point
All I want is for someone with technical knowledge in the field to help me, by just deciphering the technical jargon and PLEASE just letting me know - am I being led on or is there any legitimacy to what these guys are saying?

Without making this any longer, I will try and attach as much informational stuff as and quote their emails to me below.

_

Mail sent on MAY 16th 2020

Dear Madam,
The submitted hard disk has undergone a lab testing process for data recovery.

Lab Test Results:

1. HDD had small noise from the disk without detection in any computer & data recovery equipment.
2. Hard Disk is analyzed for head defects which will read & write data from the magnetic platters. Head assembly is defective.
3. Data recovery to be processed on the drive by replacing working head assembly from similar donor / spare hard disk with firmware, re-alignment & data extraction by using disk imaging technology.

Estimated Recovery %: Undetermined

Recoverable Data: All Available Data

Estimated Time for Recovery: 20 Business days

We require an email approval from your end to go ahead with data recovery. We shall start the process by purchasing spares required for recovery.

Drive condition after recovery: Tampered and non usable.

Require a backup hard drive after completion of data recovery for data backup purposes.
Payment Terms: During submission of data backup.

___

Since a lot more time passed, I asked them for an update.

____

Mail sent on July 25th 2020

Dear Sir,
The current hard drive had issues with readable heads, we have already shifted the reading heads on the hard drive. The Lab work is successful, we have the complete drive online with capacity and parameters. We are facing the issue with the firmware codes of the hard drive. Since the disk is manufactured in Sep 2019, the codes of these drives are Locked by manufacture ie. Western digital. Hence no sectors are readable from the entire drive.

We are working with our tool manufacturer and the Western digital team (as Western digital will never provide any support for data recovery) to get the codes to unlock the drive and access data.
Since it is a very complicated process to reverse engineer the drive locking mechanism, it is taking time. We shall update the final status in 10 days of time.

___

Then a follow up

Mail sent on August 11th 2020

Dear Team,
All above mentioned issues are resolved and disk imaging is completed. The current drive sector readings are completely accessible, and we have taken the complete disk image of the drive with starting to ending sectors.
We are only facing one final issue with Decryption, the original PCB board has WD Hardware encryption on the fly, for this new 2019 model of the drive called "Spyglass 2" the solution for decryption is not yet released. Expected to get the updated release in coming 2 months. The data recovery is possible once the decryption parameters are provided by the tool manufacturer.

We are closing the case currently, as soon as the decryption is available we will be able to get the data from the drive.

____

This is where the matter rests. I try and get in touch every month or so to get updates and get told the same thing - "the tool manufacturer has yet to release the update which would have your solution" or something very similar. They claim there worldwide, there is no solution available, but it SURELY will come out. Whether its a week from now, or 6 months from now, they can't say.

I really don't know what to make of the situation and whether these are just random terms being thrown at me to make me believe there's still a chance, or whether there is actual hope.

I would be really grateful to anyone who could get some real information from the above mails, and give me an opinion on whether the recovery team seems to know what they're talking about and is there such a situation with this particular Hard Disc.

In case it's relevant, they haven't charged me anything so far, which is all the more reason I can't imagine they would be making all this up instead of just saying "we can't do this, sorry".

Thank you for your time.

Claire.

 

[Nemesia]

What's the company you sent it to? You sure they are a legit data recovery company?

 

[USAFRet]

Many external drives have encryption built into the enclosure hardware.
You can remove the drive and make it 'functional', but without that specific hardware, previously existing data on it is still encrypted and not accessible.

Lacking anything direct from WD, you, and they, are out of luck.

 

[clairerobb1]

What's the company you sent it to? You sure they are a legit data recovery company?

Hello, yes, they are a legitimate company. A couple of my colleagues had used their services and said they did a great job.

 

[clairerobb1]

Many external drives have encryption built into the enclosure hardware.
You can remove the drive and make it 'functional', but without that specific hardware, previously existing data on it is still encrypted and not accessible.

Lacking anything direct from WD, you, and they, are out of luck.

