Access Issues

[digitalbaron]

Background: I have a WD My Book Live Duo 6TB device which I configured for RAID 1. For some reason, my access gradually reduced to no access -- I was able to login to the dashboard with the device connected to the router (via the IP)... then, something happened and I could not get past the "initializing" stage. I connected the device to my laptop via an ethernet adapter and I was able to see the dashboard -- drive 2 was noted as "bad". I lost dashboard access later that day. I am normally a Windows 11 user and attempted to view the contents of drive 1 via a SATA wire (without a power cable), but was only able to see two empty folders... and then a subsequent access attempt did not recognize the drive. I am assuming that the latter issues may have been attributed somewhat to not powering the drive (I put the drive in a non WD adapter with power later, which you will see below).

Upon reading information online further, I realized that I needed to see the files using a Linux file system reader and tried using DiskInternals Linux Reader, but the drive was not recognized. The drive shows up as a physical drive "WDC WD30 EZRX-00DC0B0", but when I try to open it, I get an error: "Can't open disk. Check the disk and try again." I also saw a message in the Linux Reader program window footer: "File system is not supported."

I then booted the latest version of Ubuntu from a flash drive. This time, I used a Unitek drive adapter with power. Under Disks, I saw "3.0 TB Hard Disk" and "WDC WD30 EZRX-00DC0B0". Size: 3.0 TB (3,000,592,982,016 bytes). Partitioning: GUID Partition Table. Contents: Unallocated Space. Device: /dev/sdb

I was not able to access the drive via Ubuntu. My understanding is that My Book Live Duo drives may or may not be encrypted. Can you please help me identify whether the drive is encrypted or not? If the drive was encrypted, I feel that this would show up as encrypted in Disks. I have not read anything that would suggest automatic drive wipes.

Thank you!

[themaddoctor]

Probably not encrypted. Probably uses a nonstandard block size, so linux does not understand the partition table.

To check, dump sectors 0 and 2048: sudo dd if=/dev/sdb count=1 status=none | hexdump -C sudo dd if=/dev/sdb skip=2048 count=1 status=none | hexdump -C

When you put the output here, use copy and paste. Do not post a screenshot.

[digitalbaron]

Thank you. Here is the output:

ubuntu@ubuntu:~$ sudo dd if=/dev/sdb count=1 status=none | hexdump -C 00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001c0 01 00 ee fe ff ff 01 00 00 00 ff ff ff ff 00 00 |................| 000001d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa |..............U.| 00000200

ubuntu@ubuntu:~$ sudo dd if=/dev/sdb skip=2048 count=1 status=none | hexdump -C 00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00000200

[themaddoctor]

Not encrypted. Sector 0 is the MBR, and it says Device Boot Start End Blocks Id System digitalbaron.0.bin1 1 4294967295 2147483647+ ee GPT

which means there is an extended partition table starting in sector 1.

Usually, the NTFS partition begins at 2048, but yours is empty.

Try fdisk -l /dev/sdb and see what it says.

[themaddoctor]

And those block numbers look more like a 2TB.

[digitalbaron]

Thank you. I tried running the fdisk -l /dev/sdb comment and the following was returned: "fdisk: cannot open /dev/sdb: Permission denied"

If not encrypted, what additional steps can I take to access the files? I should note that some directories were password protected, but some were not.

Strange that this is showing closer to 2TB versus 3TB -- where would the additional space be?

[themaddoctor]

sudo fdisk -l /dev/sdb

[digitalbaron]

Apologies - that returns the following:

$ sudo fdisk -l /dev/sdb Disk /dev/sdb: 2.73 TiB, 3000592982016 bytes, 5860533168 sectors Disk model: EZRX-00DC0B0
Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disklabel type: gpt Disk identifier: (my drive's serial number)

[themaddoctor]

It looks like a newly initialized disk with no partitions. You probably did that in Windows.

Do a hexdump of sector 2049 to see if there are signs of a filesystem.

[digitalbaron]

Thanks for this info. I am not a Linux expert so would need help with that command - what would I need to do to perform this hexdump?

[themaddoctor]

sudo dd if=/dev/sdb skip=2049 count=1 status=none | hexdump -C

[digitalbaron]

sudo dd if=/dev/sdb skip=2049 count=1 status=none | hexdump -C 00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00000200

[themaddoctor]

Nope. Not there.

Try this and see if there is anything anywhere: sudo hexdump -C /dev/sdb | more

It will pause after each page of output. Just report the first page. Type "q" in the terminal to quit the dump.

[digitalbaron]

sudo hexdump -C /dev/sdb | more 00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001c0 01 00 ee fe ff ff 01 00 00 00 ff ff ff ff 00 00 |................| 000001d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa |..............U.| 00000200 45 46 49 20 50 41 52 54 00 00 01 00 5c 00 00 00 |EFI PART.......| 00000210 88 4f 06 91 00 00 00 00 01 00 00 00 00 00 00 00 |.O..............| 00000220 af a3 50 5d 01 00 00 00 22 00 00 00 00 00 00 00 |..P]....".......| 00000230 8e a3 50 5d 01 00 00 00 d9 f0 16 2b 8a 1a 09 40 |..P].......+...@| 00000240 90 11 3d a3 51 93 57 3c 02 00 00 00 00 00 00 00 |..=.Q.W<........| 00000250 80 00 00 00 80 00 00 00 86 d2 54 ab 00 00 00 00 |..........T.....| 00000260 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00004400 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 |................| 00100000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00f00000 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 |................| --More--

[themaddoctor]

To get more output, hit the space bar after each page. Hit "q" when you want to stop.

What you have shown so far is the MBR, the GTP partition table, and 15MB of junk.

