Recover My Book Duo (1st Gen) after resetting the RAID 1 configuration

[fredfred27]

I have a My Book Duo 16TB that was configured RAID 1 and contains about 6TB of data (mostly photographs). I bought another new My Book Duo 16TB and plugged it into my system (Windows 7). I used the WD Drive Utilities to set the RAID configuration of the new drive to RAID 1, but to my utter horror, I picked the wrong drive and reconfigured the older enclosure. Yes, I was utterly stupid for not disconnecting the old drive before I tried to configure the new one. The old drive is now showing as a RAW 8TB drive in my system. Since it was and still is a RAID 1 configuration, can I recover anything off of either of the drives in the enclosure using your method? I was not using password protection.

[themaddoctor]

I don't know. It depend on a lot of things. To start, you should remove one of the disks from the enclosure and dump the first 2MB, so that I can see what's what.

[themaddoctor]

DO NOT DO IT IN WINDOWS. It will only corrupt the MBR. Do it in linux or mac with the dd command.

[fredfred27]

Sadly, I hooked up disk 1 to my Windows machine and ran TestDisk on it. Luckily I have disk 2 that has been untouched. Should that work?

I am not a Linux person. I have worked in it in the past, but I need to brush up. Will I be fine using a Live CD version? Do you have a suggested version?

[themaddoctor]

I will suggest ubuntu 16.04 live, but only because I have a copy of that one.

Use live, not emulated, because no one I know has gotten disk access to work with an emulator.

Just curios: Did testdisk find anything?

[fredfred27]

I will go ahead and install ubuntu 16.04 on a second hard drive in my spare computer. The first drive has a dual boot of Windows 7 and XP. I need some time to get up to speed on Linux again. I will try not to ask you noob questions if I am not up to speed. If you want to talk me through the procedures, I would be fine with that, but I bet you would rather have me a little up to speed.

With the drives in the enclosure, Testdisk only saw "MS reserved" and "MS data" partitions. I did not run a full analysis on them because as it was running I searched the internet and realized that the disks were encrypted. I also ran Photorec on the enclosure, but the files it recovered were unreadable junk. When I ran the single disk under Windows 7, Testdisk returned nothing also.

[fredfred27]

Here are the dumps from the two disks in the My Book Duo. I used Ubuntu 16.04. Here is the command I used.

sudo dd if=/dev/sdX count=4096 of=2mb_my_book_duo_disk_X.bin

Disk 1 was the one that was connected to my computer running Windows 7 at first. Disk 2 has only been hooked up to Ubuntu.

2mb_my_book_duo_disk_1.zip
2mb_my_book_duo_disk_2.zip

[themaddoctor]

Both dumps were identical. Did you change "X" to the right things?

I see that they are encrypted, but I didn't see anything to show that there is a filesystem in the appropriate place.

The next thing you should do is follow the instructions in the PDF until you have the decryption filter set up. Then dump the first 2MB again through the filter, so we can see what it decrypts into.

[fredfred27]

Since it was a RAID 1, shouldn't they be identical. When I hooked up Disk 1 to the Windows 7 machine, I did no formatting. I only ran Testdisk and Photorec on the drive via a generic, non-encoding USB to SATA enclosure.

Now I am connecting the drives one at a time via the Ubuntu computer's interior SATA connections. I do a full shutdown swap when working with the drives. Just in case I might have made a mistake, I re-made the files for you.

2mb_my_book_duo_disk_1_again.zip
2mb_my_book_duo_disk_2_again.zip

Are they still exact matches?

I will now plow into your PDF. I have a lot to learn, but hopefully I will be able to get back to you in a few days. Thanks for the help. If this doesn't work, I will have lost a lot of great photography.

[fredfred27]

Sorry I forgot to add...yes, I changed the X correctly when running the script. They were always the 5th drive, sde. I used "ls" under /dev to make sure it was the correct drive designation. They were the only drives not showing a partition.

[fredfred27]

I tried to find the keyblock on both of the disks using the instructions for the four types of chips. JMicron JMS538S, Symwave SW6316, Initio INIC-1607E and PLX OXUF943SE. Since my disks are 8TB, I had to extrapolate what might be the right number for the end of the disk. Since the difference between 2TB and 3TB (also 3TB and 4TB) was always 1953503232, I multiplied this by 4 and added it to the 4TB number of each chip. Running the command with the new number for each chip on both drives always returned:

00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000200

Next I followed the instructions in Appendix E. I copied your text into gedit and saved the file as "kb_bash.sh". I then ran:

sudo chmod +x ./kb_bash.sh
sudo ./kb_bash.sh /dev/sde

This always returned:
keyblock not found

I guess I need to open the enclosure so I can see the chip. This might prove a little difficult because I can't seem to find out how to get into it. I will give it a try though.

Any ideas while I am trying this?

[fredfred27]

I would probably have to damage the box if I wanted to get to the board. Instead, I used a dental mirror to take photos of the chips on the board inside. I am enclosing them for you.

MyBookDuo_Chip_Photos.zip

[themaddoctor]

I don't know how the JMS or AMS chip does encryption. The WD site says that if you buy a new enclosure, and put your disks in it, then you should be able to access your data. This means that the information needed to do so must be stored on the disk(s).

Can you dump the LAST 4MB of one of the drives? Do that by adding a "skip=..." to the dd command, where .... is the number of 512-byte sectors to skip. You have to play with the number until you get something small enough (but not smaller than 4MB).

If the information isn't there, then the next step is to dump the service-area modules with hddsupertool.

[fredfred27]

Sorry, but could you give me a command example for finding the 4MB? I will take the time to run it over and over until I narrow down the correct "skip=" value. Thanks.

[themaddoctor]

same command as before, plus "skip=..."