My Book Duo

Maverickk · December 23, 2015, 10:31pm

DO NOT BUY A MY BOOK DUO. I have one and it has worked flawlessly, although there is one huge problem. The my book duos have a hardware encryption built into the circuit board in the enclosure. It is turned on by default and cannot be turned off. Sounds awesome right? Wrong. The encryption key for the AES-256 encryption is not provided to you and it cannot be found either. So if the circuit board fails on your enclosure you have no way to decrypt your backups on yours drives. Ohhh and simply placing the drives in a comparable enclosure does not solve the issue either

I am currently looking to get rid of mine and buy a better more effective raid enclosure. Also, WD has known about this issue for awhile and has yet to come out with either a firmware upgrade to reveal the encryption key or a way to turn off the encryption.

So I would think hard about purchasing this enclosure.

Trancer · December 24, 2015, 7:50pm

While I understand where you’re coming from, please keep in mind WD’s My Book drives are advertised for hardware encryption capabilities above any other feature. Revealing how encryption is handled would open the doors for encryption bypass and the units could no longer be advertised as secure. This is intentional design.

RAID 1 is a fault-tolerance method in case of an individual hard drive failure. It does not provide protection in case of controller failure or data corruption, regardless of encryption. A backup is still recommended.

Maverickk · December 29, 2015, 4:19am

Thank you Trancer. Yes the mybook duo does advertise hardware encryption, but none of the advertisements mention that this hardware encryption cannot be disabled nor can the encryption key be found.

Also, I contacted WD about this issue. The CSR mentioned that if the raid controller failed my data could be recovered by using a data recovery company or data recovery software. So my question is what is stopping a resourceful/knowledgeable criminal from circumventing WD’s hardware encryption by doing just what the CSR told me?

Consequently the CSR’s recommendation for how to recover my data not only reaffirms to me that WD does not care to solve this issue it also reaffirms to me that the hardware encryption is not as secure as you may think.