WD Passport

[jerovsek]

Hello,

I connect drive to computer. There are no strange sounds. Drive spin up normally. In explorer it show only CD with smartware. Data partition is not visible in Explorer.
I was able to recover about 160GB files from drive(tree structure is OK), but I'm not shure, if this is all.
Is it possible, that just part of drive is encrypted? Smartware reports, that there is no smartware partition on drive.
When I scan drive, on the begining files are not detected.

Thank you
Jure

 

[pclab]

Why not ask the client what files he needs?
If you have them then it's done.

 

[Bankole Oladoja]

What model of My Passport are you working on ? and How do you recover those you have recovered so far ? by scanning the Drive, you might be killing it..

 

[jerovsek]

Thank you both for replay
I Will check with client
I don't know model of Password. It's out of the box. I receive only drive without enclosure

 

[jol]

[post]4016[/post] I don't know model of Password. It's out of the box. I receive only drive without enclosure

the SN from the drive can tell the answer

 

[Jared]

Since when does the enclosure make any difference? First thing I ever do is toss the plastic case back in the bin and go to work. The model number of the internal drive is all I need to know.

As to the drive being "partly encrypted" that is possible if someone entered the password wrong too many times, did the reset option (which changes the encryption key) and then wrote new data to it. The original data would be encrypted with the key in the SA, but the new data with the newly generated key in the magic sector near the end.

 

[LarrySabo]

As to the drive being "partly encrypted" that is possible if someone entered the password wrong too many times, did the reset option (which changes the encryption key) and then wrote new data to it. The original data would be encrypted with the key in the SA, but the new data with the newly generated key in the magic sector near the end.

Interesting. So resetting the drive does not restore access to the entire capacity then? Not such a useful function in that case. Can the key from mod 25/38 be copied to the magic sector and the encrypted data be recovered that way? Probably not if the password is also required in conjunction with that key, I'd guess.

 

[Jared]

The drive has a HPA from the factory which is where the magic key sector is stored. If you notice the capacity is larger over SATA than it is in USB mode. So you don't really lose any capacity doing the reset, it's still the same amount of hidden sectors at the end of the drive, it just changes the key so as to avoid needing to wipe the whole drive. But, I don't believe it actually changes the key in the service area. I know I've seen a number of cases where the key at the end and the SA one were different and the SA one didn't work anymore.

 

[LarrySabo]

I know about the sectors at the end of the drive not being accessible to the user, making the usable capacity less than the drive capacity. I thought you were suggesting that after the reset, there was still user data on the drive encrypted with the original key, plus another part that would hold any new user data encrypted with the new key produced as a result of the reset.

The OP stated that:
* 160GB of data had been recovered, with names and structure.
* He wasn't sure that he had all the data and questioned whether more data resided on the drive but was encrypted.
* "When I scan drive, on the begining files are not detected" and "Data partition is not visible in Explorer."

... so I'm confused whether the drive is encrypted or only some data is encrypted by a non-SmartWare program/utility.

 

[jol]

[post]4056[/post] I know I've seen a number of cases where the key at the end and the SA one were different and the SA one didn't work anymore.

i think that this happens if it's user password protected