when we have two forms of encryption.... which one do we select?

[osity]

Please see photo attached.

encrypted.png (3.94 KiB) Viewed 10421 times

I've tried both options above..... and none, and still cant see any file structure, although I can image the whole drive either way.

[DataMedics]

Are you sure the drive wasn't secure reset using the WD smartware?

Normally all you do is try each key, then inspect where you'd expect to find blank space, such as right after the MBR. If it's zeros, you've got the right key. If it's an odd repeating pattern, try the other key.

[Maxim_TS]

I just would like to add that in most of cases if we see Self Encrypting in options, we need to select it first

[osity]

I forgot to mention that head 0 does not work, but I would think that the MFT is also available on another platter.

[DataMedics]

Keep in mind that if the user or their computer tech messed around doing things like taking a My Book out of the enclosure, they may have initialized it overwriting the MBR with a non-encrypted one (which will look encrypted after decrypting). That's why it's best to look at the empty space, maybe even look in the user area a bit to see if you can see any plain English words, or at least a lot of periods (. . .) in the ACII column in hex. That way you know you have the right key and can worry about the logical stuff like restoring the MBR later.

[lcoughey]

Source of the post I forgot to mention that had zero does not work, but I would think that the MFT is also available on another platter.

If it were a Samsung, I might be with you on that. However, the odds are, a good portion of the MFT will be lost without head 0.

[osity]

Even more strange, a raw recovery brought up nothing even though you can see lots of data being copied. Perhaps I had the wrong encryption chosen. I will play with it again today and report back

[osity]

jms.png (11.38 KiB) Viewed 10366 times

SED.png (13.9 KiB) Viewed 10366 times

This is what i get for the last few sectors of the drive using either JMS and SED decryption.
Both seem like meaningless repeating patterns...

[lcoughey]

Those are likely sectors with no data, filled with zeroes. You need to find a sector that has data (preferably one with known data), to figure it out.

[osity]

it seems like in my case the proper choice was JMS decryption.

I had TS looks at it and it appears that it may have file vault on it. Will I have to image the whole thing and get a password from client?
Its a shame as I did have a complete image of the drive but I deleted it for higher priority jobs...

[300ddr]

SED is not always the correct choice. Last time I had an option of JM and SED, it was JM. The way to test is try one, read first sector, check data. If shows 55AA, it's good. If it contains a mess of data, it's still encrypted. In that case, you need to exit the task and start over with a new one, choosing correct decryption option (ACE: it would be nice if we had the option to re-select a different decryption option after initial selection).

If FileVault encrypted, yes, you need to clone entire drive. Then enable MBR and hope it mounts on a Mac so it prompts for PW. If not, only other option is DiskWarrior 5 rebuild (then move files from the "preview" of the partition; do not "replace" the directory on the last step).

[osity]

yeah, i always thought that the option to change decryption type on the fly would be nice..
... but perhaps it could add more complications as it would be possible that some sectors would be left decrypted incorrectly if not careful...
...and by creating a new task like its required now, this mistake would not be possible.