WDBLWExxxxJCH-00 Western Digital WD My Book Duo 4060-775140-006 REV A Data Recovery

Western Digital (WD) offers a range of network-attached storage (NAS) products that are designed to meet the needs of both home and business users. These products come with a variety of features, such as multiple drive bays, powerful processors, and user-friendly interfaces. WD's My Cloud series is a popular choice for home users who want to set up their own personal cloud storage system. These devices allow users to store, access, and share their files from anywhere with an internet connection. They also come with a variety of apps that can be used to back up data, stream media, and manage files.

For business users, WD offers the My Cloud EX series, which comes with advanced features such as RAID support, dual Ethernet ports, and integrated backup software. These devices are designed to be used in small and medium-sized businesses, and can support multiple users and devices at once. The My Cloud EX series also comes with advanced security features such as data encryption and password protection. WD's NAS products are known for their reliability and performance, making them a popular choice for users who need to store and access large amounts of data on a regular basis. Whether you're a home user looking for a personal cloud storage solution, or a business user looking for a powerful and reliable network storage device, WD's NAS products are worth considering.

The patient is a WDBLWE0060JCH-00 password-protected RAID0 with a failed controller board. Has hardware encryption, password is known.

Enclosures with model numbers of the form WDBLWExxxxJCH-00 are all compatible and can be used as donors (the xxxx is just the total capacity of the unit when sold with drives, e.g. 0060 for this 6TB patient). If password protected, will need to use the WD Security program to unlock https://downloads.wdc.com/wdapp/WDSecurity_WIN.zip. The data can then be copied over using windows explorer.

The AES-256 encryption used appears to be in ECB mode (notice the 16-byte repeating blocks). Some encryption metadata is stored in the service area of the drives. This is likely where the data encryption key (DEK) is stored. It's encrypted with the key encryption key (KEK), which is either hardcoded from the factory or is derived from a user-selected password using some key derivation algorithm. It seems likely that the "IVP0" block found in the SA (modules 25 and 38) is related in some way to the DEK.

The password hint is also stored in the SA (module 25) in plaintext.