WD External Drive Encryption

[coffee]

Pretty quick question here. Customer brought in a WD external drive and the data is encrypted. They lost their password. Any success route with recovery of data?

This is a past customer of mine and the drive is not stolen. I know them very well.

Looks to be partition is encrypted as no partitions show up.

Probably cannot do anything but reformat but thought I would ask anyways.

coffee

 

[punzada]

What method of encryption was used? Most likely will be a list cause but there is always the chance of some flawed/exploitable situation.

 

[Larry Sabo]

Maybe try Nirfsoft's Protected Storage Passview to see a list of all the passwords they've used before. Maybe they'll jog their memory, or you might find what you're looking for.

 

[300DDR]

Did they set a password with WD's SmartWare? Are you sure they forgot the password, or could it be they remembered it but it doesn't work (which would indicate likely firmware problem with drive)?

 

[tpcg]

Have you connected that drive to a Linux box to see if it reads the drive?
it may have ext3/ext4 partitions.

 

[lcoughey]

These drives are encrypted via the controller...whether or not a password is set. If the drive requires a password, then it will need to be entered in order to gain access to the data. However, if the password was not intentionally set, then it is likely a firmware or physical issue with the drive, as was mentioned by Brian.

I recommend sending it to Brian, as his site says this is only $400 recovery.

 

[coffee]

Ok, Let me attack all the questions here in one post

What method of encryption was used?

It appears 256 bit encryption. They used the WD Smartware software to do this.

Have you connected that drive to a Linux box to see if it reads the drive?

Yep. Can read a small partition on it that contains pdfs/html and such from WD. Other partition doesnt show up at all. Linux finds no partitions on the drive which I see as strange - but hey....

However, if the password was not intentionally set...

It was a intentionally set password.

This is a simple case of customer forgot password.

@ Larry Sabo - Ill check into the software you mentioned.

I think for all practicle purposes it will be a drive reformat. Anyone run into this what did you do?

Thanks all..

 

[brock029]

I think for all practicle purposes it will be a drive reformat. Anyone run into this what did you do?

Thanks all..

At my day job they use PGP Whole Disk Encryption and the only way around it is to reformat. I know that doesn't help much but I have yet to find a way around it.

 

[Magic Miguel]

There's some guys over at HDDGuru that have figure out a way to bypass the password for the encryption. I am almost certain this is what you're looking for.

http://www.youtube.com/watch?v=gXe7Tyc1JvE

The above video is from the guy who created the proof of concept. I don't know for sure if he's offering his services but if you really need that data, maybe that guy can help.

Sorry disregard, it seems like it can only bypass the password but not defeat the AES encryption. Although it wouldn't hurt to ask.