Taking work now — the first look is freeNAS drives posted in from anywhere in the UK, or handed in at ten drop-off pointsQuicker still, give us a ring:0800 6890668
NDRNAS Data Recovery 0800 6890668 Price my job
NDR / Whatever it is saying now / My Book Live wiped

My Book Live · Live Duo · June 2021 · CVE-2018-18472 · CVE-2021-35941

A My Book Live that was wiped. The reset rewrote the index. The files were still on the platters underneath it.

On 23 and 24 June 2021, My Book Live and Live Duo units across the world were reset to factory settings overnight, their owners waking to empty drives. Western Digital had stopped updating the line in 2015; attackers used an old remote command execution flaw, CVE-2018-18472, and a second, CVE-2021-35941, an administrator function that could run a factory restore without any password. WD told owners to unplug the units from the internet. A factory reset re-creates the file system, which rewrites the structures that say where every file is, and leaves the files themselves where they were until something new is written over them. Owners who left the unit alone got most of it back; owners who used it afterwards got less. A My Book Live is £300 + VAT and a Live Duo £500 + VAT upwards after the free look, fixed in writing.

Free first lookOne fixed figure in writingNo data, no bill on most jobsReturn postage paid

Rather talk it through? An engineer answers the bench line
0800 6890668

Unplug it from the network and do not write anything to it. The reset rewrote the file system's structures, not the files. Every file copied onto it since lands on the blocks the old files occupied. Send it as it is.

What a factory reset does to an ext4 volume, and what it leaves.

A factory reset on the My Book Live re-creates the data partition's file system with mkfs. That writes a fresh superblock, fresh group descriptors, fresh inode tables and a fresh, empty root directory across the volume, and it does so in a pattern that touches a small fraction of the disk. The data blocks that held your files are not written; they are simply no longer referred to by anything. On an ext4 volume with a 64K block size, as the My Book Live used, the metadata that mkfs rewrote is scattered predictably across the disk, and the old metadata survives in the backup superblock groups the new format did not reuse.

That is why the units left alone recovered so well. The old inode tables, where they survived, give files their names, sizes and locations; where they did not, the files are carved from the data blocks by their contents and sorted by type. Every file written to the drive after the reset, and every backup job that helpfully ran, lands on blocks the old files occupied, and each one of those is a file that will not come back. The difference between a unit unplugged on 24 June 2021 and one used until August is the difference between most of it and some of it.

The bench images the drive, or both drives of a Duo, and works entirely on the image: the old ext4 structures are reconstructed from what the reset did not overwrite, the file tree rebuilt where the inode tables survive, and the rest carved from the free space. The 64K block size that defeats ordinary PC tools is not a problem on the bench, and nothing is written to the original.

What it says, and what it means.

Describe yours to us →
What you see The usual reason Where that leaves you
Drive empty after the night of 23–24 June 2021The remote resetOld file system reconstructed on the image
Unit unplugged sinceNothing overwrittenMost files back with names
Unit used since, files copied onFree space reusedWhat was not overwritten comes back; told honestly
Drive will not mount on a PC64K-block ext4Mounted from the image on the bench
Live Duo: both drives resetMirror re-createdBoth imaged; the better copy used

From the box arriving to your files going back.

Work we have closed →
01

Logged the day it lands, and the first look costs nothing Free

A case number goes on the parcel and a number on every drive the day it is opened, and an engineer settles what has actually happened before anything spins. The unit is examined on its own; each drive is assessed on our own equipment, never in a NAS that will try to rebuild. Back to you come two things together: a straight note of what is liftable and what is not, plus one figure, fixed and written down. Accept it, or decline and owe us nothing.

Nothing to pay for lookingA single figure, put in writingNo rebuilds, no repairs, no resets
02

The unit, and the drives, apart

The box and the disks are two different jobs. The unit is tested separately, because a dead power supply, a failed board or a bricked boot flash leaves the drives untouched more often than not. Each drive is then read on the bench: the ones that answer at full speed, and the weak or failed ones in clean air where they need head work. On units that hold an encryption key or a layout of their own, the unit is part of the data and is kept with it.

Unit and disks assessed separatelyFailing members to the clean bench
03

Every member imaged, once

Nothing is worked on live and nothing is rebuilt on the originals. Every drive in the set is imaged sector by sector, the weak ones head by head with the bad areas last, and the SSD cache with them where there is one. From then on the originals are not touched again.

Every drive, including the cacheWeak areas last
04

The set put back together, from the images

Order, chunk size, parity rotation and the reshape point are read from the drives' own metadata and the array is reassembled in software: mdadm and LVM under SHR, X-RAID and QTS pools; a ZFS pool imported read-only; Drobo's BeyondRAID zones reconstructed. The file system, Btrfs, ext4, XFS or ZFS, is repaired on the virtual volume, and encrypted volumes are unlocked there with the key you supply. Never on the originals.

Rebuilt in software, from imagesThe file system repaired on the virtual volume
05

You see the file list before you pay

What was recovered is listed for you first, and only then does a bill exist. Approve the list and it is invoiced; turn it down and it is not — and where nothing has come back, most jobs carry no charge at all. Recovered data travels home on fresh media bought in for your job, with the postage at our end. Your case is not closed until you have opened the files on a machine of your own.

No charge until you accept the figureFresh media, supplied with the job3–4 days at the bench

From the bench

  • The less written since, the more comes back. A unit unplugged the morning it was found empty is a good job years later. One that ran backups for a month afterwards is a partial one.
  • Do not put the drive in a PC. Windows offers to initialise it and macOS offers to erase it; both write. The 64K block size means neither will mount it anyway.
  • WD offered recovery to affected owners from July 2021, and the offer has long lapsed. The drive is recovered the same way here, from an image.
  • The Duo is a mirror, and both drives were reset the same night. Both are imaged and the copy with the most surviving metadata is used.

One job, followed all the way through.

UK · NDR-2026-0519JOB LOGGED ✓

A My Book Live 3TB reset in June 2021, unplugged that morning, and left in a drawer until its owner found this page

Nothing had been written to it since the reset, which is why it was one of the better jobs of the year. The drive was imaged, the old ext4 structures reconstructed from the backup superblock groups the reset had not reused, and the file tree rebuilt with names intact for all but a few hundred files, which were carved and sorted by type.

97% of files recovered, most with names4 days here, and back by post
Illustrative example — replace with a genuine case

What helps, and what harms.

Do this much first

  • Unplug it from the network and the mains
  • Send the unit with its drive or drives
  • Say roughly what was written to it after the reset, if anything
  • Tell us what was on it, so the carving is planned around it

What sets us back

  • Copying files onto it to see whether it works
  • Letting a backup job run to it
  • Initialising or erasing the drive in a PC
  • Factory resetting it again

Questions answered before you commit.

My My Book Live was wiped in June 2021. Is the data gone?

Usually not. The reset re-created the file system's structures and left the data blocks alone. What has been written to the drive since is what decides how much comes back.

Why won't a PC read the drive?

The My Book Live used ext4 with a 64K block size that most PC tools refuse. On the bench it is mounted from an image without difficulty.

I used the drive for a while after the reset. Is it too late?

Not entirely. What was not overwritten comes back. The free look says how much, before any charge.

What does it cost?

£300 + VAT for a My Book Live; a Live Duo is a two-drive set from £500 + VAT.

How long does it take?

3–4 days at the bench.

Nothing gets worse while it is powered down.

Looking at it is free. Back comes a list of what opened and what did not, together with a single price to finish, set down in writing while you are still free to say no. Until that list reaches you, leave the unit off and the drives in their bays.

0800 6890668