Skip to content
DataForensics Book an AppointmentBook Now

Case Study

Encrypted, damaged, and still 96% recovered.

A Western Digital My Passport Ultra 1TB — hardware-encrypted by default, with the encryption built into a custom USB-to-SATA bridge board — arrived with damaged heads and no backup of the business documents on it. Here is what it took to get the data back.

I.

The case

A My Passport Ultra with encryption built in.

The drive: a Western Digital My Passport Ultra, 1TB, one of the My Passport models that encrypts by default at the hardware level.

Western Digital builds these drives with a custom PCB that replaces the standard SATA interface with a USB bridge and an encryption chip. It is a tougher drive to recover from than a standard external for one reason: encryption.

Imaging the platters is only half the job. Without the original encryption chip's key transferred across to whatever the data is recovered onto, the recovered data is still unreadable. That transfer step is what turns a routine recovery into a considerably more involved one.

On top of the encryption, the drive's heads were in poor condition — bad enough that a single donor drive was not going to be enough to complete the job.

II.

The recovery

Donor drives, a donor PCB, and an encryption chip transfer.

  1. 01

    Assessing the encryption layer

    Because the drive encrypts at the hardware level, recovery could not stop at imaging the platters — the original encryption chip needed to be carried over to a donor board with a standard SATA interface before the data would be readable at all.

  2. 02

    Two donor drives

    The original heads were too badly damaged to complete the job from a single donor. A second donor drive was needed to finish the imaging.

  3. 03

    Donor PCB and chip transfer

    A blank donor mainboard with a standard SATA interface was prepared, and the encryption chip from the original board was transferred across so the imaged data would decrypt correctly.

  4. 04

    Imaging

    With the heads and encryption both addressed, the drive was imaged through to completion.

III.

The result

96% recovered, business documents intact.

The recovery itself took around two days on top of the diagnosis, with 96% of the data recovered. Total turnaround from drop-off to return was three days, at a cost of around £490 + VAT.

The drive held viable business documents with no backup anywhere else. For a case like this, that cost is measured against the alternative: total loss of records the business had no other copy of.

Hardware-encrypted external drives like this one are becoming more common, and they are harder to recover than a standard drive precisely because of the encryption layer. If you're considering how to protect a drive, encrypting at the operating-system or folder level is generally easier to recover from than whole-drive hardware encryption. See our approach to hard drive data recovery more broadly.

Diagnosis first
Encrypted drive failed or damaged?

Power it down and stop using it. Tell us what happened and an engineer will give you an honest view of what's recoverable and a fixed quote before any work starts.