How to Recover Data from Hacked WD MyBook Live?

Several users have reported a remote hacking attack on their Internet-connected MBL devices, resulting in device reset and seemingly permanent data loss. The hackers exploited a remote command execution flaw in WD MyBook Live® (MBL) to trigger the factory reset of these network-attached storage devices, resulting in complete data loss.

However, there is no need to worry if you use a WD MyBook Live device and have lost data due to the malicious attacks. You can efficiently recover your lost data – images, documents, and other files, etc.

Read this blog to understand the root cause of this problem and the available solutions, including the approach and “how to” steps, to recover data from hacked WD MyBook Live devices.

WD MBL Hacking: Overview & Root Cause

Data Recovery Options for WD MBL

How to Recover Data from Hacked MBL

Supported MyBook Live SKUs

WD MyBook Live Hacking Attacks– Overview & Root Cause

As per Western Digital official release, the My Book Live and My Book Live Duo devices were attacked remotely by hackers while the devices were connected to the Internet. The hackers had found a way to exploit a command injection vulnerability in the device, thereby resetting them and causing complete data loss.

Several users have reported that these attacks have caused substantial data loss, as there was no data in the devices when checked later. Additionally, the users haven’t been able to log in to the compromised devices, as they are getting an “invalid password” error message

.

According to the WD official advisory, a review of the log files taken from some of these affected devices reveal that the attackers had directly connected to the affected MyBook Live devices from various IP addresses across different countries.

They had installed a malicious binary (Linux ELF binary (Trojan) compiled for the PowerPC architecture used by these devices) to reset the device. Reportedly, these MyBook Live storage devices have been wiped and reformatted with the Ext4 file system.

Data Recovery Options for Hacked WD MBL Devices

Irrespective of factory reset or device formatting, you can recover your data from the hacked WD MyBook Live devices.

You can seek free technical assistance from Stellar to retrieve the lost data or use a powerful DIY Professional data recovery software called Stellar Data Recovery Professional, which supports data recovery from devices having EXT2/3/4 file systems. Notably, the hacked MBL devices were reformatted with EXT4 file system.

How to Recover Data from Hacked WD MyBook Live (MBL) Using Software

WD MyBook Live® is a network-attached storage (NAS) device having the hard drive inside a metallic enclosure. You may have two hard drives if you are using a MyBook Live Duo device.

The device cannot connect with a Windows PC directly, and therefore, you need to remove the drive(s) from the enclosure to connect them to a host system for data recovery. Following are the steps in two parts A & B:

Part A: Remove MyBook Live Hard Drive & Connect It to a PC

• Disconnect the MBL device from the Internet
• Switch OFF the device and remove the power cables.
• Next, use a plastic pry opening tool to unhinge the clips on the front edges.

• Next, carefully separate the back cover clips from the device chassis using a screwdriver
• Hold the cover carefully. Separate the front from the chassis by gently sliding it off.

• Afterward, gently pull the plastic LED extension (plastic insert) from the front of the MyBook Live device.

• Next, separate the metal board from the rubber padding to remove it from the chassis.

• Unscrew the metallic board and take out the hard drive from it.

• Finally, use a SATA or USB adaptor to connect the hard drive to a Windows PC or laptop.

For detailed instructions, please watch this video:

Next, proceed with the data recovery steps using Stellar Data Recovery Professional Edition, as follows:

Part B: Recover Data from WD MyBook Live Using Stellar Data Recovery Professional

After connecting the hard drive to your Windows PC, download a free trial of Stellar Data Recovery Professional. It is an advanced data recovery software for NTFS, FAT, exFAT, Ext2, Ext3, & Ext4 file systems. The software can recover data from formatted, corrupted, lost, or inaccessible storage drives & partitions and fully supports WD MyBook Live devices. [View the full list of supported MBL SKUs]

Steps to recover data from factory reset or hacked WD MyBook devices:

• Connect the WD MyBook Live hard drive to a Windows PC using the steps described earlier.
• Download and run Stellar Data Recovery Professional software on the system.
• Select ‘All Data’ or the specific type of files you wish to recover. Click Next.

• On the ‘Recover From’ screen, choose the WD MyBook Live hard drive shown among the Connected Drives and click Scan.  

• The software will begin scanning the MBL drive and display the recoverable files on the preview screen.

• Preview the files by clicking on them. You will view the details like actual image, video, etc., on the main screen
• Next, click Recover to recover and save the files.
• Click Browse to choose a storage location and then click Start-Saving to save the recovered files.

Caution: Do not choose the same storage drive or location to save the recoverable files. This could overwrite the existing data, resulting in permanent loss. You need to choose a different location or storage device to save the recovered data.

A Note on Data Recovery for Mac Users

If you use a Mac system, you can download Stellar Data Recovery Professional software for Mac and recover the data using the steps described earlier.

Alternatively, you can download a free trial of Stellar Photo Recovery software for Mac and attempt recovery of images and videos lost after hacking and factory resetting of your WD MyBook Live device.

A few Mac users have reported that they could successfully recover their lost photos from MyBook Live using Stellar Photo Recovery.

Supported MyBook Live SKUs

The methods described in this post can recover data from following SKUs of Western Digital MyBook Live and MyBook Live Duo devices.

Final Thoughts

Instantly disconnect your WD MyBook Live® and MyBook Live Duo® devices from the Internet to prevent further hacking attacks and data loss incidents. We recommend seeking expert technical assistance to maximize the data recovery from hacked MyBook Live devices. Alternatively, you can use a powerful DIY data recovery tool such as Stellar Data Recovery Professional to recover your data from a factory reset MBL. The software recovers data from MBL devices having the EXT4 file system, and you can use the tool on Windows PC and Mac systems.

Was this article helpful?

YES0

NO

About The Author

Satyeshu Kumar

Satyeshu is a Windows blogger and data recovery expert. He is having good technical knowledge and experience in Windows data recovery. He writes about latest technical tips, Windows issues and tutorials.