[digitalbaron]

Okay, here is some more data:

$ sudo hexdump -C /dev/sdb | more 00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 000001c0 01 00 ee fe ff ff 01 00 00 00 ff ff ff ff 00 00 |................| 000001d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 000001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa |..............U.| 00000200 45 46 49 20 50 41 52 54 00 00 01 00 5c 00 00 00 |EFI PART....\...| 00000210 88 4f 06 91 00 00 00 00 01 00 00 00 00 00 00 00 |.O..............| 00000220 af a3 50 5d 01 00 00 00 22 00 00 00 00 00 00 00 |..P]....".......| 00000230 8e a3 50 5d 01 00 00 00 d9 f0 16 2b 8a 1a 09 40 |..P].......+...@| 00000240 90 11 3d a3 51 93 57 3c 02 00 00 00 00 00 00 00 |..=.Q.W<........| 00000250 80 00 00 00 80 00 00 00 86 d2 54 ab 00 00 00 00 |..........T.....| 00000260 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00004400 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 |................| * 00100000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00f00000 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 e5 |................| * 00f00400 00 00 00 01 00 00 1e 8e 00 00 00 00 f0 af 30 29 |..............0)| 00f00410 25 d2 42 bd 8c 5f 77 01 df 73 fd a3 00 00 00 00 |%.B.._w..s......| 00f00420 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00f0fff0 00 00 00 00 00 00 53 57 41 50 53 50 41 43 45 32 |......SWAPSPACE2| 00f10000 0f f5 b6 80 0f db fc 20 0f f5 b6 88 0f f5 b6 8c |....... ........| 00f10010 0f f5 b6 90 0f f5 b6 94 0f e7 c0 00 0f f5 b6 9c |................| 00f10020 0f f5 b6 a0 0f f5 b6 a4 0f e5 6a 50 0f f5 b6 ac |..........jP....| 00f10030 0f f5 b6 b0 0f f5 b6 b4 0f f5 b6 b8 0f f5 b6 bc |................| 00f10040 0f f5 b6 c0 0f f5 b6 c4 0f f5 b6 c8 0f f5 b6 cc |................| 00f10050 0f f5 b6 d0 0f f5 b6 d4 0f f5 b6 d8 0f f5 b6 dc |................| 00f10060 0f f5 b6 e0 0f f5 b6 e4 0f f5 b6 e8 0f f5 b6 ec |................| 00f10070 0f f5 b6 f0 0f f5 b6 f4 0f f5 b6 f8 0f e0 e1 70 |...............p| 00f10080 0f f5 b7 00 0f f5 b7 04 0f f5 b7 08 0f f5 b7 0c |................| 00f10090 0f e1 19 60 0f f5 b7 14 0f e8 e7 c4 0f f5 b7 1c |...............| 00f100a0 0f f5 b7 20 0f e8 ed 8c 0f f5 b7 28 0f f5 b7 2c |... .......(...,| 00f100b0 0f f5 b7 30 0f f5 b7 34 0f f5 b7 38 0f f5 b7 3c |...0...4...8...<| 00f100c0 0f f5 b7 40 0f f5 b7 44 0f f5 b7 48 0f e2 81 80 |...@...D...H....| 00f100d0 0f f5 b7 50 0f f5 b7 54 0f f5 b7 58 0f f5 b7 5c |...P...T...X...| 00f100e0 0f f5 b7 60 0f f5 b7 64 0f f5 b7 68 0f f5 b7 6c |......d...h...l| 00f100f0 0f f5 b7 70 0f f5 b7 74 0f f5 b7 78 0f f5 b7 7c |...p...t...x...|| 00f10100 0f f5 b7 80 0f e0 d7 10 0f f5 b7 88 0f f5 b7 8c |................| 00f10110 0f f5 b7 90 0f f5 b7 94 0f f5 b7 98 0f f5 b7 9c |................| 00f10120 0f f5 b7 a0 0f f5 b7 a4 0f f5 b7 a8 0f f5 b7 ac |................| 00f10130 0f f5 b7 b0 0f f5 b7 b4 0f f5 b7 b8 0f f5 b7 bc |................| 00f10140 0f f5 b7 c0 0f f5 b7 c4 0f f5 b7 c8 0f f5 b7 cc |................| 00f10150 0f df 8a 50 0f f5 b7 d4 0f f5 b7 d8 0f f5 b7 dc |...P............| 00f10160 0f f5 b7 e0 0f f5 b7 e4 0f f5 b7 e8 0f f5 b7 ec |................| 00f10170 0f f5 b7 f0 0f e2 d5 d0 0f f5 b7 f8 0f f5 b7 fc |................| 00f10180 0f e2 83 00 0f f5 b8 04 0f f5 b8 08 0f f5 b8 0c |................| 00f10190 0f f5 b8 10 0f f5 b8 14 0f f5 b8 18 0f f5 b8 1c |................| 00f101a0 0f f5 b8 20 0f f5 b8 24 0f f5 b8 28 0f f5 b8 2c |... ...$...(...,| 00f101b0 0f f5 b8 30 0f f5 b8 34 0f f5 b8 38 0f f5 b8 3c |...0...4...8...<| 00f101c0 0f f5 b8 40 0f f5 b8 44 0f f5 b8 48 0f f5 b8 4c |...@...D...H...L| 00f101d0 0f f5 b8 50 0f f5 b8 54 0f f5 b8 58 0f f5 b8 5c |...P...T...X...\| 00f101e0 0f f5 b8 60 0f f5 b8 64 0f f5 b8 68 0f f5 b8 6c |......d...h...l| 00f101f0 0f f5 b8 70 0f f5 b8 74 0f f5 b8 78 0f f5 b8 7c |...p...t...x...|| 00f10200 0f f5 b8 80 0f f5 b8 84 0f f5 b8 88 0f f7 02 0c |................