WD encrypted portable drive on Linux
Hi, all -- A student of ours gave us a Western Digital disk so that we could deliver his files ... but it's an encrypted volume that only shows up as an 8M read-only sr0. Any thoughts on mounting it, presuming he gives me the passphrase, before I just throw it back at him? We don't do that steenking encryption stuff :-) and I am absolutely at ground zero. TIA :-D -- David T-G See http://justpickone.org/davidtg/email/ See http://justpickone.org/davidtg/tofu.txt
On 2023-10-03 15:05, David T-G wrote:
Hi, all --
A student of ours gave us a Western Digital disk so that we could deliver his files ... but it's an encrypted volume that only shows up as an 8M read-only sr0. Any thoughts on mounting it, presuming he gives me the passphrase, before I just throw it back at him? We don't do that steenking encryption stuff :-) and I am absolutely at ground zero.
If it is LUKS, Linux knows about that and will ask for the password when the desktop tries to mount it. If it is some Windows thing, who knows. I'm guessing it is some WD proprietary thing, and the 8MB open partition contains the windows setup program. Do you see something there? You could try: lsblk --output NAME,KNAME,RA,RM,RO,PARTFLAGS,SIZE,TYPE,FSTYPE,LABEL,PARTLABEL,PTTYPE,MOUNTPOINT,UUID,PARTUUID,WWN,MODEL,SERIAL,HCTL,ALIGNMENT /dev/something then "file -s /dev/something" -- Cheers / Saludos, Carlos E. R. (from openSUSE 15.5 (Laicolasse))
Carlos, et al -- ...and then Carlos E. R. said... % On 2023-10-03 15:05, David T-G wrote: % > % > A student of ours gave us a Western Digital disk so that we could deliver % > his files ... but it's an encrypted volume that only shows up as an 8M ... % % If it is LUKS, Linux knows about that and will ask for the password when the % desktop tries to mount it. Doesn't seem that, then. % % If it is some Windows thing, who knows. I'm guessing it is some WD % proprietary thing, and the 8MB open partition contains the windows setup % program. Definitely seems that. Sorry that I forgot to include a listing: davidtg@gezebel:~> ls -goh /run/media/davidtg/WD\ Unlocker/{,Extras/} '/run/media/davidtg/WD Unlocker/': total 2.0M drwxr-xr-x 3 272 Mar 22 2015 Extras drwxr-xr-x 22 1.2K Mar 14 2015 Locale -rwxrwxrwx 1 2.0M Mar 14 2015 'WD Drive Unlock.exe' -rwxrwxrwx 1 79 Nov 1 2011 autorun.inf '/run/media/davidtg/WD Unlocker/Extras/': total 142K -rwxrwxrwx 1 216 Nov 4 2011 'Adobe Reader Download.lnk' -rwxrwxrwx 1 136K Mar 16 2015 Unlock.ico -rwxrwxrwx 1 443 Mar 22 2015 VCDVersion.xml drwxrwxrwx 2 248 Mar 13 2015 'WD SES Device Driver' % % Do you see something there? I peeked in autorun.info but it simply points to the unlock icon file as well as the Win executable. % % You could try: % % lsblk --output NAME,KNAME,RA,RM,RO,PARTFLAGS,SIZE,TYPE,FSTYPE,LABEL,PARTLABEL,PTTYPE,MOUNTPOINT,UUID,PARTUUID,WWN,MODEL,SERIAL,HCTL,ALIGNMENT % /dev/something davidtg@gezebel:~> sudo lsblk --output NAME,KNAME,RA,RM,RO,PARTFLAGS,SIZE,TYPE,FSTYPE,LABEL,PARTLABEL,PTTYPE,MOUNTPOINT,UUID,PARTUUID,WWN,MODEL,SERIAL,HCTL,ALIGNMENT /dev/sr0 NAME KNAME RA RM RO PARTFLAGS SIZE TYPE FSTYPE LABEL PARTLABEL PTTYPE MOUNTPOINT UUID PARTUUID WWN MODEL SERIAL HCTL ALIGNMENT sr0 sr0 512 1 0 30M rom udf WD Unlocker mac /run/media/davidtg/WD Unlocker 550e29b200000000 Virtual_CD_0827 