WD5000LMCW-11T31S1 My Passport Smartware Forensic Data Recovery Case

This is one very important forensic data recovery case for one law enforcement agency and the user bought DFL SRP for WD to fix this case only to get the evidence files to be used in the court.

Case name: WD My Passport-Smartware Password Protected HDD Recovery
HDD Model: WD5000LMCW-11T31S1
HDD failure symptoms: Smartware password protected; not detected and keep busy.

Tools used for user: DFL-SRP for WD; EnCase Enterprise Edition

Before purchasing DFL-SRP for WD, the user doesn’t proper firmware repair tools to get the drive ready and IDed and cannot even work on the SA part due to the firmware failure and smartware password.

To dig the evidence files, the very first step is to access the SA and fix the firmware failure and remove the smartware password.

The engineer connected the patient drive to DFL-SRP and found the ROM couldn’t be read or written and firmware module list is not available too. The engineer soldered the ROM chip off and managed to read the ROM off the chip and then edited the ROM to bypass the ID module, next user wrote the new ROM to the chip using flash programmer and power on the drive again, the drive could be ready but not detected.

The user entered DFL WD firmware repair program and found all the firmware modules were available to be read/written without even loading loaders by using the DFL new function to bypass the ID module. All firmware modules can be directly backup in ID mode except the ID module, but ID module is accessible in ABA mode.

Next the engineer fixed the slow initialization problem in ATA mode and removed the smartware password and finally wrote the original ROM back.

Power off and on again after writing the original ROM back, the drive was perfectly fixed, perfectly IDed.

The engineer connected the case to PC, all normal data was displayed but the encrypted data are not seen, it is hidden, please note the smartware password has already been removed. The engineer connected to EnCase and scanned the lost data, all the needed evidence files appeared directly.

The engineer was extremely happy with the result.

Any question is welcome to sales@dolphindatalab.com or Dolphin Skype ID: dolphin.data.lab