| 00f10210 75 61 76 63 00 00 00 00 00 00 00 00 00 00 00 00 |uavc............| 00f10220 ff ff ff ff 00 00 00 01 0f f4 a3 50 0f f4 a1 f0 |...........P....| 00f10230 0f f4 a3 10 0f f4 a2 00 0f f4 a2 10 00 00 00 01 |................| 00f10240 00 00 00 01 0f f5 3b 40 00 00 00 00 00 00 00 00 |......;@........| 00f10250 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00f10280 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 |................| 00f10290 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00f10b00 00 00 00 00 00 00 00 00 10 02 00 98 10 02 00 b8 |................| 00f10b10 10 02 00 e0 10 02 00 30 10 02 01 08 10 02 01 d8 |.......0........| 00f10b20 10 02 00 68 10 02 02 10 10 02 02 48 10 02 01 48 |...h.......H...H| 00f10b30 10 02 02 78 10 02 02 a8 10 02 01 70 10 02 03 48 |...x.......p...H| 00f10b40 10 02 03 70 10 02 03 98 10 02 02 e0 10 02 03 c0 |...p............| 00f10b50 10 02 04 28 10 02 04 f8 10 02 03 18 10 02 04 68 |...(...........h| 00f10b60 10 02 04 90 10 02 05 30 10 02 05 98 10 02 06 68 |.......0.......h| 00f10b70 10 02 00 20 00 00 00 00 00 00 00 00 00 00 00 00 |... ............| 00f10b80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00f20000 7f 45 4c 46 01 02 01 00 00 00 00 00 00 00 00 00 |.ELF............| 00f20010 00 03 00 14 00 00 00 01 00 00 0b a0 00 00 00 34 |...............4| 00f20020 00 00 31 84 00 00 00 00 00 34 00 20 00 08 00 28 |..1......4. ...(| 00f20030 00 20 00 1f 00 00 00 06 00 00 00 34 00 00 00 34 |. .........4...4| 00f20040 00 00 00 34 00 00 01 00 00 00 01 00 00 00 00 05 |...4............| 00f20050 00 00 00 04 00 00 00 03 00 00 22 64 00 00 22 64 |.........."d.."d| 00f20060 00 00 22 64 00 00 00 0d 00 00 00 0d 00 00 00 04 |.."d............| 00f20070 00 00 00 04 00 00 00 01 00 00 00 00 00 00 00 00 |................| 00f20080 00 00 00 00 00 00 24 2c 00 00 24 2c 00 00 00 05 |......$,..$,....| 00f20090 00 01 00 00 00 00 00 01 00 00 2e 24 00 01 2e 24 |...........$...$| 00f200a0 00 01 2e 24 00 00 02 24 00 00 02 58 00 00 00 06 |...$...$...X....| 00f200b0 00 01 00 00 00 00 00 02 00 00 2e 64 00 01 2e 64 |...........d...d| 00f200c0 00 01 2e 64 00 00 01 00 00 00 01 00 00 00 00 06 |...d............| 00f200d0 00 00 00 04 00 00 00 04 00 00 01 34 00 00 01 34 |...........4...4| 00f200e0 00 00 01 34 00 00 00 44 00 00 00 44 00 00 00 04 |...4...D...D....| 00f200f0 00 00 00 04 64 74 e5 51 00 00 00 00 00 00 00 00 |....dt.Q........| 00f20100 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 |................| 00f20110 00 00 00 04 64 74 e5 52 00 00 2e 24 00 01 2e 24 |....dt.R...$...$| 00f20120 00 01 2e 24 00 00 01 dc 00 00 01 dc 00 00 00 04 |...$............| 00f20130 00 00 00 01 00 00 00 04 00 00 00 14 00 00 00 03 |................| 00f20140 47 4e 55 00 aa a4 6c 77 6e 70 49 96 7b 73 e3 e2 |GNU...lwnpI.{s..| 00f20150 bb 7b 81 09 d3 a9 9c 40 00 00 00 04 00 00 00 10 |.{.....@........| 00f20160 00 00 00 01 47 4e 55 00 00 00 00 00 00 00 00 02 |....GNU.........| 00f20170 00 00 00 06 00 00 00 12 00 00 00 16 00 00 00 1a |................| 00f20180 00 00 00 04 00 00 00 07 00 11 00 98 00 00 42 00 |..............B.| 00f20190 08 60 00 82 de 08 28 93 00 00 00 1a 00 00 00 00 |.....(.........| 00f201a0 00 00 00 00 00 00 00 00 00 00 00 1b 00 00 00 00 |................| 00f201b0 00 00 00 1c 00 00 00 1d 00 00 00 00 00 00 00 1f |................| 00f201c0 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 22 |........... ..."| 00f201d0 00 00 00 23 00 00 00 00 00 00 00 00 00 00 00 24 |...#...........$| 00f201e0 00 00 00 26 00 00 00 27 00 00 00 00 00 00 00 29 |...&...'.......)| 00f201f0 f8 fc 21 91 19 5f b3 95 f9 07 e8 05 f9 04 02 06 |..!.._..........| 00f20200 f9 04 02 07 18 80 53 c1 0f 4d c4 ae 06 92 a2 61 |......S..M.....a| 00f20210 f6 6c 3d d5 f6 6c 3d d7 42 73 19 f8 18 a9 16 eb |.l=..l=.Bs......| 00f20220 42 73 19 fb f9 00 af 60 18 d0 9e 7f 0f fb 33 fb |Bs...........3.