Thank you for your answer, and taking out the time. In your experience, does WD help in such matters, if I approach them with the issue?

Also, when they say that they are waiting for the "tool manufacturer" to provide the key, and after that all data would be readable, that's just talking out of nowhere? I'm only asking because they have not yet once stated that there's a chance it won't be done at all, and since they haven't taken any money from me, I don't see why they'd spin a yarn and just lead me on for so long.

Thay have stated that such keys often took a couple of years to be released, but that recently, the time is mostly around 6 months. This year, due to the virus situation and things being on hold or delayed all around the world, it's taken much longer than usual.

Thanks again.

 

[USAFRet]

Thank you for your answer, and taking out the time. In your experience, does WD help in such matters, if I approach them with the issue?

Also, when they say that they are waiting for the "tool manufacturer" to provide the key, and after that all data would be readable, that's just talking out of nowhere? I'm only asking because they have not yet once stated that there's a chance it won't be done at all, and since they haven't taken any money from me, I don't see why they'd spin a yarn and just lead me on for so long.

Thay have stated that such keys often took a couple of years to be released, but that recently, the time is mostly around 6 months. This year, due to the virus situation and things being on hold or delayed all around the world, it's taken much longer than usual.

Thanks again.

'my experience'? None.
I've not had occasion to use a data recovery company, nor had to deal with recovering from an encrypted drive.

They've seemingly successfully recovered the data to a readable state. Just that it is still encrypted.

Will WD or whomever made that encryption cough up with a decryption routine? Completely unknown.
The company you're working won't say "Yes" until it actually works.

So far they've done all the work, and have no money yet. So it doesn't look bad.
Just have to wait for the next level up the chain to provide the needed tools to decrypt.

 

[fzabkar]

"Spyglass 2" drives store an encryption key in the microcontroller on the PCB. Earlier models stored this key on the drive's platters. The tool supplier is Ace Laboratory (Russia) and the tool is PC3000. WD will give you nothing -- they will only refer you to their data recovery "partners" who are themselves waiting for the Russian developers (aka hackers) to crack the encryption and provide an update in their PC3000 update box. In fact Seagate can recover data from WD's drives, but WD cannot. Shame WD, shame.

The only solution is to transfer the MCU (and ROM) to a donor PCB, assuming the MCU has not been damaged. If you can get back your original PCB, I can at least help you to assess the damage. If the MCU is undamaged, then you need to find a competent, component level, electronic workshop. Most data recovery "techs" come from an IT background and have zero knowledge about electronics.

I suspect that your data recovery company is probably limited to whatever they are able to do from behind a keyboard. That's why they would be waiting for a solution from their tool supplier.

 

[clairerobb1]

"Spyglass 2" drives store an encryption key in the microcontroller on the PCB. Earlier models stored this key on the drive's platters. The tool supplier is Ace Laboratory (Russia) and the tool is PC3000. WD will give you nothing -- they will only refer you to their data recovery "partners" who are themselves waiting for the Russian developers (aka hackers) to crack the encryption and provide an update in their PC3000 update box. In fact Seagate can recover data from WD's drives, but WD cannot. Shame WD, shame.

The only solution is to transfer the MCU (and ROM) to a donor PCB, assuming the MCU has not been damaged. If you can get back your original PCB, I can at least help you to assess the damage. If the MCU is undamaged, then you need to find a competent, component level, electronic workshop. Most data recovery "techs" come from an IT background and have zero knowledge about electronics.

I suspect that your data recovery company is probably limited to whatever they are able to do from behind a keyboard. That's why they would be waiting for a solution from their tool supplier.

Wow. Ok, thank you so much.. for just giving me some answers. The team I have given it to has been so ambiguous and confusing with their replies that it's really gotten me frustrated. I really appreciate you taking out the time to answer in such detail.

I can definitely get back the HD since they don't seem to be hesitant in doing that. I'll have to collect it myself, it's currently in another city, and I'm not going to risk getting it shipped.

Just to clarify that when you say you can "help in assessing the damage", you mean you would need to have the disc/PCB with you physically, right? I'm not sure if that's what you meant.

