WD Passport Password protected, last 5% of drive unrecovered

[ThomasH]

I have a "My Passport Essential SE (USB 3.0)"
Model WDBACX0010BBK-01
0512B R/N C4B ABAHFA
Internal model: WD10TMVW-11ZSMS5

Swapping to SATA pcb allows cloning of the first 93% of the drive perfectly. It degrades after that, and after the 95% mark, I can only recover maybe half of the sectors... one at a time.
The customer has a password enabled, (and he knows the password).
I've tried starting the 95% clone with a WD 3.5" JM538S chipped SATA-USB bridge, but I can't access any sectors.
I've downloaded and installed smartware into Windows, which does recognize the drive as password locked, but when I try to click on it, it says the "~maximimum attempts to unlock has been reached, unplug and try again~".

I can try to use a same model USB WD donor/target, turn it into a SATA drive, copy only the first 95% to that drive, and then put the USB PCB back on it...but... is that likely to work if I just leave the smartware section from the donor/target intact? Or, are is there a sector or sectors that are absolutely crucial to recover from the original drive that contain unique password decryption key info once it's created? ... And if that's the case, since I can't just scroll through the smartware section at the end, does anyone know what sectors on this model would be crucial to pull from the smartware section (or whereever it's stored)?

I guess if I knew exactly what to pull, if it was just 1 or 2 sectors needed, I could try those with the 3.5" adapter technique, ...if the smartware section doesn't need to be copied completely.

Any suggestions? I'm waiting for same-model drives to arrive, but customer is running out of time...

[AJ2008]

The key will be stored within the last 1% of the disk. You cant image in reverse even for a little while in SATA?

[ThomasH]

Thanks for responding, but no... the entire last 5% is really really bad. Although I seem to be able to read about 50% of the sectors I click on, each time DE/DDI hits a bad sector, the drive needs to be repowered, or it just reads garbage after hitting the first bad one. And the drive, in its unhealthy state, takes a little longer than normal to boot (even using SATA pcb), so automated cloning of that area isn't really an option...at least not with any settings I've tried. (Software and Hardware resets are not good enough to make the drive able to read sectors again after hitting the 1st bad one).

[ThomasH]

Finally found an exact model donor/experimental drive. (note: there are several variations of internal drives inside of the same exact external model number.) (I'm not sure if there are smartware differences, but there are definitely pcb differences (ending in 672, 692, 814, which take different SATA PCB swaps).

Since the smartware area on the client drive is only half recoverable at best and would take months, I had to find out where the password sector(s) were located to try to snipe just those.

1) Using SATA PCB, I cloned the smartware section on the experiment drive (while no password enabled) (sector 1953458176-end) (66992 total sectors) to a target drive 1.
2) Swapped ROM back to orig USB PCB, enabled password in smartware, and chose a hint.
3) Swapped back to SATA PCB, and recloned the same area to a different target drive (2).
4) hooked both target drives up and searched for differences in Winhex. Only 2 sectors within smartware were different. One presumably for the password/encryption unlock key, and one for the password hint (which was viewable as I typed it within that sector).
The crucial sectors on this 1TB USB3 with JM538S encryption chip (see full model above) were:
1953519648-seems like the important one
1953519880-definitely the password hint sector.

Unfortunately, I could recover the password hint sector from the client drive, (which matched what I'd expect to see based on what I saw on the experimental drive after enabling password and hint);
But I could not recover 1953519648.

Oh well. Maybe this will save someone some time.

I don't suppose that key/password is stored anywhere else??? Someone suggested looking at module 25, but it's blank on mine. Any chance the key/password unlock is stored in a module or maybe the U14 chip as a backup?

I'm about out of ideas here...

[AJ2008]

Look for string "57 44 76" inside module 25...

[ThomasH]

Thanks for the tip.
I almost very stupidly missed the fact that the important 512bytes part of module 25 is 2nd 512byte section. I was scrolling too fast in Winhex and never saw data there.

I was able to copy the 512byte key from client's module 25 to the important sector of the transfer drive. (I also copied the password hint sector from the original drive just in case), (and also modified sector 25 on the transfer drive to have the client's key...though I doubt that was necessary).

The drive then popped up as it should, I entered the client's password, and finished the recovery.

Thanks for the help.

[AJ2008]

Great