Go Back   Technibble Forums > General Computers > Tech-to-Tech Computer Help

  Technibble Sponsor

Reply
 
Thread Tools Display Modes
  #1  
Old 07-10-2012, 12:59 AM
coffee's Avatar
coffee coffee is offline
 
Join Date: Oct 2011
Location: USA, Indiana
Posts: 1,711
coffee has a spectacular aura aboutcoffee has a spectacular aura about
Send a message via Skype™ to coffee
Default WD External Drive Encryption

Pretty quick question here. Customer brought in a WD external drive and the data is encrypted. They lost their password. Any success route with recovery of data?

This is a past customer of mine and the drive is not stolen. I know them very well.

Looks to be partition is encrypted as no partitions show up.

Probably cannot do anything but reformat but thought I would ask anyways.

coffee
__________________

www.renuecomputers.com
Reply With Quote
  #2  
Old 07-10-2012, 02:57 AM
punzada punzada is offline
 
Join Date: Mar 2011
Posts: 16
punzada is an unknown quantity at this point
Default

What method of encryption was used? Most likely will be a list cause but there is always the chance of some flawed/exploitable situation.
Reply With Quote
  #3  
Old 07-10-2012, 03:22 AM
Larry Sabo's Avatar
Larry Sabo Larry Sabo is offline
 
Join Date: Jul 2009
Location: Ottawa, Canada
Posts: 1,706
Larry Sabo has a spectacular aura aboutLarry Sabo has a spectacular aura about
Default

Maybe try Nirfsoft's Protected Storage Passview to see a list of all the passwords they've used before. Maybe they'll jog their memory, or you might find what you're looking for.
__________________
Sabo Computer Repairs & Data Recovery
Ottawa, Canada
Reply With Quote
  #4  
Old 07-10-2012, 04:43 AM
300DDR's Avatar
300DDR 300DDR is offline
 
Join Date: Jun 2012
Location: Los Angeles, CA
Posts: 748
300DDR will become famous soon enough
Default

Did they set a password with WD's SmartWare? Are you sure they forgot the password, or could it be they remembered it but it doesn't work (which would indicate likely firmware problem with drive)?
Reply With Quote
  #5  
Old 07-10-2012, 11:23 AM
tpcg tpcg is offline
 
Join Date: Jun 2010
Posts: 71
tpcg is an unknown quantity at this point
Default

Have you connected that drive to a Linux box to see if it reads the drive?
it may have ext3/ext4 partitions.
Reply With Quote
  #6  
Old 07-10-2012, 04:14 PM
lcoughey's Avatar
lcoughey lcoughey is offline
 
Join Date: Apr 2012
Location: Ontario, Canada
Posts: 925
lcoughey is a jewel in the roughlcoughey is a jewel in the roughlcoughey is a jewel in the rough
Send a message via MSN to lcoughey Send a message via Skype™ to lcoughey
Default

These drives are encrypted via the controller...whether or not a password is set. If the drive requires a password, then it will need to be entered in order to gain access to the data. However, if the password was not intentionally set, then it is likely a firmware or physical issue with the drive, as was mentioned by Brian.

I recommend sending it to Brian, as his site says this is only $400 recovery.
__________________


Data Recovery Specialists | Phone Support | Re-Seller Discounts
Reply With Quote
  #7  
Old 07-10-2012, 04:53 PM
coffee's Avatar
coffee coffee is offline
 
Join Date: Oct 2011
Location: USA, Indiana
Posts: 1,711
coffee has a spectacular aura aboutcoffee has a spectacular aura about
Send a message via Skype™ to coffee
Default

Ok, Let me attack all the questions here in one post

Quote:
What method of encryption was used?
It appears 256 bit encryption. They used the WD Smartware software to do this.

Quote:
Have you connected that drive to a Linux box to see if it reads the drive?
Yep. Can read a small partition on it that contains pdfs/html and such from WD. Other partition doesnt show up at all. Linux finds no partitions on the drive which I see as strange - but hey....

Quote:
However, if the password was not intentionally set...
It was a intentionally set password.

This is a simple case of customer forgot password.

@ Larry Sabo - Ill check into the software you mentioned.

I think for all practicle purposes it will be a drive reformat. Anyone run into this what did you do?

Thanks all..
__________________

www.renuecomputers.com
Reply With Quote
  #8  
Old 07-10-2012, 05:00 PM
brock029's Avatar
brock029 brock029 is offline
 
Join Date: Feb 2012
Location: San Antonio, Texas
Posts: 473
brock029 is an unknown quantity at this point
Default

Quote:
Originally Posted by coffee View Post

I think for all practicle purposes it will be a drive reformat. Anyone run into this what did you do?

Thanks all..
At my day job they use PGP Whole Disk Encryption and the only way around it is to reformat. I know that doesn't help much but I have yet to find a way around it.
Reply With Quote
  #9  
Old 07-11-2012, 02:46 AM
Magic Miguel Magic Miguel is online now
 
Join Date: Jul 2012
Posts: 425
Magic Miguel is on a distinguished road
Default

There's some guys over at HDDGuru that have figure out a way to bypass the password for the encryption. I am almost certain this is what you're looking for.

http://www.youtube.com/watch?v=gXe7Tyc1JvE

The above video is from the guy who created the proof of concept. I don't know for sure if he's offering his services but if you really need that data, maybe that guy can help.

Sorry disregard, it seems like it can only bypass the password but not defeat the AES encryption. Although it wouldn't hurt to ask.

Last edited by Magic Miguel; 07-11-2012 at 02:57 AM.
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT. The time now is 06:53 AM.


Powered by vBulletin®
Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Technibble.com is based out of MELBOURNE, AUSTRALIA.