WD Passport - WD Sync

[mscotgrove]

I have a WD Passport drive that has lost many files.

The major problem I have is that the system uses something called WD
Sync that encrypts the files with 128 bit encryption - I think AES. I
have the password, and so would like guidance on how to decrypt the
files.

Any pointers or ideas would be appreciated.

Michael

 

[Arno Wagner]

I have a WD Passport drive that has lost many files.

The major problem I have is that the system uses something called WD
Sync that encrypts the files with 128 bit encryption - I think AES. I
have the password, and so would like guidance on how to decrypt the
files.

Any pointers or ideas would be appreciated.

Michael

Typically the password is not directly used, but a crypto-hash
is applied from it and the key formed from the result. In addition
a ''salt'' (nonsecret random value) and other information
can be mixed-in with the password. AES itself is standard,
and there are just 3 different key sizes: 128 bit,
192 bit and 256 bit. Unfortunately the way the key is
derived is not standard at all. Unless you can get this
product to decrypt for you or you get exact information on how
the key is derived, you will have to reverse-engineer the
software, a time-consuming and difficult process. In addition,
you have to find out the data-format used as well.

Incidentially, this is another argument against closed-source
software and data formats.

Arno

 

[mscotgrove]

Typically the password is not directly used, but a crypto-hash
is applied from it and the key formed from the result. In addition
a ''salt'' (nonsecret random value) and other information
can be mixed-in with the password. AES itself is standard,
and there are just 3 different key sizes: 128 bit,
192 bit and 256 bit. Unfortunately the way the key is
derived is not standard at all. Unless you can get this
product to decrypt for you or you get exact information on how
the key is derived, you will have to reverse-engineer the
software, a time-consuming and difficult process. In addition,
you have to find out the data-format used as well.

Incidentially, this is another argument against closed-source
software and data formats.

Arno

I rather feared this might be the answer. I am fairly certain it is a
128 bit key, from product documentation, and the fact that all files
are a multiple of 16 bytes long, plus 4 bytes which is the actual file
length. (AES will pad to a full 16 bytes).

My research implied that the AES routine is standard, but the
generation of the key from the password is very non standard, and as
you mention, a bit of salt does not help. You have unfortunately
confirmed my web research.

Unless anyone has any significant clues, I think this will have to be
a 'life is too short' problem.

Thanks

Michael

 

[johnsilver]

Hi

I would not waste time trying to crack AES it has never been broken before. However if you still have your password you can simply decrypt it by a program that uses the same algorithm and SALT as mentioned to recover your files.

The link below is to a tutorial to decrypt your files.

Data Recovery Tutorial

Full link:
http://prodir.synthasite.com/data-recovery-wd-sync-cruzer-sync-dmailer-sync.php