| 00f20230 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00f20240 00 00 00 00 00 00 0b 4c 00 00 00 00 03 00 00 0b |.......L........| 00f20250 00 00 00 99 00 00 00 00 00 00 00 00 12 00 00 00 |................| 00f20260 00 00 01 20 00 00 00 00 00 00 00 00 12 00 00 00 |... ............| 00f20270 00 00 00 01 00 00 00 00 00 00 00 00 20 00 00 00 |............ ...| 00f20280 00 00 00 1f 00 00 00 00 00 00 00 00 20 00 00 00 |............ ...| 00f20290 00 00 00 63 00 00 00 00 00 00 00 00 12 00 00 00 |...c............| 00f202a0 00 00 01 0e 00 00 00 00 00 00 00 00 12 00 00 00 |................| 00f202b0 00 00 00 e9 00 00 00 00 00 00 00 00 20 00 00 00 |............ ...| 00f202c0 00 00 00 b9 00 00 00 00 00 00 00 00 12 00 00 00 |................| 00f202d0 00 00 00 33 00 00 00 00 00 00 00 00 11 00 00 00 |...3............| 00f202e0 00 00 00 8b 00 00 00 00 00 00 00 00 12 00 00 00 |................| 00f202f0 00 00 00 b0 00 00 00 00 00 00 00 00 12 00 00 00 |................| 00f20300 00 00 01 15 00 00 00 00 00 00 00 00 12 00 00 00 |................| 00f20310 00 00 01 4c 00 00 00 00 00 00 00 00 12 00 00 00 |...L............| 00f20320 00 00 01 60 00 00 00 00 00 00 00 00 12 00 00 00 |...............| 00f20330 00 00 00 45 00 00 00 00 00 00 00 00 21 00 00 00 |...E........!...| 00f20340 00 00 00 4d 00 00 00 00 00 00 00 00 11 00 00 00 |...M............| 00f20350 00 00 00 44 00 00 00 00 00 00 00 00 21 00 00 00 |...D........!...| 00f20360 00 00 00 d4 00 00 00 00 00 00 00 00 20 00 00 00 |............ ...| 00f20370 00 00 00 f8 00 00 00 00 00 00 00 00 20 00 00 00 |............ ...| 00f20380 00 00 00 be 00 00 00 00 00 00 00 00 20 00 00 00 |............ ...| 00f20390 00 00 00 43 00 00 00 00 00 00 00 00 11 00 00 00 |...C............| 00f203a0 00 00 00 7e 00 00 00 00 00 00 00 00 11 00 00 00 |...~............| 00f203b0 00 00 00 a9 00 00 00 00 00 00 00 00 12 00 00 00 |................| 00f203c0 00 00 00 10 00 00 00 00 00 00 00 00 22 00 00 00 |............"...| 00f203d0 00 00 01 3d 00 00 17 f0 00 00 00 60 12 00 00 0c |...=...........| 00f203e0 00 00 01 6e 00 00 1c c0 00 00 00 b8 12 00 00 0c |...n............| 00f203f0 00 00 00 a2 00 00 10 f0 00 00 00 e4 22 00 00 0c |............"...| 00f20400 00 00 00 6f 00 00 0d 10 00 00 00 b8 12 00 00 0c |...o............| 00f20410 00 00 00 6f 00 00 1e a0 00 00 00 b4 12 00 00 0c |...o............| 00f20420 00 00 01 44 00 00 18 50 00 00 00 ac 12 00 00 0c |...D...P........| 00f20430 00 00 00 93 00 00 0f a0 00 00 00 e4 12 00 00 0c |................| 00f20440 00 00 01 bf 00 00 00 00 00 00 00 00 11 00 ff f1 |................| 00f20450 00 00 01 93 00 00 00 00 00 00 00 00 11 00 ff f1 |................| 00f20460 00 00 01 9d 00 00 00 00 00 00 00 00 11 00 ff f1 |................| 00f20470 00 00 01 a7 00 00 00 00 00 00 00 00 11 00 ff f1 |................| 00f20480 00 00 00 76 00 00 0f 30 00 00 00 6c 12 00 00 0c |...v...0...l....| 00f20490 00 00 01 b3 00 00 00 00 00 00 00 00 11 00 ff f1 |................| 00f204a0 00 00 01 67 00 00 19 00 00 00 00 94 12 00 00 0c |...g............| 00f204b0 00 00 01 29 00 00 15 80 00 00 02 70 12 00 00 0c |...).......p....| 00f204c0 00 00 01 31 00 01 30 48 00 00 00 04 11 00 00 1b |...1..0H........| 00f204d0 00 5f 5f 67 6d 6f 6e 5f 73 74 61 72 74 5f 5f 00 |.gmon_start.| 00f204e0 5f 5f 63 78 61 5f 66 69 6e 61 6c 69 7a 65 00 5f |cxafinalize.| 00f204f0 4a 76 5f 52 65 67 69 73 74 65 72 43 6c 61 73 73 |Jv_RegisterClass| 00f20500 65 73 00 5f 72 74 6c 64 5f 67 6c 6f 62 61 6c 5f |es._rtldglobal| 00f20510 72 6f 00 5f 5f 65 6e 76 69 72 6f 6e 00 5f 6c 69 |ro.__environ._li| 00f20520 62 63 5f 69 6e 74 6c 5f 64 6f 6d 61 69 6e 6e 61 |bc_intl_domainna| 00f20530 6d 65 00 5f 5f 64 63 67 65 74 74 65 78 74 00 64 |me.dcgettext.d| 00f20540 6c 6f 70 65 6e 00 64 6c 63 6c 6f 73 65 00 5f 72 |lopen.dlclose._r| 00f20550 74 6c 64 5f 67 6c 6f 62 61 6c 00 5f 64 6c 5f 73 |tld_global._dl_s| 00f20560 79 6d 00 64 6c 73 79 6d 00 5f 64 6c 5f 76 73 79 |ym.dlsym._dl_vsy| 00f20570 6d 00 64 6c 76 73 79 6d 00 73 74 72 63 6d 70 00 |m.dlvsym.strcmp.