Return to Level1Techs.com

Help decrypting WD Mybook drive

can anyone give me a step by step guide on installing and using this, I’m not a wizard with linux and it will take 5 hours plus to get this working not 5 minutes with the lack of information available for this

1 Like

@AnotherDev perhaps you would be so kind as to help this poor soul get Go installed on his linux install?

@TheRabidTech after you get Go set up you should be able to just use the information contained in the github page to do what you need to.

EDIT: see below

What Distro are you using? you need install Go itself first and then run this command, if we know what distro you use we can give you more detail on how to install.

go get github.com/andlabs/reallymine

According to github, it should be installed after that and then the instructions on how to use are there

actually I just saw under the releases tab of github is precompiled binaries so you dont even need to install Go

download reallymine-linux-amd64 from here

open a terminal
cd /home/YOUR USER NAME HERE/Downloads
chmod +x reallymine-linux-amd64
mv reallymine-linux-amd64 reallymine
now you should be able to use the program as intended

1 Like

lubuntu, have moved already moved to home folder.
chmod a+x reallymine-linux-amd64
sudo apt install reallymine-linux-amd64

after reading the package reports unable to find the file
best advise i can find with that is update my packages, that’s currently in progress

you dont need to install anything. you just do ./reallymine-linux-amd64 to run binaries.

The beauty of Go is it is a static, compiled language so you don’t need the tools or source code on your computer :nerd_face: :go: – WTF we don’t have a Go emoji?

I also kind of wanted to converse with the original poster @d0rk about the usage of reallymine, that’s why I asked my question on his previous post rather than starting a new thread.

Give me a few to look through it and I’ll help you with that.

without previous experience decrypting WD hard drives you won’t be able to, that’s why I wanted to talk to the guy that originally posted about reallymine because he has experience using it, closing the previous thread and splitting my question into a new thread was seriously not helpful, can we delete this thread and reopen his old thread so we can have a discussion about the usage flowing on from his original post for myself and others learning to use it to benefit from.

It actually is quite helpful. This is the way we do things here because we found it to be most effective. We can discuss the nuances privately if you desire.

Tagging the OP like you just did was good, however, they haven’t logged in for over 4 months so that may be hit or miss.

@Dynamic_Gravity I’ve been logging in, just not posting. I’m still lurking.

@TheRabidTech
I haven’t ran reallymine in about a year if memory serves.

The instructions on github were fairly straightforward to get reallymine up and running.

just as a quick rundown, on ubuntu 18.04.4 (current LTS) opening a terminal and running the following should get you up and running (I just used the stuff below to get reallymine running on my work laptop)

sudo apt-get install golang
mkdir .gopath
export GOPATH=$HOME/.gopath 
go get github.com/andlabs/reallymine
cd .gopath 
cd bin 
./reallymine

that should display program help for reallymine, then comes the important bit actually running it.

sudo ./reallymine decrypt /dev/sdx /path/to/decrypted.img

/dev/sdx being the encrypted drive you are reading from.

there is one gotcha to reallymine that is somewhat annoying, it will not overwrite an existing file so you cannot directly decrypt from one drive to another.
sudo ./reallymine decrypt /dev/sdx /dev/sdy
will display an error message that /dev/sdy already exists.

one reallymine finishes, you can write the image ato a disk using DD.

sudo dd if=/path/to/decrypted.img of=/dev/sdx

one note, dd doesn’t display progress, you may want to install gddrescue (sudo apt-get install gddrescue) it shows progress,etc, and a nice byte preview of the data being copied

“sudo ddrescue -P -f /path/to/decrypted.img /dev/sdx”

If you’re working with a drive that is beginning to fail, has bad sectors, smart warnings, it may be worthwhile to use ddrescue or safecopy to copy the contents of the drive to known good drive before running reallymine.

3 Likes
status=progress
3 Likes

that is legitimately handy to know. I’ve actually been using another utility called progress that watches the progress of various utilities to monitor DD.

