Hacking wfsdump - PC util for dumping WFS devices (WiiU File System)

Drak

Active Member
Newcomer
Joined
Oct 29, 2007
Messages
41
Trophies
0
Website
Visit site
XP
296
Country
Canada
Have you formatted the drive? Have you formatted the console after you used that drive on it for the last time?

The only thing I did was to format a new drive with the console. The old one was not formatted. Here's the full story:

I tried making a backup data from my WIIU external hard drive. While the WIIU was closed, I unplugged my external hard drive and plugged it in my computer. I saw that Windows wasn't detecting it (Windows 10).

So I tried plugging it in my second laptop (Windows 7). Still no pop-ups and it didn't seem to detect the drive. So I went to disk management and I saw the drive as "unallocated". So I didn't want to touch it. I didn't format it. I didn't do anything.

When I plugged it back to WIIU to see if I could do another form of backup, it wasn't detected either. I actually had a pop-up that asked me if I wanted to format the drive to be compatible with the WIIU. I pressed cancel or no and closed down the console. I'm supposing my second computer automatically did something do the hard drive so it lost the link with the WIIU.
 

piratesephiroth

I wish I could read
Member
Joined
Sep 5, 2013
Messages
3,453
Trophies
2
Age
103
XP
3,233
Country
Brazil
The only thing I did was to format a new drive with the console. The old one was not formatted. Here's the full story:

I tried making a backup data from my WIIU external hard drive. While the WIIU was closed, I unplugged my external hard drive and plugged it in my computer. I saw that Windows wasn't detecting it (Windows 10).

So I tried plugging it in my second laptop (Windows 7). Still no pop-ups and it didn't seem to detect the drive. So I went to disk management and I saw the drive as "unallocated". So I didn't want to touch it. I didn't format it. I didn't do anything.

When I plugged it back to WIIU to see if I could do another form of backup, it wasn't detected either. I actually had a pop-up that asked me if I wanted to format the drive to be compatible with the WIIU. I pressed cancel or no and closed down the console. I'm supposing my second computer automatically did something do the hard drive so it lost the link with the WIIU.
Then I can only conclude that there's' some problem with the drive. If you connect a WII U-formatted drive to any Windows computer, it will detect it and ask if you want to format it.
 

Drak

Active Member
Newcomer
Joined
Oct 29, 2007
Messages
41
Trophies
0
Website
Visit site
XP
296
Country
Canada
Then I can only conclude that there's' some problem with the drive. If you connect a WII U-formatted drive to any Windows computer, it will detect it and ask if you want to format it.

Well now it is viewable in the disk management but the space is "unallocated". Isn't it suppose to still work? Can't I do something to fix that?
 

piratesephiroth

I wish I could read
Member
Joined
Sep 5, 2013
Messages
3,453
Trophies
2
Age
103
XP
3,233
Country
Brazil
Well now it is viewable in the disk management but the space is "unallocated". Isn't it suppose to still work? Can't I do something to fix that?
If it still had the contents your Wii U (if you haven't formatted the console after using the drive for the last time) would have read it fine. It either lost all the data or it got severely corrupted.
 

Cyan

GBATemp's lurking knight
Former Staff
Joined
Oct 27, 2002
Messages
23,749
Trophies
4
Age
45
Location
Engine room, learning
XP
15,649
Country
France
If you connect the drive to WiiU and it asks to format, it means your sector 0 has a partition table (or at least a partition table signature).
it would be very very unlucky that the WiiU sector 0's information contains exactly the signature (0x55AA) at the wrong place and ask to format it thinking it's not already in WiiU format.
But as it happened only after you plugged it to windows, I suspect windows regenerated a partition table with no partition defined.

Why did windows edited your drive without your consent is unknown (and strange), but maybe it's possible.

what I'd recommend is make a dump of sector 0 (for example with HxD, dump first 512bytes of the hdd, or just take a screenshot and post here) so we can analyze it and tell you if it indeed got replaced or not.
To me, you got your sector 0 replaced (or it got corrupt for unknown reason if not replaced with a partition table)

What I suggested in the other thread :
- format another drive, with the same physical size
- make a full image backup of your non working drive (for backup/restore possibility)
- dump sector 0 of working drive
- replace bad sector 0 with extracted one from working drive

I don't know what the first sector contains, so maybe it will not work if it has any file system data on it, but if it only specify the available size and some cryptographic info maybe it can work?
No idea either if formatting another drive uses the same crypto key. I think the HDD key is the same until you format your console.
in another thread I've read the first 64bytes contains the file system info, so replacing the full sector 0 might not work.
EyeKey would know better than me.
 
