How to Recover Data from Western Digital My Book NAS Hard Drives

1108
Recover data from western digital drive

Recently, the topic of WD data recovery has gained urgency as many owners worldwide discovered that all of their files are missing. If you count yourself among them, then you’ve found the right article because you’ll soon learn how to recover data from a Western Digital external hard drive using readily available tools and easy-to-learn techniques.

Important: If you haven’t done so already, DISCONNECT your Western Digital My Book NAS hard drive from the internet before you continue reading this article to prevent additional data loss.

What Is My Book NAS Hard Drive?

My Book NAS Hard DriveThe Western Digital My Book is a network-attached storage (NAS) device that can be connected to a home router for convenient access to your files within and even outside the home network.

All My Book NAS hard drives feature built-in 256-bit AES hardware encryption to keep your content private and safe, and they’re ready to use out of the box with minimal configuration required.

My Book NAS hard drives are used by millions of people around the world, who trust them with their most important data, relying on their durability, shock tolerance, and long-term reliability. Still, even My Book NAS owners aren’t immune to data loss, so the topic of WD external hard drive data recovery is certainly a relevant one.

What Do We Know About the Recent Data Loss from WD Hard Drives?

Western Digital WD My Book Live

Any internet-connected device is a security concern, and network-attached storage devices are no exception.

Recently, many owners of Western Digital My Book NAS hard drives have discovered that their files are nowhere to be found. Even Western Digital initially had no idea what happened, but the company eventually determined that hackers exploited an unpatched security vulnerability, using it to factory reset some Western Digital My Book NAS hard drives.

Here are all products affected by the vulnerability:

Product SKU
My Book Live WDBACG0030HCH
My Book Live WDBACG0020HCH
My Book Live WDBACG0010HCH
My Book Live Duo WDBVHT0080JCH
My Book Live Duo WDBVHT0060JCH
My Book Live Duo WDBVHT0040JCH

According to the National Vulnerability Database (entry CVE-2018-18472), “Western Digital WD My Book Live and WD My Book Live Duo (all versions) have a root Remote Command Execution bug via shell metacharacters in the /api/1.0/rest/language_configuration language parameter. It can be triggered by anyone who knows the IP address of the affected device.”

Since there’s no patch available at the moment (and probably won’t ever be considering that the last firmware update was released in 2015), Western Digital is urging all users of My Book NAS hard drives to disconnect them from the network.

Unfortunately, a lot of damage has already been done, and there are many people who have lost terabytes of data.

Are the lost files gone for good? Not necessarily. As the log files posted online indicate, the My Book NAS hard drives were quick formatted:

“I have found this in user.log of this drive today:
Jun 23 15:14:05 My BookLive factoryRestore.sh: begin script:
Jun 23 15:14:05 My BookLive shutdown[24582]: shutting down for system reboot
Jun 23 16:02:26 My BookLive S15mountDataVolume.sh: begin script: start
Jun 23 16:02:29 My BookLive _: pkg: wd-nas
Jun 23 16:02:30 My BookLive _: pkg: networking-general
Jun 23 16:02:30 My BookLive _: pkg: apache-php-webdav
Jun 23 16:02:31 My BookLive _: pkg: date-time
Jun 23 16:02:31 My BookLive _: pkg: alerts
Jun 23 16:02:31 My BookLive logger: hostname=My BookLive
Jun 23 16:02:32 My BookLive _: pkg: admin-rest-api

As such, the lost files should still be in their original location, recoverable using Western Digital data recovery software. Continue reading this article to learn how to use Western Digital hard drive data recovery software to undo the damage caused by the hack.

How to Recover Data from WD NAS Hard Drives After Factory Reset

Let’s take a look at several common data loss scenarios and how to recover from them. Again, make sure to first disconnect your hard drive from the internet to prevent attackers from using the same exploit again.

Case 1: Recovering data from a single hard drive

To recover a single WD NAS hard drive that has been factory reset, you need to connect the hard drive to a computer and use a suitable data recovery software application to retrieve lost data from it.

For the purposes of this article, we’re using a data recovery software application called Disk Drill, which we selected because of its ease of use, great performance, and generous free trial version that lets you preview all recoverable files without paying.

Since the factory reset option wipes clean the entire file system, you won’t be able to retrieve files with their original names, so Disk Drill will automatically generate names based on available metadata or simply assign random names if no metadata is available.

Here’s how to recover lost data using Disk Drill from a single hard drive:

  1. Download and install Disk Drill on your computer.Install Disk Drill
  2. Connect the hard drive you want to recover.
  3. Launch Disk Drill and scan the hard drive.Scan your hard drive
  4. Select the files you want to recover.
  5. Click the Recover button and specify a suitable recovery destination.Select recovery destination

Case 2: Recovering data from RAID 1

Raid 1WD NAS hard drives support the RAID 1 configuration. In this configuration, the RAID controller duplicates all data from one hard drive to a second hard drive, effectively doubling your recovery chances.

The data recovery process is exactly the same as when recovering data from a single hard drive, except that you need to perform it twice in total. You can learn more about RAID recovery in our previous article on the subject.

You can then use a diff tool like Meld to see the differences between two sets of recovered files, or you can simply copy files from one recovery folder to the other one and skip duplicate files.

Case 3: Recovering data from RAID 0/5/10

In addition to RAID 1 configuration, some users of WD NAS hard drives use the RAID 0/5/10 configuration to increase performance by striping data across multiple drives.

For the best recovery results, we recommend you use R-Studio, a professional data recovery software tool with an advanced RAID reconstruction module capable of recreating a damaged RAID array from its components and processing it just like a real one.

R-Studio supports standard RAID levels (0, 1, 4, 5, 6), as well as non-standard RAID levels (10(1+0), 1E, 5E, 5EE, 6E).

Follow the steps below to recover data from RAID 0/5/10 with R-Studio:

  1. Download and install R-Studio on your computer.Install R-Studio
  2. Connect the RAID array you want to recover.
  3. Launch R-Studio and scan the RAID array.scan the RAID array
  4. Select all files you want to recover.
  5. Click the Recover or Recover Marked button and specify recover options.specify recover options

Case 4: Recovering data from other external storage devices

other storage devices

While the recent hack has affected only My Book Live devices, there are many other causes of data loss that can make important files disappear from any external storage device.

The good news is that you can recover data from a WD My Passport external hard drive or any other external storage device, regardless of whether it uses FAT/FAT32, NTFS, or HFS+ file system, using the same tools and techniques we’ve described earlier in this article.

Conclusion

Despite their great reputation, Western Digital hard drives are not immune to data loss. In addition to physical failure, their owners now have one more thing to worry about: remote cyber attacks. That’s why it’s more important than ever to know how to recover data from Western Digital external hard drives using the techniques described in this article, namely data recovery software.

Of course, you also need to take the necessary steps to prevent data loss from occurring in the first place, such as regularly backing up your data and using antivirus and firewall to keep cyber threats at bay.