How to create an image of my hard drive?

Langtang

Having fallen victim to the Western Digital MyBookLive attack in June

https://community.wd.com/t/help-all-data-in-mybook-live-gone-and-owner-password-unknown/268111

I'm now faced with sending my drives back to the US for the files to be recovered. Downside is, they're not going to send the drives back to me afterwards - whether they recover files or not.

Before I do so, I'd like to try and create an image (or images) of the drive(s) to see if I can somehow recover the files myself at some point - and also to have copies of the drives.

 The MyBookLive Duo is 6Tb (2 x 3Tb drives) and, according to the control panel, I have used 3Tb out of a total of 6Tb. The drives are not in any type of Raid array, so I assume I'd need to image both drives as I'm not sure if it is exactly 3Tb or just above (or below) that (but let's say it is below, would I only need to image one drive or would the data be spread across both drives?)

How do I go about creating images of drives? I'd need to buy 2 new drives first (not WD!!!), but should i get internal or external ones?

Any help would be very much appreciated.

[Deleted User]

So I thought that the system was totally reset after the malware - when you say 3TB is used out of the 6TB - can you actually see any data at all or was that before the reset?

Out of the box they are spanned drives (JBOD) so not RAID 0 or 1 - I assume it was like this before the malware reset it? Did you have it as mirrored (RAID 1) before the reset?

If that is the case that they were just spanned, you still can't guarantee that all the data was on one of the drives just because 3TB was used, Linux has a healthy way of distributing files to prevent fragmentation that would mean it could be on either of the drives.

So you will need to buy 2x 3TB internal drives to do a proper recovery:

Personally I have one of these devices to clone drives:

https://www.amazon.co.uk/gp/product/B08291CB6J

Remove one drive from the MyBookLive, slot it into number 1 on the above device and a fresh 3TB internal (or bigger) in number 2 and press the clone button. It doesn't need to be connected to a PC to do a clone. It could take several hours but the progress lights tell you when it has finished.

Repeat for the second drive with and another fresh drive in number 2. Label them up as you go so you don't get confused.

The clone device then also doubles up as a "caddy" so you can connect to your PC / laptop via USB and use recovery tools to attempt to retrieve the data so you can then insert both of your clones into it and commence recovery.

When you get to recovery stage, come back here for some more advice. They are Linux formatted drives so you will need a bit of technical know-how but I guess you will only do that if WD don't manage to recover anything.

Given that it will cost you around £140 to buy 2x 3TB drives, think of a strategy about what you do with them.

1. You can re-sell them for a good price when you are done because you will be able to show the SMART data with very little usage so keep all original packaging. If so just buy the cheapest you can find to start with.

2. You could decide to make your own NAS drive from them and insert them in a Synology / QNAP / Asustor 2 bay NAS so if you do, think about buying proper NAS drives such as Seagate Ironwolf.

EDIT: Deleted my original comment - misread your post and got it all wrong!

Langtang

So I thought that the system was totally reset after the malware...

From what I have been reading on the WD boards, it seems to have been a gentle wipe (I know there's no such term) of the drives. I sent the logs off to WD and they say they'll give recovery a go.

...when you say 3TB is used out of the 6TB - can you actually see any data at all or was that before the reset?

I can still log into the control panel of the NAS, and that's where I can see 3Tb (exactly, not 2.9 or 3.1) of 6 have been used. When I then look into the main folders, that were all created on June 24th - the date of the attack - they are all empty.

Out of the box they are spanned drives (JBOD) so not RAID 0 or 1 - I assume it was like this before the malware reset it? Did you have it as mirrored (RAID 1) before the reset?.

Yes, I just used the NAS "as is" right out of the box. When I bought it I, naively, purchased it as 6Tb of storage rather than 3Tb in RAID. It's never been altered from then until now.

So you will need to buy 2x 3TB internal drives to do a proper recovery:

Personally I have one of these devices to clone drives:

https://www.amazon.co.uk/gp/product/B08291CB6J 

Thanks, that's a great deal. I've ordered it now. I have a similar at home (Icy box), albeit just for one drive,  so am familiar with the concept. I've kept most of my older drives, so this is used to access them via the USB connection.

I will look at drives shortly.

Remove one drive from the MyBookLive, slot it into number 1 on the above device and a fresh 3TB internal (or bigger) in number 2 and press the clone button. It doesn't need to be connected to a PC to do a clone. It could take several hours but the progress lights tell you when it has finished.

Repeat for the second drive with and another fresh drive in number 2. Label them up as you go so you don't get confused.

Brilliant, thanks so much for the link. Struggling to open it at work, but that may be overcome at home.

The clone device then also doubles up as a "caddy" so you can connect to your PC / laptop via USB and use recovery tools to attempt to retrieve the data so you can then insert both of your clones into it and commence recovery.