I’ll have several panes in termux running dd to scrub drives for reuse, and then one pane with progress running to watch all of them along with the cp jobs for simple file transfers for customer data.

for general purpose drive copy stuff i prefer ddrescue (preview window starts scrolling zeros - we’ve probably passed the data and can kill it, plus an actua ETA counter) but for the more niche weird applications dd seems more flexible. dd is nice because its almost guaranteed to be there out of the box on most distros.

I’m just gonna merge this reply into this message to avoid double posting
@AnotherDev
I don’t know a whole lot about Go, but what little bit i have seen is impressive.

it seems to be about as powerful/flexible as C, but requires less hand hacking and babysitting, and i’d assume a standard library that makes all the C stuff look like cave paintings.

thanks d0rk I’ve been trying
sudo ./reallymine decrypt /dev/sdb /dev/sdc1/decrypted.img
but it always reports error not a directory or error is a directory if I don’t specify image file name.
any other command I try reports I/O error
I saw another guy report this as his problem but the only answer i see in that forum is someone explaining decrypting to a NTFS volume is the cause of really slow transfer speed, nobody addressed the errors he was getting the same as mine, he got passed it though just not from an answer in that forum

@TheRabidTech
You do have to specify an image name for output.

if the drive you’re copying is /dev/sdb and you’ve got sufficient space (the entire size of /dev/sdb)
mounted at /mnt/scratch/ you would run

sudo ./reallymine decrypt /dev/sdb /mnt/scratch/decrypted.img

it sounds like person who’s post you were reading that was getting a error:not a directory was trying to write directly to a drive like /dev/sdc which is not a valid path (its a special file)
and you were getting the error:is a directory because you weren’t specifying an output filename, just a path.
its annoying in ways, but i understand why they designed it to work that way, its a saftey feature to prevent you from potentially overwriting other data, or overwriting the source drive and permanently losing the data.

however, getting I/O errors leads me to believe you’ve got a drive that’s failing, on top of being encrypted.
Even if the drive is encrypted, you should be able to copy the encrypted data to another drive.

if you’ve tried to use dd to copy the drive to another and its giving you I/O errors, its proabably time to find someone with a cleanroom to do a platter or controller swap then come back to reallymine.

I do wanna make sure we’re not making any assumptions, so please don’t be offended for me asking: You are working with a bare WD SATA drive that has been removed from its original mybook enclosure correct? Some people call it shucking.

The sata to usb controller board that also did the encryption is typically failed long before the drive in the enclosure did.

/dev/sdc1/ is a 2TB volume and /dev/sdb/ is a 1TB volume I’m trying to decrypt

I specified /dev/sdc1/decrypted.img that’s a valid file specified isn’t it, that is what reports “is not a directory”

It’s a WD10SDZW-11UMGS0 it is a native USB controller board on the bottom, no interface to be removed

Glad I could help! This only works with versions of GNU Coreutils >= 8.24.

Sauce:

1 Like

/dev/sdc1 isn’t a directory, it is the first partition on the third hard drive the sata controller detected. you’re essentially pointing to a device node, the drive has to be mounted to be usable.

If you’re more familiar with windows, instead of giving it a drive letter of where you wanted to save the data, you gave it the device id string from device manager (not exactly)

Format dev sdc1 if it hasn’t been and then mount it.
being that it is already partitioned, you probably formatted it as well.

If you’re not sure, the following “should” work.

sudo mkdir /mnt/scratch 
sudo mount /dev/sdc1 /mnt/scratch/ 

then run

sudo ./reallymine decrypt /dev/sdb /mnt/scratch/decrypted.img

i hate those 2.5" little gremlins. i think the usb cables for them tend to be crappy, or the drive itself runs really close to the spec for usb power draw and they fail prematurely due to being starved for power. :frowning_face:

Good luck

yeah i was just looking up compatible SATA boards just in case it comes to that, hopefully not,
And thanks I’m sure i mounted the 2TB destination drive but not with console commands, using the disk manager thing in lubuntu, I’ll go check what I’m doing and mount it the way you specified