57584831453635334D553946 16:0:0:1 0 % % then "file -s /dev/something" davidtg@gezebel:~> file -s /dev/sr0 /dev/sr0: Apple Driver Map, blocksize 2048, blockcount 2248802304, devtype 0, devid 0, driver count 0, contains[@0x200]: Apple Partition Map, map block count 2, start block 1, block count 63, name Apple, type Apple_partition_map, contains[@0x400]: Apple Partition Map, map block count 2, start block 7068, block count 10776, name DiscRecording 5.0.9d2, type Apple_HFS, valid, allocated, in use, readable, writable, pic boot code, mount at startup I don't even see how to find the actual device! davidtg@gezebel:~> sudo dmesg | grep sr0 [703475.928979] sr 16:0:0:1: [sr0] scsi3-mmc drive: 51x/51x caddy [703475.929215] sr 16:0:0:1: Attached scsi CD-ROM sr0 I'm betting it's sdk Filesystem Size Used Avail Use% Mounted on /dev/nvme0n1p1 32G 27G 2.9G 91% / /dev/nvme0n1p3 824G 819G 5.5G 100% /mnt/ssd /dev/sdf1 298G 296G 2.3G 100% /mnt/GIFTarch-278 /dev/sdc1 298G 297G 2.0G 100% /mnt/GIFTarch-431 /dev/sdb1 15T 13T 1.7T 89% /mnt/Av16Tusb3-67 /dev/sda1 3.7T 3.1T 652G 83% /mnt/hdd /dev/sdg1 19T 19T 20K 100% /mnt/WD20Tusb3 /dev/sdj2 233G 194G 39G 84% /run/media/davidtg/Seagate /dev/sr0 8.2M 8.2M 0 100% /run/media/davidtg/WD Unlocker /dev/sdh1 118G 110G 8.2G 94% /run/media/davidtg/LSAvid-MC14 /dev/sdd1 119G 108G 11G 91% /run/media/davidtg/LSAvid-TG48 /dev/sdi1 118G 105G 14G 89% /run/media/davidtg/LSAvid-MC21 /dev/sde1 118G 11G 108G 9% /run/media/davidtg/LSAvid-MC12 davidtg@gezebel:~> ls -goh /dev/sd* brw-rw---- 1 8, 0 Sep 24 21:42 /dev/sda brw-rw---- 1 8, 1 Sep 24 21:42 /dev/sda1 brw-rw---- 1 8, 16 Sep 24 21:42 /dev/sdb brw-rw---- 1 8, 17 Sep 24 21:42 /dev/sdb1 brw-rw---- 1 8, 32 Sep 24 21:42 /dev/sdc brw-rw---- 1 8, 33 Sep 24 21:42 /dev/sdc1 brw-rw---- 1 8, 48 Oct 3 01:09 /dev/sdd brw-rw---- 1 8, 49 Oct 3 01:09 /dev/sdd1 brw-rw---- 1 8, 64 Oct 3 01:17 /dev/sde brw-rw---- 1 8, 65 Oct 3 01:17 /dev/sde1 brw-rw---- 1 8, 80 Sep 24 21:42 /dev/sdf brw-rw---- 1 8, 81 Sep 24 21:42 /dev/sdf1 brw-rw---- 1 8, 96 Sep 24 21:42 /dev/sdg brw-rw---- 1 8, 97 Sep 24 21:42 /dev/sdg1 brw-rw---- 1 8, 112 Oct 3 01:09 /dev/sdh brw-rw---- 1 8, 113 Oct 3 01:09 /dev/sdh1 brw-rw---- 1 8, 128 Oct 3 01:09 /dev/sdi brw-rw---- 1 8, 129 Oct 3 01:09 /dev/sdi1 brw-rw---- 1 8, 144 Sep 24 21:42 /dev/sdj brw-rw---- 1 8, 145 Sep 24 21:42 /dev/sdj1 brw-rw---- 1 8, 146 Oct 3 12:44 /dev/sdj2 brw-rw---- 1 8, 160 Oct 3 01:06 /dev/sdk plugged in right around the same time as all of the cards, but ... davidtg@gezebel:~> sudo parted /dev/sdk p free Error: /dev/sdk: unrecognised disk label Model: WD My Passport 0827 (scsi) Disk /dev/sdk: 2000GB Sector size (logical/physical): 512B/512B Partition Table: unknown Disk Flags: I guess the partition table is encrypted, too. % % -- % Cheers / Saludos, Thanks again! :-D -- David T-G See http://justpickone.org/davidtg/email/ See http://justpickone.org/davidtg/tofu.txt
On 2023-10-03 15:33, David T-G wrote:
Carlos, et al --
...and then Carlos E. R. said... % On 2023-10-03 15:05, David T-G wrote: % > % > A student of ours gave us a Western Digital disk so that we could deliver % > his files ... but it's an encrypted volume that only shows up as an 8M ... % % If it is LUKS, Linux knows about that and will ask for the password when the % desktop tries to mount it.