When you get to recovery stage, come back here for some more advice. They are Linux formatted drives so you will need a bit of technical know-how but I guess you will only do that if WD don't manage to recover anything.

Excellent, I'll get back to you once I've completed the cloning. From what I'm hearing, they're managing to retrieve all the small files, docs, photos, pdf etc. but are struggling with anything larger on unorthodox. I've got a lot of high resolution music files on the drive, some as much as 1Gb in size, so I'm not holding out much hope of getting those back.

Deleted_User said:

Given that it will cost you around £140 to buy 2x 3TB drives, think of a strategy about what you do with them.

I can easily find a use for them. I am a music collector, live music in particular (people go to gigs, record them, and we swap and share them online) I had a huge collection of these on the NAS. I'd been slowly backing these shows up onto Blu Ray disc but hadn't finished. One artist in particular, Neil Young, I have an as-complete-as-you-can-get collection spanning 1960's to the present day. I'd backed up the 1960's right up to 1994, but1996 to the present day were on the drive. I can download a lot of these again from the likes of dimeadozen, traders den etc. but a lot of them will be irreplaceable (mainly videos) Hey, ho...

Deleted_User said:

2. You could decide to make your own NAS drive from them and insert them in a Synology / QNAP / Asustor 2 bay NAS so if you do, think about buying proper NAS drives such as Seagate Ironwolf.

I'd be interested in doing this. If I did but those Ironwolf drives, and decided to just use them to replace my internal 2Tb drives in my PC, could I do that - or are these specifically for NAS' only? For the uplift in cost from the £75 ones that might be worth it.

The price varies (drastically) for those ironwolf one: (MSE content!!)


https://www.broadbandbuyer.com/products/31301-seagate-st4000vn008-4hdd/ 

https://www.ebuyer.com/758036-seagate-ironwolf-4tb-3-5-nas-hard-drive-st4000vn008?utm 


Wow! you've been really helpful, I can only thank you. Very much.

Laz123

What I do which may help you in the future is I use Macrium Relect which is a free image/cloning program. It's a great bit of kit and has got me out of the mire a few times. I image my 'c' drive once a week and keep it on an external hdd. If I can't boot for any reason I reinstall the backup.

ann_droid

Hi

Clue in the name, and it is a Lo-Cost/No-Cost option.

clonezilla.org

Langtang

[Deleted User] said:

So you will need to buy 2x 3TB internal drives to do a proper recovery:

Just purchased 2 x 4Tb ironwolf drives from ebuyer. Arrive Monday. I'll let you know when I'm ready for your next installment ;-)

Langtang

ann_droid said:

Hi

Clue in the name, and it is a Lo-Cost/No-Cost option.

clonezilla.org

Thank you for the link, I will check it out. 

Langtang

Laz123 said:

What I do which may help you in the future is I use Macrium Relect which is a free image/cloning program. It's a great bit of kit and has got me out of the mire a few times. I image my 'c' drive once a week and keep it on an external hdd. If I can't boot for any reason I reinstall the backup.

Thanks for the advice. I really do need to get on top of backing up. I do back up windows, using the built-in service but don’t really do anything other than that. I take more care of my music collection than I do of my personal files. Which is a bit sad….

[Deleted User]

Laz123 said:

What I do which may help you in the future is I use Macrium Relect which is a free image/cloning program. It's a great bit of kit and has got me out of the mire a few times. I image my 'c' drive once a week and keep it on an external hdd. If I can't boot for any reason I reinstall the backup.

Do you keep multiple versions of this image or just the current one?

The reason I ask is that I wouldn't consider a drive image to be a backup. If you have deleted a file or a file has become corrupted and you haven't yet realised when you take the image of you c drive then you will then over-write the backup copy.

Worst case some ransomware encrypts your data files in the background without you noticing and then you make a copy of the ransomed files to backup.

a

ann_droid said:

Hi

Clue in the name, and it is a Lo-Cost/No-Cost option.

clonezilla.org

Tried Rescuezilla or redorescue? RedoRescue has been my choice, because it can backup to ftp, and you can get  single exe windows files which run up an ftp server for a quick backup with no usb connection needed and easy to backup a linux box from bare metal

Langtang

[Deleted User] said:

Personally I have one of these devices to clone drives:

https://www.amazon.co.uk/gp/product/B08291CB6J

Remove one drive from the MyBookLive, slot it into number 1 on the above device and a fresh 3TB internal (or bigger) in number 2 and press the clone button. It doesn't need to be connected to a PC to do a clone. It could take several hours but the progress lights tell you when it has finished.

Repeat for the second drive with and another fresh drive in number 2. Label them up as you go so you don't get confused.

I'm trying to clone the drives just now. All 3 blue lights are flashing at the same time. It's been running for 6 hours, and they're all still flashing. how long would a normal cloning process take on a 3TB drive? Does it make a difference that I bought 4TB drives, rather than 3TB ones?