Last edited by Cyan,

tivu100

Well-Known Member
Member
Joined
Jun 6, 2015
Messages
2,260
Trophies
0
Age
34
XP
1,136
Country
United States
I suspect Drak's HDD has hardware failure, not just mere data corruption. I meant something like the motor, head problem. I wonder any chance it's Seagate. I experienced this before. And if it's the case, there is no saving as far as novice end user has access to. I meant you would need to open the HDD itself and replace the head, which may be more expensive than buying a new drive itself.

Making an image of the whole drive is also a way to confirm this.
 
Last edited by tivu100,

Drak

Active Member
Newcomer
Joined
Oct 29, 2007
Messages
41
Trophies
0
Website
Visit site
XP
296
Country
Canada
Is the "unexpected WFS version (bad key?)" error really related to the drive?

what I'd recommend is make a dump of sector 0 (for example with HxD, dump first 512bytes of the hdd, or just take a screenshot and post here) so we can analyze it and tell you if it indeed got replaced or not.
To me, you got your sector 0 replaced (or it got corrupt for unknown reason if not replaced with a partition table)

I have 4 different hard disks in Hxd. How do I know which one is which?
 
Last edited by Drak,

piratesephiroth

I wish I could read
Member
Joined
Sep 5, 2013
Messages
3,453
Trophies
2
Age
103
XP
3,233
Country
Brazil
Is the "unexpected WFS version (bad key?)" error really related to the drive?
It means that the program couldn't decrypt the contents (at least the very first sectors) to anything meaningful.
Of course the problem is evident because your console can't see the contents of the drive.
 

Drak

Active Member
Newcomer
Joined
Oct 29, 2007
Messages
41
Trophies
0
Website
Visit site
XP
296
Country
Canada
Nevermind, I unplugged it and plugged it back to see which one was new. And it seems there is a problem indeed with Sector 0. Please see attached.
 

Attachments

  • Sector 0.bmp
    5.6 MB · Views: 281

Nintynuts

Well-Known Member
Newcomer
Joined
Mar 14, 2009
Messages
54
Trophies
0
Age
33
Location
England
XP
242
Country
I'm backing up my 32GB NAND, and it's been going for over 12 hours now. This thread says it should take 3.5 hours. My memory card is a SanDisk 64GB Ultra UHS-I microSDXC, so I don't think it should be slow write speeds.
Based on the Hex numbers showing how much is done it seems to be only 1/3 of the way. Any Ideas why it's so slow? Thanks
 
Last edited by Nintynuts,

piratesephiroth

I wish I could read
Member
Joined
Sep 5, 2013
Messages
3,453
Trophies
2
Age
103
XP
3,233
Country
Brazil
I'm backing up my 32GB NAND, and it's been going for over 12 hours now. This thread says it should take 3.5 hours. My memory card is a SanDisk 64GB Ultra UHS-I microSDXC, so I don't think it should be slow write speeds.
Based on the Hex numbers showing how much is done it seems to be only 1/3 of the way. Any Ideas why it's so slow? Thanks
Well it's been a very long time since I dumped the NANDs here but it really takes a long time, however back then I used the iosuhax dump, straight copying the data to the SD without a filesystem
You might be using the NAND Dumper homebrew and it saves files so it relies on the filesystem.
You're using a 64GB card so you should have formatted it with the biggest possible cluster (65536 bytes / 64KB). Too small clusters result in slower speeds.
 