| 00f20580 5f 64 6c 5f 61 64 64 72 00 66 72 65 65 00 5f 5f |_dl_addr.free.| 00f20590 70 74 68 72 65 61 64 5f 73 65 74 73 70 65 63 69 |pthread_setspeci| 00f205a0 66 69 63 00 5f 5f 70 74 68 72 65 61 64 5f 6b 65 |fic.pthread_ke| 00f205b0 79 5f 63 72 65 61 74 65 00 5f 5f 70 74 68 72 65 |y_create.pthre| 00f205c0 61 64 5f 6f 6e 63 65 00 5f 5f 70 74 68 72 65 61 |ad_once.pthrea| 00f205d0 64 5f 67 65 74 73 70 65 63 69 66 69 63 00 63 61 |d_getspecific.ca| 00f205e0 6c 6c 6f 63 00 5f 5f 61 73 70 72 69 6e 74 66 00 |lloc.__asprintf.| 00f205f0 73 74 72 65 72 72 6f 72 00 64 6c 65 72 72 6f 72 |strerror.dlerror| 00f20600 00 5f 64 6c 66 63 6e 5f 68 6f 6f 6b 00 64 6c 61 |._dlfcn_hook.dla| 00f20610 64 64 72 00 64 6c 61 64 64 72 31 00 5f 64 6c 5f |ddr.dladdr1.dl| 00f20620 72 74 6c 64 5f 64 69 5f 73 65 72 69 6e 66 6f 00 |rtld_di_serinfo.| 00f20630 73 74 72 63 70 79 00 64 6c 69 6e 66 6f 00 64 6c |strcpy.dlinfo.dl| 00f20640 6d 6f 70 65 6e 00 6c 69 62 63 2e 73 6f 2e 36 00 |mopen.libc.so.6.| 00f20650 6c 64 2e 73 6f 2e 31 00 6c 69 62 64 6c 2e 73 6f |ld.so.1.libdl.so| 00f20660 2e 32 00 47 4c 49 42 43 5f 32 2e 30 00 47 4c 49 |.2.GLIBC_2.0.GLI| 00f20670 42 43 5f 32 2e 31 00 47 4c 49 42 43 5f 32 2e 33 |BC_2.1.GLIBC_2.3| 00f20680 2e 33 00 47 4c 49 42 43 5f 32 2e 33 2e 34 00 47 |.3.GLIBC_2.3.4.G| 00f20690 4c 49 42 43 5f 50 52 49 56 41 54 45 00 47 4c 49 |LIBC_PRIVATE.GLI| 00f206a0 42 43 5f 32 2e 31 2e 33 00 47 4c 49 42 43 5f 32 |BC_2.1.3.GLIBC_2| 00f206b0 2e 34 00 00 00 00 00 00 00 07 00 08 00 00 00 00 |.4..............| 00f206c0 00 08 00 08 00 00 00 08 00 09 00 07 00 07 00 0a |................| 00f206d0 00 09 00 08 00 08 00 08 00 08 00 00 00 00 00 00 |................| 00f206e0 00 08 00 09 00 08 00 0b 00 02 00 05 00 03 00 03 |................| 00f206f0 80 02 00 04 00 02 00 06 00 02 00 03 00 04 00 02 |................| 00f20700 00 05 00 04 00 02 00 06 00 01 00 01 00 01 00 01 |................| 00f20710 0a f2 cf 92 00 00 00 14 00 00 00 1c 00 00 01 88 |................| 00f20720 00 00 00 00 00 01 00 00 00 02 00 01 0d 69 69 10 |.............ii.| 00f20730 00 00 00 14 00 00 00 1c 00 00 01 93 00 00 00 00 |................| 00f20740 00 01 00 00 00 03 00 02 0d 69 69 11 00 00 00 14 |.........ii.....| 00f20750 00 00 00 24 00 00 01 9d 00 00 00 08 00 00 01 93 |...$............| 00f20760 00 00 00 00 00 01 00 00 00 04 00 02 09 69 19 73 |.............i.s| 00f20770 00 00 00 14 00 00 00 24 00 00 01 a7 00 00 00 08 |.......$........| 00f20780 00 00 01 9d 00 00 00 00 00 01 00 00 00 05 00 02 |................| 00f20790 09 69 19 74 00 00 00 14 00 00 00 24 00 00 01 b3 |.i.t.......$....| 00f207a0 00 00 00 08 00 00 01 a7 00 00 00 00 00 01 00 00 |................| 00f207b0 00 06 00 02 09 63 cf 85 00 00 00 14 00 00 00 00 |.....c..........| 00f207c0 00 00 01 bf 00 00 00 08 00 00 01 b3 00 00 00 00 |................| 00f207d0 00 01 00 01 00 00 01 80 00 00 00 10 00 00 00 20 |............... | 00f207e0 09 63 cf 85 00 00 00 09 00 00 01 bf 00 00 00 00 |.c..............| 00f207f0 00 01 00 04 00 00 01 76 00 00 00 10 00 00 00 00 |.......v........| 00f20800 09 69 1f 73 00 00 00 0b 00 00 01 cd 00 00 00 10 |.i.s............| 00f20810 0d 69 69 14 00 00 00 0a 00 00 01 d9 00 00 00 10 |.ii.............| 00f20820 0d 69 69 10 00 00 00 08 00 00 01 93 00 00 00 10 |.ii.............| 00f20830 09 63 cf 85 00 00 00 07 00 00 01 bf 00 00 00 00 |.c..............| 00f20840 00 01 2e 24 00 00 00 16 00 00 1d 80 00 01 2e 34 |...$...........4| 00f20850 00 00 00 16 00 00 12 f0 00 01 2e 40 00 00 00 16 |...........@....| 00f20860 00 01 30 54 00 01 2e 48 00 00 00 16 00 01 30 44 |..0T...H......0D| 00f20870 00 01 2e 4c 00 00 00 16 00 01 30 58 00 01 2e 50 |...L......0X...P| 00f20880 00 00 00 16 00 01 2e 38 00 01 2e 54 00 00 00 16 |.......8...T....| 00f20890 00 01 2e 30 00 01 2e 58 00 00 00 16 00 01 2e 3c |...0...X.......<|

