[SOLVED] Issues retrieving data on (possibly) partitioned WD MyBook Elite 1.5TB HDD

Status
Not open for further replies.
Jun 27, 2020
9
0
10
Hi. Hoping someone can help please.
I have a Western Digital MyBook Elite 1.5TB external drive that had a mishap courtesy of one of our cats whilst I was using it.
Result being the USB interface came off the board while it was going, and the drive is now RAW.
Now when I first bought it, it was like the drive was partitioned. In my system it had drives E and F.
On E there was a whole lot of WD stuff including an automated backup app and manuals.
My data was on the F drive.
I have tried both Recoverit and Photorec with deep scan, and after hours of searching they both come up the same - all they retrieve are the same WD things on the E drive.
Nothing of my actual files/photos/films/music from the F.
Nothing shows to indicate there is a partition.
Does anyone know of a way that I can bypass the WD stuff on E and retrieve my data on F? Or somehow get the retrieval apps to read all the data? Thanks!
 
Solution
WD uses hardware encryption on their external drives. If you are attempting data recovery with the drive outside the enclosure you will fail. Your only option in that case is to obtain a new enclosure from WD.
Jun 27, 2020
9
0
10
Can you show us the Partitions window in DMDE?

https://dmde.com/
Sorry, can't attach an image for some reason. I'll try to write it out. VOLUME has 2x entries: Drive 1, and below that is a line to a second drive with a red X through it and no name. PARTITION has nothing for drive 1 but Primary (A) for the bottom one. F.SYSTEM is MBR (greyed out slightly) for Drive 1 and MSData (06) for the other. SIZE is 1.50 TB for both. INDICATORS is T for Drive 1 and Ex (x is red) for the other. FIRST SECTOR is 0 for Drive 1 and 2048 for the other. SECOND SECTOR is 2 930 277 167 for Drive 1 and 2 930 274 303 for the other.
 
Jun 27, 2020
9
0
10
Forgot to add, when I first was able to reconnect it, no drive letter was assigned, and I had to assign one myself. So only one letter shows for the drive. Do I perhaps need to try and assign a second drive letter? And how is that done?. Thanks!
 
If you can't find a file hosting service, you can capture the partition information to a text file as follows:

  • Menu -> Screenshot to text file

It would appear that DMDE has found no partitions in its quick scan of the problem drive. This would suggest that you may have initialised it. Hopefully a full scan will find the $MFT.

The sector range (0 - 2 930 277 167) corresponds to the entire physical drive, so this would suggest that your model is not one of those with a hidden VCD (Virtual CD).

This is the IDEMA formula for standard HDD capacities:

https://www.google.com/search?q=97696368+++(1953504+x+(enter_GB_here+–+50))+in+decimal
 
Last edited:
Jun 27, 2020
9
0
10
If you can't find a file hosting service, you can capture the partition information to a text file as follows:

  • Menu -> Screenshot to text file
It would appear that DMDE has found no partitions in its quick scan of the problem drive. This would suggest that you may have initialised it. Hopefully a full scan will find the $MFT.

The sector range (0 - 2 930 277 167) corresponds to the entire physical drive, so this would suggest that your model is not one of those with a hidden VCD (Virtual CD).

This is the IDEMA formula for standard HDD capacities:

https://www.google.com/search?q=97696368+++(1953504+x+(enter_GB_here+–+50))+in+decimal
Thanks. I'll run a full scan. Will respond in about 24 hrs.
 
Following on from ex_bubblehead's observation, if you are connecting to the drive directly via SATA, then this would explain why you are seeing a larger capacity (2 930 277 168 versus 2 930 274 304). The difference is 2864 sectors which could be the hidden space assigned to a VCD. The VCD area is not encrypted, so this could explain why your software is finding the WD stuff at the end of the drive but not your encrypted data.

If you show us sector 0 with DMDE, then we will be able to determine whether the drive is encrypted.
 
Jun 27, 2020
9
0
10
Following on from ex_bubblehead's observation, if you are connecting to the drive directly via SATA, then this would explain why you are seeing a larger capacity (2 930 277 168 versus 2 930 274 304). The difference is 2864 sectors which could be the hidden space assigned to a VCD. The VCD area is not encrypted, so this could explain why your software is finding the WD stuff at the end of the drive but not your encrypted data.

If you show us sector 0 with DMDE, then we will be able to determine whether the drive is encrypted.
Sorry, total n00b here. What is the command sequence? Thanks!
 
Jun 27, 2020
9
0
10
Launch DMDE.

Uncheck "Show partitions"

Select physical device.

OK.

The screen should now show sector 0 (LBA 0).

You can either take a snapshot of the screen, or you can select Edit -> Export to Text File.
6nvsNut.png
 
Sector 0 is not encrypted. Is this the original sector of the problem drive? If you have initialised the drive, then this sector will have been overwritten.

Note that if you are viewing this sector via USB, it will have been decrypted by the enclosure.
 
Jun 27, 2020
9
0
10
Sector 0 is not encrypted. Is this the original sector of the problem drive? If you have initialised the drive, then this sector will have been overwritten.

Note that if you are viewing this sector via USB, it will have been decrypted by the enclosure.
Thanks everyone for all the help. I might try to get the original WD parts fixed or get a new WD enclosure and see if that does anything for it. Cheers!
 
Status
Not open for further replies.