PC-3000 Forum

Hello,

Got this drive. It was used with Apple. It was slow responding etc. Now reads well with some bad sectors. Unfortunetly first 40 and last tens of sectors are unable to read. Finding any file system shows HFS+ with both squares read, no data. Tried raw recovery - no files after few GB read. I got no clue if there is any encryption. PC-3000 didn't find any key.
Any ideas what to do with that case?

It very likely is using FileVault encryption. Do you have an actual mac you can connect the clone drive to? Might have to manually rebuild the partition table if so.

No, i just got the MyBook box. Don't have any mac. After scanning ~40GB from the beginning i got 6 movie files, 3 mp3, and exFAT Root directory. And from the end of the drive some leftovers of Apple Partition scheme and HFS+ Volume Header.
Will check if those movie files are good. If yes then it will take weeks to make o sector by sector copy of this 3TB drive and then do a RAW recovery.

EDIT:
Copied 150GB. Raw recovery showed only few vids, none of it working. Few mp3 100 times larger than usual. Will try to get a mac to try to fix that drive as it was written here: viewtopic.php?f=141&t=8724

From how little file signatures you found, I'd say it's almost certainly encrypted. Those "movies" and other hits you got are probably just false postives. You'll need to do some searching in hex editor to find the start and end locations of the partition and then manually rebuild the table. It's a p.a.i.n. in the butt, but it can be done. PM me if you need any help with it. The partition most likely starts at sector 409640. To determine the end you'll need to find the little system partition at the end.