[themaddoctor]

Are you sure you have the right disk? What you are showing me is a linux swap space with some linux programs in it.

[digitalbaron]

I believe so. This device (/dev/sdb) is the only one registering as 3.0TB. The other drives are a 512GB drive (for my laptop), 125GB drive for the flash drive I am using to boot Ubuntu, a 5.0TB external drive to prepare for a file copy from the RAID drive, and a "2.3GB loop device"

[themaddoctor]

Yeah, that's why the partition table says 2.1TB.

[digitalbaron]

The 2.3GB loop device info: Contents: Unknown (squashfs 4.0) - Mounted at /rofs Device: /dev/loop0 (Read-Only) Backing File /cdrom/casper/filesystem.squashfs

Strange that info from this device would be shown when the commands reference the other device.

[themaddoctor]

Try lsblk

[digitalbaron]

ubuntu@ubuntu:~$ lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS loop0 7:0 0 2.1G 1 loop /rofs loop1 7:1 0 62M 1 loop /snap/core20/1587 loop2 7:2 0 4K 1 loop /snap/bare/5 loop3 7:3 0 163.3M 1 loop /snap/firefox/1635 loop4 7:4 0 400.8M 1 loop /snap/gnome-3-38-2004/112 loop5 7:5 0 47M 1 loop /snap/snapd/16292 loop6 7:6 0 45.9M 1 loop /snap/snap-store/582 loop7 7:7 0 91.7M 1 loop /snap/gtk-common-themes/1535 loop8 7:8 0 284K 1 loop /snap/snapd-desktop-integration/14 sda 8:0 1 116.1G 0 disk ├─sda1 8:1 1 3.6G 0 part /cdrom ├─sda2 8:2 1 4.1M 0 part ├─sda3 8:3 1 300K 0 part └─sda4 8:4 1 112.5G 0 part /var/crash /var/log sdb 8:16 0 2.7T 0 disk sdc 8:32 0 4.5T 0 disk └─sdc1 8:33 0 4.5T 0 part /media/ubuntu/Elements nvme0n1 259:0 0 476.9G 0 disk ├─nvme0n1p1 259:1 0 250M 0 part ├─nvme0n1p2 259:2 0 128M 0 part ├─nvme0n1p3 259:3 0 459.3G 0 part ├─nvme0n1p4 259:4 0 990M 0 part ├─nvme0n1p5 259:5 0 14.9G 0 part └─nvme0n1p6 259:6 0 1.4G 0 part

[themaddoctor]

Weird.

Anyway, the disk is not encrypted, so this project doesn't help you.

There is a utility called testdisk. It might be installed on your Ubuntu already. I can't advise you how to use it. Try man testdisk to see the manual page. It looks at the raw disk and tries to find filesystems.

[digitalbaron]

Okay, thanks very much for your help. I am glad that the drive is not encrypted.

[u2n]

Might check this closed issue since unencrypted. (themaddoctor = thebest)

[digitalbaron]

Thank you @u2n, I can try that. If you do not mind, can you please clarify what my offset value should be? 3TB WD 'green label' drive with the following details found via sudo fdisk -l /dev/sdb :

Disk /dev/sdb: 2.73 TiB, 3000592982016 bytes, 5860533168 sectors Disk model: EZRX-00DC0B0 Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disklabel type: gpt Disk identifier: 2B16F0D9-1A8A-4009-9011-3DA35193573C

I changed the command slightly to match another device I will be copying to (sdc).

mkdir /dev/sdc/copied-files sudo mount /dev/sdb /dev/sdc/copied-files -o loop,offset=___

[themaddoctor]

The offset is the location of the filesystem measured in bytes. You have to find the filesystem first.

[digitalbaron]

Thanks for your reply. What command(s) would I need to run to find this info?

[themaddoctor]

testdisk

[digitalbaron]

Thank you. I installed testdisk and ran sudo testdisk /list

The output of that (in relation to the drive) is:

Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 2861588 64 32 Partition Start End Size in sectors 1 P EFI GPT 0 0 2 2097151 63 32 4294967295

I also entered the following command: sudo fdisk -l

The output of that in relation to the drive is: Disk /dev/sdb: 2.73 TiB, 3000592982016 bytes, 5860533168 sectors Disk model: EZRX-00DC0B0
Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disklabel type: gpt Disk identifier: (my drive's serial number)

From this info, can you please help me refine the offset value I should use?

Thanks again for all of your help -- all of my life's information is on the drive.

[themaddoctor]

No, sorry. Not something I know how to do.

[digitalbaron]

Okay, no problem -- thanks for the help you provided. I will continue some other research -- I did just find more info. I ran:

apt-get install disktype disktype /dev/sdb

Output: --- /dev/sdb Block device, size 2.729 TiB (3000592982016 bytes) DOS/MBR partition map Partition 1: 2.000 TiB (2199023255040 bytes, 4294967295 sectors from 1) Type 0xEE (EFI GPT protective) GPT partition map, 128 entries Disk size 2.729 TiB (3000592982016 bytes, 5860533168 sectors) Disk GUID (my serial number) Partition 1: unused

It looks like this may prove what you thought might have happened earlier -- when initializing the disk in Windows, it may have caused further damage. In reference to "DOS/MBR partition map"

I may use Disk Drill as next step to recover files.

[u2n]

@digitalbaron, the commands you tried in response to my post would not have succeeded as "/dev/sdc/" references the disk, not a partition on the disk. (Not sure what the system would have done with that, hopefully ignore it.)

Maybe a word of caution here: Since complete data loss can happen with even one missed character, it's best to be positive each command is correct and does what you intend before pressing Enter. (It can also be useful to understand what the commands do before editing them.)

Have you tried the two commands as given? (From your post, "sdb" would replace "sdx," but be sure before entering!)

Note in the referenced thread in the link provided, gns11 also had a 3 TB drive with similar sector counts to yours. As mentioned, mine was 4 TB; but the mount worked with the same offset as his.

After the drive mounts, the filesystem will be accessible at /tmp/wd

[digitalbaron]

Thanks @u2n for your feedback. I did not yet execute the commands from your post as I could not find the correct offset value. You also have a very good point about needing to make sure that the commands are correct the first time. I am really struggling with this and do not know how to continue. I feel that I need a step by step guide/instructions since I am normally a Windows user. I have been using Ubuntu live from a USB drive for the above. Would you by chance be open to discussing offline for further help? I would be happy to pay via PayPal/Venmo. If so, I can be reached at digitalbarondev at gmail.

