Recover data from a WD My Book drive

klturi421

Honorable
Sep 9, 2013
13
0
10,510
A few months ago my dad was having issues with his WD My Book and was unable to access his data (mostly pictures) with no backup in place. We've since set up backups to ensure no further loss of data, you could say we learned our lesson. Going back to the WD My Book, I connected the drive to his PC and as I have seen previously the drive was not reading and Disk Manager was indicating the drive was not formatted. At the time I was not aware that the My Book had some sort of encryption/scrambling of the data to deter access in the event that the drive was compromised.

In the effort of attempting to recover the data from the drive, I attempted several data recovery software but came up empty-handed each time. After some discussion and deliberation, my dad finally decided that it was maybe not worth spending the money to attempt recovering the pictures. A solution that I was hoping would work was to do a quick format to NTFS to make the drive readable while also hoping that it would permit the data recovery software a better chance at recovering the data. I still came up empty handed with quick scans. After running a deep scan (10+ hours) it finally came up with a Raw Data file with a bunch of folders with different "file types" but clearly not useable data but the total size of files matches what was previously stored on the drive.

With this being said, I am wondering what the chances of recovering this data are? Are there any programs that can attempt to decrypt/de-scramble the data?

On a similar forum someone was able to take the data from one disk and put it on the same type of disk and re-insert it to the drive and was successful in decrypting it that way. Since I did the quick format, did I erase any chance at potentially putting the data back? Or could I go into the disk manager, 'delete' the drive, swap the drive and recover the data that way?

Any assistance will be much appreciated!
 

asoroka

Distinguished
Apr 19, 2009
1,200
1
19,660
At this point your chances are probably low. The quick format has not destroyed the data, but any directory links are toast.
If the system is encrypted, that makes life more difficult.

If the photos are important, then you can send it to a professional recovery lab.

Alternately, you need to take an image copy of the disk as soon as possible.

We don't know if the problem is with the disk or the enclosure (probably disk, but you might be lucky).

I would remove the disk from the WD enclosure (destructive process) and mount it in a new external enclosure (or direct mount inside your PC).
I would then take a bitwise clone copy and only play with the clone.

It will not be easy.
 

klturi421

Honorable
Sep 9, 2013
13
0
10,510


I'm fairly confident that the issue was with the enclosure. It was having trouble staying on while trying to read from USB. I did remove the drive from the enclosure, connected it to a PC and that is when I discovered that the drive was not reading at all. Disk Management showed that a drive was present but unformatted. That's when I performed the quick format.

As for a bitwise clone of the drive, will I need another drive 3TB or larger to make the copy or will it copy only the data that is on the drive?

Let's say it is the enclosure that was going bad. If I do obtain another enclosure, in theory, would I be able to just connect the board to the drive as it is now and be able to potentially read the previous data? Is there something that I would need to the drive in it's current state to attempt restoring it to its previous condition? I'm thinking along the lines of using Disk Management to delete the drive and go from there.

What are the possibilities of initializing the drive with the new enclosure, my guess is that the data would still be unreadable, but would it then open up the possibility for a data recovery software to work?
 

asoroka

Distinguished
Apr 19, 2009
1,200
1
19,660
Your problem is that you have formatted the disk.

So if you obtain another enclosure then it should read the disk, however it may be encrypted.
So either you try another WD enclosure or you try to break the encryption.

If you put your original hdd into a vanilla enclosure it will be unreadable by any recovery software. You can refomat and use it, but you will never get your data back.

I did some searching for you.

https://community.wd.com/t/how-to-decrypt-a-wd-mybook-drive-after-its-removed-from-the-enclosure/146588

Safest bet is to clone to another identical hdd and play with that. In theory you should be able to clone down to a smaller disk, but I'm not sure about thet detail.

So if it was me, I would buy a new 3TB disk (possibly in a new external enclosure). Mount both disks internally in my PC.
Clone the original and then try to crack the WD encryption, then use software to recover from your format.

Alternately if it was mission critical (eg wife's iphone snaps) then I would pay a professional LAB.