Oh and..the "solution" they are waiting for from the tool supplier.. is this really something that eventually does come out sooner or later? The disc is manufactured in 2019 Sept, I think, and I had the issue happen in May 2020. So would it be reasonable to expect that the solution will come out , perhaps sometime this year?

Sorry last question - on another forum, someone mentioned that the "key" for each device is unique. Is that so? Or is there a common key, which if the "Ace Laboratory" guys crack, will solve the issue for all drives of this Model Number? The guys have been saying that "there is no solution for this worldwide" so I'm not sure what to think, if it's a common issue and all persons needing this drive to be decrypted are waiting, or if some have been decrypted and others , like me, are still waiting for their particular drive to be cracked.

Thank you for your time again. Sorry for the long posts and questions.

 

[fzabkar]

I can only help you by examining a photo of the PCB and asking you to measure certain test points with a multimeter. I may be able to find an electronic workshop for you, if it turns out to be necessary. A digital multimeter costs as little as US$5.

It would be interesting to see the second "unrecoverable" HDD as well.

BTW, I would ask them for the cloned copy of your HDD, even if you have to pay for it. You cannot be certain that the same HDD will survive a second cloning attempt.

As for a solution from Ace, there is no guarantee that there will ever be one. In fact data recovery will probably "disappear" in the near future as HDDs and SSDs become "locked down". Other firmware architectures (eg WD/HGST helium drives) have yet to be cracked, so there is no timeline that you can bank on.

Ideally, if the manufacturers were to correctly implement their security, then it should never be possible to circumvent it, even by the manufacturers themselves. That said, I suspect that there may be intentional backdoors, if governments demand it.

As for the uniqueness of the key, my understanding is that each MCU does in fact have a unique key. However, WD's security in respect of its earlier My Book and Passport drives has been shown to be extremely poor, with many loopholes, so who knows what the outcome will be for the current products.

 

[clairerobb1]

I can only help you by examining a photo of the PCB and asking you to measure certain test points with a multimeter. I may be able to find an electronic workshop for you, if it turns out to be necessary. A digital multimeter costs as little as US$5.

It would be interesting to see the second "unrecoverable" HDD as well.

BTW, I would ask them for the cloned copy of your HDD, even if you have to pay for it. You cannot be certain that the same HDD will survive a second cloning attempt.

Sure, will definitely ask them for a cloned copy. I'll get a multimeter, no problem. Finding an electric workshop would probably be quite difficult from you at your end, as I'm currently living in India, and doubt many such viable options exist, or that you'd probably have any reason to know about them. :/

I'll still try and get in touch with you once I have the original PCB and HD back with me. Let me know if you'd prefer communicating over an email or something, not sure if you'd still be available here, as it may take a few days/weeks. Truly appreciate your help in this.

 

[fzabkar]

I saw your thread at HDD Guru. We can communicate by PM, if you have sensitive data. Otherwise it would be better to communicate publicly via this thread.

Edit:

Did you password protect your HDD?

 

[fzabkar]

See the comment by "ddrecovery":

http://www.hddoracle.com/viewtopic.php?f=3&t=3048

The MCU is the largest square chip.

 

[fzabkar]

The responses at HDD Guru are typically cagey, but it would appear that there is a solution, and that it will be released in a future Ace Lab update. I recall another comment which suggested that there may be a copy of the key in a hidden, reserved firmware area on the platters.

I'm not sure, though. It would appear that the most expedient solution may still be to transfer the MCU and ROM to a donor PCB.

 

[clairerobb1]

I saw your thread at HDD Guru. We can communicate by PM, if you have sensitive data. Otherwise it would be better to communicate publicly via this thread.

Edit:

Did you password protect your HDD?

Of course, here is fine, no sensitive data or anything I was just not sure if you might be available here if I get back the HD after some time.

No I didn't password protect it in anyway.

Thanks a ton for the responses here and on HDD Guru, it helps me try to cut through the jargon which I'm not able to understand. Much Appreciated.