[u2n]

@digitalbaron, appreciate the $$ offer but remunerated help is not satisfying. The spirit of open source is based on voluntary contribution for the greater good. Comments here will help others.

Since the given offset worked for at least two users (with 3 TB and 4 TB drives), the obvious question is, why not try it?

[themaddoctor]

@u2n His problem is that the partitions are not in a standard place. His disk is from a linux system, and the first partition is the swap space. He needs to search for an ext3 or ext4 filesystem, probably. It will start a few GB later, since swap spaces are usually on the order of the size of one's memory.

[u2n]

@themaddoctor, I had taken special note of your 1-word paragraph, "Weird" that succinctly summarized the analysis of inputs. Since digitalbaron had twice mentioned being a Windows user, my thought was: No way this disk contains linux partitions.

The only thing I could think of was that since linux systems will sometimes assign different letters to drives on successive boots, maybe this happened and he was running the commands from memory (on sdb).

In any case, nothing would be lost when trying the same offset as worked for others. All it can do at worst is not work, in which case I got nothing lol.

Thanks again for providing the platform where even non-encrypted drive data can be saved.

[themaddoctor]

@u2n It's a MyBook Dual "Live", which means it has its own OS. That's about all I know.

[u2n]

And I didn't even know that much! So it's probable (since linux powers the world) that the drive letter was correct and the partition is ext4...which would lead back to your instruction: "You have to find the filesystem first."

Hope he stays with it and posts the (successful) results. These threads get indexed and often come up high in web searches so others can be helped.

Is there some known string he might search for near the FS start, then zero-in on the offset?

[themaddoctor]

If I had to do it from scratch, I would do something like

for i in seq 1 numsectors; do sudo dd if=/dev/sdx count=8 skip=$i | file -s - done

and grep on words like ext3 or ext4 or filesystem. It would take a long time.

[digitalbaron]

Just wanted to say thank you again for your help as I follow your latest posts -- I would be happy to post/confirm the solution here. My concern though is I do not know how to apply the latest feedback. I would essentially need end to end instructions for Linux.

I am currently running Disk Drill on Windows for 'drive 2' (the drive flagged as "bad" when I was able to access the My Book Live Duo dashboard). So far, there are 125,000+ bad sectors, but based on what I see so far from directories and files, there appears to be some kind of Linux or Unix based OS. My plan in the end is I can compare what I retrieved from drive 2 and drive 1 and merge anything that I could not retrieve from drive 1.

I am holding off on running Disk Drill on drive 1 (the supposed 'good' drive) as a last resort, as I read that this can cause issues, or not be able to recover all files. I can try to identify partitions on the drive using other software and follow up here when I have more info. For clarity, drive 1 represents everything from above in this thread.

I am also considering cloning drive 1 to be safe -- any recommendations on software for this? I have read good things about Clonezilla and ddrescue.

[themaddoctor]

ddrescue

[digitalbaron]

@u2n / @themaddoctor I have an update on this after reviewing further using testdisk (details below).

Intel partition table type has been detected.

I then proceeded with analyzing the drive. The initial output:

Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 2861588 64 32
Current partition structure:
     Partition                  Start        End    Size in sectors

 1 P EFI GPT                  0   0  2 2097151  63 32 4294967295

Warning: Bad ending sector (CHS and LBA don't match)
No partition is bootable

I then proceeded with a "Quick Search" for partitions and found this:

Disk /dev/sdb - 3000 GB / 2794 GiB - CHS 2861588 64 32
     Partition               Start        End    Size in sectors
>D Linux                  504   0  1  2456  63 32    3999744
 D Linux RAID             504   0  1  2456  63 32    3999744 [md1]
 D Linux                 2457   0  1  4409  63 32    3999744
 D Linux RAID            2457   0  1  4409  63 32    3999744 [md1]
 * Linux                 4410   0  1 2861567  63 32 5851459584

When I select each row from above, I see the following (I have referenced each line in the order they appear above):

     Partition               Start        End    Size in sectors
>D Linux                  504   0  1  2456  63 32    3999744

Output: ext3 blocksize=4096 Large_file Sparse_SB Recover, 2047 MB / 1953 MiB

     Partition               Start        End    Size in sectors
 D Linux RAID             504   0  1  2456  63 32    3999744 [md1]

Output: md 0.90.0 B.Endian Raid 1: devices 0(8,17)* 2(8,18), 2047 MB / 1953 MiB

     Partition               Start        End    Size in sectors
 D Linux                 2457   0  1  4409  63 32    3999744

Output: ext3 blocksize=4096 Large_file Sparse_SB Recover, 2047 MB / 1953 MiB

     Partition               Start        End    Size in sectors
 D Linux RAID            2457   0  1  4409  63 32    3999744 [md1]

Output: md 0.90.0 B.Endian Raid 1: devices 0(8,17) 2(8,18)*, 2047 MB / 1953 MiB

     Partition               Start        End    Size in sectors
 * Linux                 4410   0  1 2861567  63 32 5851459584

Output: ext4 blocksize=65536 Large_file Sparse_SB Recover, 2995 GB / 2790 GiB

I then used the "P" key to list the directory structure of each partition. I could not see anything in the "Linux RAID" partitions because of an error (not supported). The two "D Linux" partitions did not seem to have any relevant files (seemed to be mostly system related). When I listed content in the last Linux partition listed above, I saw:

   * Linux                 4410   0  1 2861567  63 32 5851459584
Directory /

 drwxr-xr-x     0     0     65536  2-Jan-1970 20:22 .
 drwxr-xr-x     0     0     65536  2-Jan-1970 20:22 ..
 drwx------     0     0    131072  2-Jan-1970 20:22 lost+found
 drwxrwxrwx     0    33     65536 20-Feb-2022 09:49 cache
>drwxrwxr-x     0  1000     65536 20-Feb-2022 09:49 shares
 drwxrwxr-x     0  1000     65536 15-Feb-2013 13:49 backup

