MyBook Duo

[Joe]

Hi All,

I have two WD MyBook Duo enclosures from the same client. One containing 2 x 6TB Drives and one of 2 x 4TB drives. I was told they were both set to RAID 1. It appears they both died from a power surge.

The 6TB enclosure doesn't get any power but one of the drives works fine but the data looks encrypted. However, DE didn't find an encryption key on it. I'm guessing that the key is stored on the RAID controller bored.

The 4TB enclosure works fine but both drives had tripped the 5V TVS and worked fine once I removed them. I do know that this one had a smartware password on it (which I know). When I put them back in the enclosure it shows up as uninitialized RAID 0 (which is the default setting) and does not ask for a password. I'm pretty convinced that the box has been reset after the failure. When I looked at these 4TB drives in DE I did find encryption keys on the drives themselves however the data still looks encrypted even after using the decrypt feature in DE.

My theory is that the RAID controller would use the smartware password to decrypt the key which is stored on the drive but now the that the controller was reset it doesn't recognize these drives and doesn't ask for a password. My question is, how can I obtain the actual key from DE and manually decrypt it using the known password and then plug it back in to decrypt the drive?

I tried using other drives to set up the box to RAID 1, add the password and then plugging back in the original drives but it appears the controller keeps track of which drives are inside based on serial numbers or some other unique identifier because when I plugged in the original drives it was back to default settings.

Here's what I did:

1. Plugged in two WD test drives of 1TB each, set it up to RAID 1 and added the password.

2. Checked the two test drives in DE just to see if the controller had put a key onto the drive. There was none.

3. I wiped both test drives sector by sector and plugged them back in. The controller still recognized these drives as RAID 1 and asked for the password which tells me the drive info is kept on the controller. When I looked at the data via the enclosure in hex I could tell it was using encryption. (They had been wiped with zeros but it showed other values)

This whole thing seems odd. Why would there not be encryption keys on the 6TB drives but while they are present on the 4TB drives. If it has something to do with the smartware password then why was there no key present on the two 1TB test drives?

In any case, I'd like to try to manually decrypt the key on the 4TB drives using known password and then use it in DE to decrypt the drives. It seems to be the only thing left to try on the 4TB drives.

Is there a way to do that? Any other ideas or insights?

I apologize dragging on so long but I wanted to give the full background.

Thanks for making it all the way to the end of the post

[DataMedics]

I don't believe the Duo models encrypt the data. At least none of the ones I've worked on ever did. My guess is the client doesn't know how it was configured and it was actually a RAID 0. In Hex, look at an area where you'd expect to see all zeros such as near the end of the drive. If it's encrypted you'll see a regular repeating pattern, if it's not there will be actual zeros.

Also, are you sure the client didn't use a third party software encryption?

[AJ2008]

From WD website:

My Book Duo provides 256-bit AES hardware encryption. With password protection, My Book Duo ensures your entire media collection and important files are protected from unauthorized access.

Do you know which file system should be present? You can try Jarods suggestion to find some repeating 16 byte pattern or use software like r-studio to find RAW files - if no signatures are found then probably it is encrypted.

[DataMedics]

Source of the post From WD website:

My Book Duo provides 256-bit AES hardware encryption. With password protection, My Book Duo ensures your entire media collection and important files are protected from unauthorized access.

I wonder if it's just handled on a software level then. Because I've seen plenty and they were never encrypted, at least not by the bridge. In fact I just had a customer pay and pick one up that I recovered over the weekend...no encryption.

Or maybe it's just the ones being stocked in the stores around here that are that way....I don't know.

[AJ2008]

I havent seen enough of these to give a valid opinion, I've worked on a few of the myCloud models which did not implement encryption.

@Joe:
Assuming it is hardware encryption and the unit is defective, the key should be stored in one of the 8 pin chips on the bridge, maybe if a picture of it gets posted someone with more experience with it can advise better.

[Joe]

Thank you all for the input.

@DataMedics. The client just knew that she has a 4TB and a 6TB hard drive and since there are 2 of each I figured it must be RAID 1 or she would've had an 8TB and 12TB. I looked at the drives in hex (without the enclosures) and tried to do raw scans with no real results.

The 6TB is the one with the dead enclosure which did not have a user password and doesn't have a key on the drive. My plan is to try to fix the controller. I'll post an update about it after I've have a chance to do it.

The 4TB has the working enclosure and according to the client had a user password. Both drives are working and both have encryption keys on them. In the enclosure they show up as unformatted RAID 0 and it does not ask for a password. I'm pretty sure the technician who had it before me reset the box (per instructions from WD customer support ) Checking them individually in DE both with decrypt and without decrypt shows only garbled data.