Doesn't seem that, then.
% % If it is some Windows thing, who knows. I'm guessing it is some WD % proprietary thing, and the 8MB open partition contains the windows setup % program.
Definitely seems that. Sorry that I forgot to include a listing:
davidtg@gezebel:~> ls -goh /run/media/davidtg/WD\ Unlocker/{,Extras/} '/run/media/davidtg/WD Unlocker/': total 2.0M drwxr-xr-x 3 272 Mar 22 2015 Extras drwxr-xr-x 22 1.2K Mar 14 2015 Locale -rwxrwxrwx 1 2.0M Mar 14 2015 'WD Drive Unlock.exe' -rwxrwxrwx 1 79 Nov 1 2011 autorun.inf
'/run/media/davidtg/WD Unlocker/Extras/': total 142K -rwxrwxrwx 1 216 Nov 4 2011 'Adobe Reader Download.lnk' -rwxrwxrwx 1 136K Mar 16 2015 Unlock.ico -rwxrwxrwx 1 443 Mar 22 2015 VCDVersion.xml drwxrwxrwx 2 248 Mar 13 2015 'WD SES Device Driver'
% % Do you see something there?
As there is an adobe reader download link, there must be some PDF somewhere.
I peeked in autorun.info but it simply points to the unlock icon file as well as the Win executable.
% % You could try: % % lsblk --output NAME,KNAME,RA,RM,RO,PARTFLAGS,SIZE,TYPE,FSTYPE,LABEL,PARTLABEL,PTTYPE,MOUNTPOINT,UUID,PARTUUID,WWN,MODEL,SERIAL,HCTL,ALIGNMENT % /dev/something
davidtg@gezebel:~> sudo lsblk --output NAME,KNAME,RA,RM,RO,PARTFLAGS,SIZE,TYPE,FSTYPE,LABEL,PARTLABEL,PTTYPE,MOUNTPOINT,UUID,PARTUUID,WWN,MODEL,SERIAL,HCTL,ALIGNMENT /dev/sr0 NAME KNAME RA RM RO PARTFLAGS SIZE TYPE FSTYPE LABEL PARTLABEL PTTYPE MOUNTPOINT UUID PARTUUID WWN MODEL SERIAL HCTL ALIGNMENT sr0 sr0 512 1 0 30M rom udf WD Unlocker mac /run/media/davidtg/WD Unlocker 550e29b200000000 Virtual_CD_0827 57584831453635334D553946 16:0:0:1 0
It is not /dev/sr0 You can try the same command, without specifying the device.
% % then "file -s /dev/something"
davidtg@gezebel:~> file -s /dev/sr0 /dev/sr0: Apple Driver Map, blocksize 2048, blockcount 2248802304, devtype 0, devid 0, driver count 0, contains[@0x200]: Apple Partition Map, map block count 2, start block 1, block count 63, name Apple, type Apple_partition_map, contains[@0x400]: Apple Partition Map, map block count 2, start block 7068, block count 10776, name DiscRecording 5.0.9d2, type Apple_HFS, valid, allocated, in use, readable, writable, pic boot code, mount at startup
I don't even see how to find the actual device!