I then clicked on the keyboard right arrow and saw all of my directories:

  * Linux                 4410   0  1 2861567  63 32 5851459584
Directory /shares

>drwxrwxr-x     0  1000     65536 20-Feb-2022 09:49 .
 drwxr-xr-x     0     0     65536  2-Jan-1970 20:22 ..
 drwxrwxr-x    99  1000     65536 20-Feb-2022 10:02 Public
 drwxr-xr--     0     0     65536 27-Oct-2013 13:02 .mediacrawler
 drwxrwxr-x    99  1000     65536  2-Jan-1970 20:22 SmartWare
 drwxrwxr-x    99  1000     65536 16-Sep-2013 14:53 TimeMachineBackup
 drwxrwxr-x    99  1000     65536 27-Dec-2021 17:43 MyFiles1
 drwxrwxr-x    99  1000     65536  4-Jan-2020 17:16 MyFiles2
 drwxrwxr-x    99  1000     65536 16-Sep-2013 14:53 TimeMachine
 drwxrwxr-x    99  1000     65536 26-Dec-2020 19:17 Photos
 drwxrwxr-x     0  1000     65536 20-Feb-2022 13:29 Taxes
 drwxrwxr-x    99  1000     65536 31-Oct-2014 10:11 Software
 drwxrwxr-x    99  1000     65536  4-Jan-2020 17:16 Publications
 drwxrwxr-x    99  1000     65536  3-Aug-2017 07:48 Music
 drwxrwxr-x    99  1000     65536 29-Jun-2019 13:15 Videos
 drwxrwxr-x     0  1000     65536 20-Feb-2022 10:02 House
 drwxrwxr-x    99  1000     65536  7-Sep-2020 11:05 Business

From here, I converted another external drive (5.0 TB WD Elements 2620) to the same Linux filesystem (ext4) believing that the copy speed may be improved. I then ensured that the drive was mounted, which I noted from the Ubuntu Disks utility that it was mounted at /media/myusername/IDhere. I created a unique directory at that mount point so I knew for sure I was on the external drive when I set the copy point. Note: when copying files using TestDisk, especially for new Linux users, it may not be apparent how to copy to the external drive. When on the copy configuration screen, the user should click the keyboard back arrow until they get to their system's root, and then go to /media/...their mount point (and preferably, a unique directory as I set). They can then copy files. I suggest that users enable logging in TestDisk before copying files, so that they know which files failed, if any.

I have just started the copy process, and I will update after.

[digitalbaron]

Update: TestDisk copy has an issue. From a 3 TB drive, my unused 5 TB drive that I am copying to is now 92.8% full, and not all files have copied. Do you have other ideas?

If I follow the method described in https://github.com/themaddoctor/linux-mybook-tools/issues/70, from the new info above, what would be the full command I need to use, with appropriate offset? Thank you

[u2n]

Wondered if you would encounter that problem restoring files with testdisk; same thing happened to me. It seems testdisk does not differentiate between current and deleted files (or filesystems), and did not restore directory structure. The files were recovered, but to sift though them and re-file would have taken way ridiculous more hours. So that's what led me back to the earlier-suggested solution:

mkdir /tmp/wd
sudo mount /dev/sdx /tmp/wd -o loop,offset=1048576

'x' is the drive to be recovered (no trailing number) and, as noted above, the regular offset was 256 x 4096 = 1048576.

To determine the offset (@themaddoctor may shed some light on this), best I can figure from your posted output is:

Since the total sector count, 5851459584, divided by the difference in input sector numbers (2861567 - 4410 = 2857157) is 2048, instead of the standard 4096 multiplier (8 sectors per block), we need to use 2048.

So the mount command would use 'offset=9031680' (4410 x 2048). But all this might be completely wrong lol, Please try it and see if your filesystem appears at /tmp/wd.

[digitalbaron]

Thanks, @u2n - that could help explain why there is a significant 'bloating' of files being copied, along with an exorbitant file size associated. It is also strange that I do not see any files (hidden or otherwise) to account for this. For example, a directory containing photos I moved from my cell phone is still copying after 1 failure and registering 519,669 items at 1.6 TB -- there is no way this is accurate, even with any deleted files. It is reducing the available capacity on my external drive that I am copying to as well. This does not appear to happen when I copy directories that do not have failures -- as soon as I have at least 1 failure, this can (but not always does) happen. Interestingly, TestDisk copy does appear to preserve directory structure for me.

I would like to proceed with your latest advise. Is there any potential for data loss/overwritten data with me issuing the command if for some reason the offset is not correct?

[u2n]

Can't imagine just issuing the mount command could corrupt any data. If the filesystem is present at that offset, it should mount, otherwise not (with possible display of error message).

TBH, I was hoping @themaddoctor would confirm or correct my deduced offset value. Could see if it works first.

[themaddoctor]

The offset is in bytes, as you figured. So I think it's correct.

[digitalbaron]

@u2n / @themaddoctor Thanks for the additional info/clarification. I tried the command, but I unfortunately see an error. Do you have any other suggestions? I am performing a TestDisk deep scan as a next step, as previously I just did a quick scan. This might help confirm some information as well.

mkdir /tmp/wd
sudo mount /dev/sdb /tmp/wd -o loop,offset=9031680
mount: /tmp/wd: wrong fs type, bad option, bad superblock on /dev/loop12, missing codepage or helper program, or other error.

[themaddoctor]

Try sudo dd if=/dev/sdb skip=4410 bs=2048 count=100 | file -s - to make sure the filesystem is where testdisk says it is.

[digitalbaron]

@themaddoctor Thank you - this is what I get in the output:

sudo dd if=/dev/sdb skip=4410 bs=2048 count=100 | file -s -
100+0 records in
100+0 records out
204800 bytes (205 kB, 200 KiB) copied, 0.0900269 s, 2.3 MB/s
/dev/stdin: data

Out of curiosity, did this command save data on the source drive?