search

andlabs / reallymine

WD MyBook encrypted hard drive decryption (still WIP).
https://github.com/andlabs/reallymine/issues/38
GNU General Public License v3.0
214 stars 48 forks source link

Unable to find key sector on WD "My Passport" using reallymine #91

Open DhwaniKapoor27 opened 5 years ago

DhwaniKapoor27 commented 5 years ago

Hi,

I have a WD "My Passport" with really important files. I don't remember the password and want to open it using reallymine.

I installed the same and tried to decrypt. But got error related to "key sector not found". got same error while trying to use dumpkeysector command.

i am trying this on MacBook.

plzzzzzzz help

sh-3.2# diskutil list /dev/disk0 (internal, physical):

: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *250.1 GB disk0 1: EFI EFI 209.7 MB disk0s1 2: Apple_HFS Macintosh HD 249.2 GB disk0s2 3: Apple_Boot Recovery HD 650.0 MB disk0s3

/dev/disk2 (external, physical):

: TYPE NAME SIZE IDENTIFIER

0: CD_partition_scheme *36.1 MB disk2

/dev/disk3 (disk image):

: TYPE NAME SIZE IDENTIFIER

0: Apple_partition_scheme +24.3 MB disk3 1: Apple_partition_map 32.3 KB disk3s1 2: Apple_HFS Flash Player 24.2 MB disk3s2

[sh-3.2# ./reallymine dumpkeysector /dev/disk3 outfile.bin error running dumpkeysector: key sector not found [sh-3.2# ./reallymine decrypt /dev/disk3 dec.img error running decrypt: key sector not found

themaddoctor commented 5 years ago

Passports have the encryption chip built into the controller board. You have to by-pass that chip in order to access the raw disk and get the key sector (the chip hides sectors near the end of the disk from the user). There are some examples online of how people have by-passed the chip, and most of them involve soldering an SATA connector directly to the board. I can't give you any better advice than this, because I have never done it myself. BTW, be sure to find a guide for your exact chip and board layout, because there are a few different ones, all called "Passport".

If you succeed in finding your key sector, you still have the problem of forgetting the password. If you want me to help you crack it (I can usually crack 95% of disks with the JMS538S chip and 99% with the SW6316 chip; for the others, I would have to try a list of passwords that I have, and I can't even estimate the chances of success), I would need to see proof of ownership, such as a receipt or WD registration.