Apple partition map? Hugh.
davidtg@gezebel:~> sudo dmesg | grep sr0 [703475.928979] sr 16:0:0:1: [sr0] scsi3-mmc drive: 51x/51x caddy [703475.929215] sr 16:0:0:1: Attached scsi CD-ROM sr0
dmesg --follow in a terminal, then plug in the thing.
I'm betting it's sdk
Filesystem Size Used Avail Use% Mounted on /dev/nvme0n1p1 32G 27G 2.9G 91% / /dev/nvme0n1p3 824G 819G 5.5G 100% /mnt/ssd /dev/sdf1 298G 296G 2.3G 100% /mnt/GIFTarch-278 /dev/sdc1 298G 297G 2.0G 100% /mnt/GIFTarch-431 /dev/sdb1 15T 13T 1.7T 89% /mnt/Av16Tusb3-67 /dev/sda1 3.7T 3.1T 652G 83% /mnt/hdd /dev/sdg1 19T 19T 20K 100% /mnt/WD20Tusb3 /dev/sdj2 233G 194G 39G 84% /run/media/davidtg/Seagate /dev/sr0 8.2M 8.2M 0 100% /run/media/davidtg/WD Unlocker /dev/sdh1 118G 110G 8.2G 94% /run/media/davidtg/LSAvid-MC14 /dev/sdd1 119G 108G 11G 91% /run/media/davidtg/LSAvid-TG48 /dev/sdi1 118G 105G 14G 89% /run/media/davidtg/LSAvid-MC21 /dev/sde1 118G 11G 108G 9% /run/media/davidtg/LSAvid-MC12 davidtg@gezebel:~> ls -goh /dev/sd* brw-rw---- 1 8, 0 Sep 24 21:42 /dev/sda brw-rw---- 1 8, 1 Sep 24 21:42 /dev/sda1 brw-rw---- 1 8, 16 Sep 24 21:42 /dev/sdb brw-rw---- 1 8, 17 Sep 24 21:42 /dev/sdb1 brw-rw---- 1 8, 32 Sep 24 21:42 /dev/sdc brw-rw---- 1 8, 33 Sep 24 21:42 /dev/sdc1 brw-rw---- 1 8, 48 Oct 3 01:09 /dev/sdd brw-rw---- 1 8, 49 Oct 3 01:09 /dev/sdd1 brw-rw---- 1 8, 64 Oct 3 01:17 /dev/sde brw-rw---- 1 8, 65 Oct 3 01:17 /dev/sde1 brw-rw---- 1 8, 80 Sep 24 21:42 /dev/sdf brw-rw---- 1 8, 81 Sep 24 21:42 /dev/sdf1 brw-rw---- 1 8, 96 Sep 24 21:42 /dev/sdg brw-rw---- 1 8, 97 Sep 24 21:42 /dev/sdg1 brw-rw---- 1 8, 112 Oct 3 01:09 /dev/sdh brw-rw---- 1 8, 113 Oct 3 01:09 /dev/sdh1 brw-rw---- 1 8, 128 Oct 3 01:09 /dev/sdi brw-rw---- 1 8, 129 Oct 3 01:09 /dev/sdi1 brw-rw---- 1 8, 144 Sep 24 21:42 /dev/sdj brw-rw---- 1 8, 145 Sep 24 21:42 /dev/sdj1 brw-rw---- 1 8, 146 Oct 3 12:44 /dev/sdj2 brw-rw---- 1 8, 160 Oct 3 01:06 /dev/sdk
plugged in right around the same time as all of the cards, but ...
davidtg@gezebel:~> sudo parted /dev/sdk p free Error: /dev/sdk: unrecognised disk label Model: WD My Passport 0827 (scsi) Disk /dev/sdk: 2000GB Sector size (logical/physical): 512B/512B Partition Table: unknown Disk Flags:
I guess the partition table is encrypted, too.
