[SOLVED] Issues retrieving data on (possibly) partitioned WD MyBook Elite 1.5TB HDD

[MDG2855]

Hi. Hoping someone can help please.
I have a Western Digital MyBook Elite 1.5TB external drive that had a mishap courtesy of one of our cats whilst I was using it.
Result being the USB interface came off the board while it was going, and the drive is now RAW.
Now when I first bought it, it was like the drive was partitioned. In my system it had drives E and F.
On E there was a whole lot of WD stuff including an automated backup app and manuals.
My data was on the F drive.
I have tried both Recoverit and Photorec with deep scan, and after hours of searching they both come up the same - all they retrieve are the same WD things on the E drive.
Nothing of my actual files/photos/films/music from the F.
Nothing shows to indicate there is a partition.
Does anyone know of a way that I can bypass the WD stuff on E and retrieve my data on F? Or somehow get the retrieval apps to read all the data? Thanks!

 

[Alabalcho]

On some portable drives, the extra partition keeps the code to unlock the drive, do you remember anything like that?

 

[fzabkar]

Can you show us the Partitions window in DMDE?

https://dmde.com/

 

[MDG2855]

On some portable drives, the extra partition keeps the code to unlock the drive, do you remember anything like that?

Hi. No, I never used it nor do I remember anything about it. There was no mention of codes anywhere. The drive is some years old.

 

[MDG2855]

Can you show us the Partitions window in DMDE?

https://dmde.com/

Sorry, can't attach an image for some reason. I'll try to write it out. VOLUME has 2x entries: Drive 1, and below that is a line to a second drive with a red X through it and no name. PARTITION has nothing for drive 1 but Primary (A) for the bottom one. F.SYSTEM is MBR (greyed out slightly) for Drive 1 and MSData (06) for the other. SIZE is 1.50 TB for both. INDICATORS is T for Drive 1 and Ex (x is red) for the other. FIRST SECTOR is 0 for Drive 1 and 2048 for the other. SECOND SECTOR is 2 930 277 167 for Drive 1 and 2 930 274 303 for the other.

 

[MDG2855]

Forgot to add, when I first was able to reconnect it, no drive letter was assigned, and I had to assign one myself. So only one letter shows for the drive. Do I perhaps need to try and assign a second drive letter? And how is that done?. Thanks!

 

[SkyNetRising]

Sorry, can't attach an image for some reason.

Upload to imgur.com first, then post link to the image.

 

[fzabkar]

If you can't find a file hosting service, you can capture the partition information to a text file as follows:

• Menu -> Screenshot to text file

It would appear that DMDE has found no partitions in its quick scan of the problem drive. This would suggest that you may have initialised it. Hopefully a full scan will find the $MFT.

The sector range (0 - 2 930 277 167) corresponds to the entire physical drive, so this would suggest that your model is not one of those with a hidden VCD (Virtual CD).

This is the IDEMA formula for standard HDD capacities:

https://www.google.com/search?q=97696368+++(1953504+x+(enter_GB_here+–+50))+in+decimal

 

[MDG2855]

If you can't find a file hosting service, you can capture the partition information to a text file as follows:

• Menu -> Screenshot to text file

It would appear that DMDE has found no partitions in its quick scan of the problem drive. This would suggest that you may have initialised it. Hopefully a full scan will find the $MFT.

The sector range (0 - 2 930 277 167) corresponds to the entire physical drive, so this would suggest that your model is not one of those with a hidden VCD (Virtual CD).

This is the IDEMA formula for standard HDD capacities:

https://www.google.com/search?q=97696368+++(1953504+x+(enter_GB_here+–+50))+in+decimal

Thanks. I'll run a full scan. Will respond in about 24 hrs.

 

[fzabkar]

DMDE should only take a few minutes to find the $MFT, if it is located at the 4GB point, or thereabouts.

 

[ex_bubblehead]

WD uses hardware encryption on their external drives. If you are attempting data recovery with the drive outside the enclosure you will fail. Your only option in that case is to obtain a new enclosure from WD.

 

[fzabkar]

Following on from ex_bubblehead's observation, if you are connecting to the drive directly via SATA, then this would explain why you are seeing a larger capacity (2 930 277 168 versus 2 930 274 304). The difference is 2864 sectors which could be the hidden space assigned to a VCD. The VCD area is not encrypted, so this could explain why your software is finding the WD stuff at the end of the drive but not your encrypted data.

If you show us sector 0 with DMDE, then we will be able to determine whether the drive is encrypted.

 

[MDG2855]

Following on from ex_bubblehead's observation, if you are connecting to the drive directly via SATA, then this would explain why you are seeing a larger capacity (2 930 277 168 versus 2 930 274 304). The difference is 2864 sectors which could be the hidden space assigned to a VCD. The VCD area is not encrypted, so this could explain why your software is finding the WD stuff at the end of the drive but not your encrypted data.

If you show us sector 0 with DMDE, then we will be able to determine whether the drive is encrypted.

Sorry, total n00b here. What is the command sequence? Thanks!

 

[fzabkar]

Launch DMDE.

Uncheck "Show partitions"

Select physical device.

OK.

The screen should now show sector 0 (LBA 0).

You can either take a snapshot of the screen, or you can select Edit -> Export to Text File.

 

[MDG2855]

Launch DMDE.

Uncheck "Show partitions"

Select physical device.

OK.

The screen should now show sector 0 (LBA 0).

You can either take a snapshot of the screen, or you can select Edit -> Export to Text File.

 

[MDG2855]

Launch DMDE.

Uncheck "Show partitions"

Select physical device.

OK.

The screen should now show sector 0 (LBA 0).

You can either take a snapshot of the screen, or you can select Edit -> Export to Text File.

 

[fzabkar]

Sector 0 is not encrypted. Is this the original sector of the problem drive? If you have initialised the drive, then this sector will have been overwritten.

Note that if you are viewing this sector via USB, it will have been decrypted by the enclosure.

 

[MDG2855]

Sector 0 is not encrypted. Is this the original sector of the problem drive? If you have initialised the drive, then this sector will have been overwritten.

Note that if you are viewing this sector via USB, it will have been decrypted by the enclosure.

Thanks everyone for all the help. I might try to get the original WD parts fixed or get a new WD enclosure and see if that does anything for it. Cheers!