Page 1 of 1

Wd encrypted??

Posted: 28.08.14, 00:47
by pclab
Hi

I got a WD 2Tb drive from a store, who send it to me from their client.
The drive was working on a Apple.
The store couldn't find any info on it, so (I can't figure out why) they tried to create a NTFS partition of about 300mb, so they say... They couldn't get nothing...
So I got the drive. I imaged the drive to a new one (because the drive was already been opened).
I ran R-studio and UFS Explorer and I could find a HFS+ partition, but no data on it, unless a WD folder.
On hex values it's possible to see some references to Smartware. Is the drive encrypted? If so, it wasn't working on a Apple, but on a external case, right?
What do you guys think?
Thanks

PS: I can't attach files. so I put Dropbox links.

https://www.dropbox.com/s/elbfaj2cl1e2m ... 1.jpg?dl=0
https://www.dropbox.com/s/a2264nqgwg39h ... 2.jpg?dl=0
https://www.dropbox.com/s/xjct1966gixzf ... 3.jpg?dl=0
https://www.dropbox.com/s/ipeygvpx72xbe ... 4.jpg?dl=0

Re: Wd encrypted??

Posted: 28.08.14, 16:11
by AJ2008
The Smartware part of the disk is located at the end of the disk and is always in an unencrypted form. this is the H+ header you find, it is not a valid partition.

Re: Wd encrypted??

Posted: 28.08.14, 16:12
by AJ2008
check modules 25 + 38 for copies of the key, alternative look for string '57' in hex at offset '0' from the end of the disk back

Re: Wd encrypted??

Posted: 28.08.14, 23:56
by pclab
Hi AJ

But I'll need the enclosure too, right?
Thank You

Re: Wd encrypted??

Posted: 29.08.14, 14:41
by AJ2008
Yes, you will need enclosure, but finding the key can usually tell you what enclosure is needed and the enclosures are interchangeable (unless its Oxford controller, then you would need original enslosure)