No, it is apple. :-( -- Cheers / Saludos, Carlos E. R. (from openSUSE 15.5 (Laicolasse))
Carlos, et al -- ...and then Carlos E. R. said... % On 2023-10-03 15:33, David T-G wrote: % > % > ...and then Carlos E. R. said... % > % On 2023-10-03 15:05, David T-G wrote: % > % > ... % > % proprietary thing, and the 8MB open partition contains the windows setup % > % program. % > % > Definitely seems that. Sorry that I forgot to include a listing: % > % > davidtg@gezebel:~> ls -goh /run/media/davidtg/WD\ Unlocker/{,Extras/} ... % > '/run/media/davidtg/WD Unlocker/Extras/': % > total 142K % > -rwxrwxrwx 1 216 Nov 4 2011 'Adobe Reader Download.lnk' ... % > % > davidtg@gezebel:~> sudo lsblk --output NAME,KNAME,RA,RM,RO,PARTFLAGS,SIZE,TYPE,FSTYPE,LABEL,PARTLABEL,PTTYPE,MOUNTPOINT,UUID,PARTUUID,WWN,MODEL,SERIAL,HCTL,ALIGNMENT /dev/sr0 % > NAME KNAME RA RM RO PARTFLAGS SIZE TYPE FSTYPE LABEL PARTLABEL PTTYPE MOUNTPOINT UUID PARTUUID WWN MODEL SERIAL HCTL ALIGNMENT % > sr0 sr0 512 1 0 30M rom udf WD Unlocker mac /run/media/davidtg/WD Unlocker 550e29b200000000 Virtual_CD_0827 57584831453635334D553946 16:0:0:1 0 % > % % It is not /dev/sr0 Yeah, not really :-) % % You can try the same command, without specifying the device. Ah! OK. Yeah, I do see sdk as a 1.8T disk, as suspeted. % % > % % > % then "file -s /dev/something" % > % > davidtg@gezebel:~> file -s /dev/sr0 % > /dev/sr0: Apple Driver Map, blocksize 2048, blockcount 2248802304, devtype 0, devid 0, driver count 0, contains[@0x200]: Apple Partition Map, map block count 2, start block 1, block count 63, name Apple, type Apple_partition_map, contains[@0x400]: Apple Partition Map, map block count 2, start block 7068, block count 10776, name DiscRecording 5.0.9d2, type Apple_HFS, valid, allocated, in use, readable, writable, pic boot code, mount at startup % > % > I don't even see how to find the actual device! % % Apple partition map? Hugh. % % > % > davidtg@gezebel:~> sudo dmesg | grep sr0 % > [703475.928979] sr 16:0:0:1: [sr0] scsi3-mmc drive: 51x/51x caddy % > [703475.929215] sr 16:0:0:1: Attached scsi CD-ROM sr0 % % dmesg --follow % % in a terminal, then plug in the thing. Thanks! I'll have to wait until I'm home for that, though. All of this is remote at the moment. % % > I'm betting it's sdk % > % > Filesystem Size Used Avail Use% Mounted on ... % > /dev/sr0 8.2M 8.2M 0 100% /run/media/davidtg/WD Unlocker ... % > davidtg@gezebel:~> ls -goh /dev/sd* ... % > brw-rw---- 1 8, 160 Oct 3 01:06 /dev/sdk % > % > plugged in right around the same time as all of the cards, but ... % > % > davidtg@gezebel:~> sudo parted /dev/sdk p free % > Error: /dev/sdk: unrecognised disk label % > Model: WD My Passport 0827 (scsi) % > Disk /dev/sdk: 2000GB % > Sector size (logical/physical): 512B/512B % > Partition Table: unknown % > Disk Flags: % > % > I guess the partition table is encrypted, too. % % No, it is apple. :-( Oho! Now that is interesting. Thanks for the catch. It isn't out of the question to plug it into the video editing iMac and see what comes up ... Stay tuned. % % -- % Cheers / Saludos, % Carlos E. R. Thanks again & HAND / que tenga buen dia :-D -- David T-G See http://justpickone.org/davidtg/email/ See http://justpickone.org/davidtg/tofu.txt