Nintynuts

Well-Known Member
Newcomer
Joined
Mar 14, 2009
Messages
54
Trophies
0
Age
33
Location
England
XP
242
Country
Well it's been a very long time since I dumped the NANDs here but it really takes a long time, however back then I used the iosuhax dump, straight copying the data to the SD without a filesystem
You might be using the NAND Dumper homebrew and it saves files so it relies on the filesystem.
You're using a 64GB card so you should have formatted it with the biggest possible cluster (65536 bytes / 64KB). Too small clusters result in slower speeds.
I am using the version downloaded though HBC. I formatted the SD card to FAT32 using an 3rd Party tool (presumably with the default cluster size) as the guide said.

I just realised I might have posted this in the wrong thread, although I can't find one specifically for that tool. Thanks anyway.
 
Last edited by Nintynuts,

Drak

Active Member
Newcomer
Joined
Oct 29, 2007
Messages
41
Trophies
0
Website
Visit site
XP
296
Country
Canada
What I suggested in the other thread :
- format another drive, with the same physical size
- make a full image backup of your non working drive (for backup/restore possibility)
- dump sector 0 of working drive
- replace bad sector 0 with extracted one from working drive

I don't know what the first sector contains, so maybe it will not work if it has any file system data on it, but if it only specify the available size and some cryptographic info maybe it can work?
No idea either if formatting another drive uses the same crypto key. I think the HDD key is the same until you format your console.
in another thread I've read the first 64bytes contains the file system info, so replacing the full sector 0 might not work.
EyeKey would know better than me.

So only the size is the limitation? Does it need to be one with a power supply or it doesn't matter?

@EyeKey
 

EyeKey

Well-Known Member
OP
Member
Joined
Feb 10, 2017
Messages
280
Trophies
0
XP
1,099
Country
Israel
Well, it is pretty complex to recover it. There are two things - first it must have the exact same sectors number (so the same printed size isn't always enough, usually it has to have the exact same size)
In addition to that, there is a random 32 bit number in the first page that is used to decrypt everything, so you have to recover that too from uncorrupted page.
In addition, I am not sure if the root directory page will be in the same page (and there a "pointer" for it in the first sector)

And the filesystem works with pages. If I remember correctly the first page is 0x2000 bytes.

I wouldn't bet on it with working with the WiiU , but with some deep understanding of the filesystem and manual work it is may be possible to recover the save files with my tool.
 

Drak

Active Member
Newcomer
Joined
Oct 29, 2007
Messages
41
Trophies
0
Website
Visit site
XP
296
Country
Canada
Well, it is pretty complex to recover it. There are two things - first it must have the exact same sectors number (so the same printed size isn't always enough, usually it has to have the exact same size)
In addition to that, there is a random 32 bit number in the first page that is used to decrypt everything, so you have to recover that too from uncorrupted page.
In addition, I am not sure if the root directory page will be in the same page (and there a "pointer" for it in the first sector)

And the filesystem works with pages. If I remember correctly the first page is 0x2000 bytes.

I wouldn't bet on it with working with the WiiU , but with some deep understanding of the filesystem and manual work it is may be possible to recover the save files with my tool.

I didn't understand a thing of what you said hahahaha!

I have around 1000 hours of save data in here. So I'll do whatever is necessary to recover the thing.

Which drive should I buy? This is my drive: https://www.amazon.com/Iomega-Selec...nements=p_n_feature_two_browse-bin:5446812011

It's still somehow being sold, but it's quite expensive. Is there one similar I could buy?
 

EyeKey

Well-Known Member
OP
Member
Joined
Feb 10, 2017
Messages
280
Trophies
0
XP
1,099
Country
Israel
I didn't understand a thing of what you said hahahaha!

I have around 1000 hours of save data in here. So I'll do whatever is necessary to recover the thing.

Which drive should I buy? This is my drive: https://www.amazon.com/Iomega-Select-External-Desktop-Drive/dp/B002AT6LUM/ref=sr_1_7?s=electronics&ie=UTF8&qid=1520348643&sr=1-7&keywords=iomega+external+hard+drive+desktop&refinements=p_n_feature_two_browse-bin:5446812011

It's still somehow being sold, but it's quite expensive. Is there one similar I could buy?
Buying a new drive won't help because as I said I wouldn't bet on creating a valid first page.

You will have to recover it from your current disk. I will see if I can do something that will help.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    K3Nv2 @ K3Nv2: Like for micro