Mounting PHYSICAL disk removed from WD My Cloud Home on Linux computer

Hi guys,

sorry to bother you if the solution is already published, I tried to google this for days.

Here is the deal:
My neighbour lost his login/password and he needs to access some old documents. I removed the disks from his three devices (2 My Cloud Home 4TB and 1 My Cloud 2TB) and mounted them on a Linux machine. This is what I find:

parted -l

Model: WDC WD20 EFRX-68EUZN0 (scsi)
Disk /dev/sdb: 2000GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
**Disk Flags: **
Number Start End Size File system Name Flags
1 17.4kB 1049kB 1031kB FW_TABLE msftdata
2 1049kB 34.6MB 33.6MB KERNEL_A msftdata
3 34.6MB 68.2MB 33.6MB ROOTFS_A msftdata
4 68.2MB 102MB 33.6MB ROOTFS_B msftdata
5 102MB 103MB 1049kB FDT_A msftdata
6 103MB 104MB 1049kB FDT_B msftdata
7 104MB 108MB 4194kB AFW_A msftdata
8 108MB 142MB 33.6MB KERNEL_B msftdata
9 142MB 175MB 33.6MB ROOTFS_GOLD msftdata
10 175MB 176MB 1049kB FDT_GOLD msftdata
11 176MB 180MB 4194kB AFW_B msftdata
12 180MB 181MB 1049kB BOOTCODE32 msftdata
13 181MB 182MB 1049kB BOOTCODE64 msftdata
14 182MB 184MB 1049kB BL31 msftdata
15 184MB 185MB 1049kB BL32 msftdata
16 185MB 218MB 33.6MB KERNEL_GOLD msftdata
17 218MB 222MB 4194kB AFW_GOLD msftdata
18 222MB 256MB 33.6MB fat32 CONFIG msftdata
19 256MB 1095MB 839MB ext4 SYSTEM_A msftdata
20 1095MB 1934MB 839MB SYSTEM_B msftdata
21 1934MB 2772MB 839MB ext4 CACHE msftdata
22 2772MB 4920MB 2147MB ext4 DATA msftdata
23 4920MB 7067MB 2147MB linux-swap(v1) SWAP msftdata
24 7067MB 2000GB 1993GB ext4 DISKVOLUME1 msftdata ← probably interesting?

mount /dev/sdb24 /media/usb

du -h -d 1 /media/usb/
45M /media/usb/restsdk
23M /media/usb/logs
24K /media/usb/backups
47M /media/usb/debug_logs
43M /media/usb/data
4.0K /media/usb/fwupdate
8.0K /media/usb/samba
305M /media/usb/kars ← probably interesting?
460M /media/usb/

ls -la /media/usb/kars/

total 311308
drwx------. 2 root valle 4096 Jan 1 2014 .
drwxr-xr-x. 10 root root 4096 Jan 1 2014 …
-rw-------. 1 root valle 318767104 Jan 1 2014 com.wd.otaclient ← how to go further?

My guess is that the file com.wd.otaclient is an image file containing the actual data, but how to mount that and what file system? I really hope it is not encrypted.

Best regards,

Valle

Valle,

This is probably too late to be of much help, but I was going through a similar experiment this evening. The only way I was able to locate the data was to mount the /sdb24 partition.

I then used the disk usage utility to see where the largest use was for the disk but you will want to run as root. ‘du /media/usb|sort -n’. The larger folder structures will be at the bottom of the list. You may notice that some of the entries appear to be tabbed over… Copy one of those lines tabs and all and ‘cd’ to that directory as root. The file names will be encrypted, but the content does not appear to be so. I was able to recover a lot of .jpg and raw images this way. The directory structure breaks the files apart into data/a-z folders … it will take some digging.

-Casey

I fouund a link to this in another post here so don’t deserve the credit but…

which links to the script itself on github.

I confess I have not tried it myself though! As per its comments, you need a Linux PC and Python3.6 though I would imagine it would also work on a BSD (perhaps needing tweaks).