Hi again, all -- ...and then David T-G home said... % % ...and then Carlos E. R. said... % % On 2023-10-03 15:33, David T-G wrote: % % > % % > ...and then Carlos E. R. said... % % > % On 2023-10-03 15:05, David T-G wrote: % % > % > % ... % % > % proprietary thing, and the 8MB open partition contains the windows setup % % > % program. % % > % % > Definitely seems that. Sorry that I forgot to include a listing: % % > % % > davidtg@gezebel:~> ls -goh /run/media/davidtg/WD\ Unlocker/{,Extras/} ... % % % % dmesg --follow % % % % in a terminal, then plug in the thing. % % Thanks! I'll have to wait until I'm home for that, though. All of this % is remote at the moment. % % ... % % > % % > I guess the partition table is encrypted, too. % % % % No, it is apple. :-( % % Oho! Now that is interesting. Thanks for the catch. % % It isn't out of the question to plug it into the video editing iMac and % see what comes up ... % % Stay tuned. In the end, he just took it back and gave me another drive, so I never got to poke more at this. He did confirm, though, that he only plugged it into his Windows desktop at home, so it isn't really Apple. Maybe the WD developers like Macs ;-) Thanks again for the pointers. Still learned some new stuff, so it's a win! :-D -- David T-G See http://justpickone.org/davidtg/email/ See http://justpickone.org/davidtg/tofu.txt
Hi one more time, all -- ...and then David T-G home said... % % ...and then David T-G home said... % % % % ...and then Carlos E. R. said... % % % On 2023-10-03 15:33, David T-G wrote: % % % > % % % > ...and then Carlos E. R. said... % % % > % On 2023-10-03 15:05, David T-G wrote: % % % > % > % % ... % % % > % proprietary thing, and the 8MB open partition contains the windows setup % % % > % program. ... % % In the end, he just took it back and gave me another drive, so I never % got to poke more at this. He did confirm, though, that he only plugged % it into his Windows desktop at home, so it isn't really Apple. Maybe the % WD developers like Macs ;-) [snip] The little drive was full, so he banged around and finally remembered his password after remembering that, yes, it was encrypted, so he gave it back. I went for some more targeted googling and got a few hits. The short form is sudo python3 -m pip install --upgrade pip # 15.1 had 10.x instead of 21.x sudo zypper in python3-devel # for Python.h file sudo python3 -m pip install wdpass # magic :-) script # plug in drive here wdpass --unlock --mount # provide password as prompted and we're now shoveling data. Yay! Thanks again for the help and pointers :-) :-D -- David T-G See http://justpickone.org/davidtg/email/ See http://justpickone.org/davidtg/tofu.txt
On 2023-10-30 02:47, David T-G wrote:
Hi one more time, all --
...and then David T-G home said...
...
% In the end, he just took it back and gave me another drive, so I never % got to poke more at this. He did confirm, though, that he only plugged % it into his Windows desktop at home, so it isn't really Apple. Maybe the % WD developers like Macs ;-) [snip]
The little drive was full, so he banged around and finally remembered his password after remembering that, yes, it was encrypted, so he gave it back.
:-D
I went for some more targeted googling and got a few hits. The short form is
sudo python3 -m pip install --upgrade pip # 15.1 had 10.x instead of 21.x sudo zypper in python3-devel # for Python.h file sudo python3 -m pip install wdpass # magic :-) script # plug in drive here wdpass --unlock --mount # provide password as prompted
Interesting. Maybe we should have that little tool, or another, to the distro.
and we're now shoveling data. Yay!
Thanks again for the help and pointers :-)
:-D
:-) -- Cheers / Saludos, Carlos E. R. (from openSUSE 15.5 (Laicolasse))
participants (2)
-
Carlos E. R.
-
David T-G