Site IT decrypt the hardisk using wintech - remove EEPC.
Unfortunely he forgot to plug in the power.
When he comes back the laptop has been power off
Disk Infomation is changed, and we don;t know how many % the disk was decrypted.
Is there a way to check remaining encrypted sector for sector by sector decryption?Message was edited by: obelicks on 11/29/10 12:07:47 PM MYT
Which version? In 5.x if you didf not perform "forced" decryption, you can restart decryption and should continue from the place it stopped due to the power going down.
With forced decryption you have to find out last decrypted sector yourself.
I;m not sure if we can recover..
From Disk Information..
Powerfail=unknown.. and issue "remove EEPC" will be failed with error=> Disk Information (error=e002000a).
of course the disk information was changed..
i would think that we can do decryption again.. to cover remaining sector but then this will mess up the unencrypted sector (whih may been done halfway)
So is there a way to check remaining sector which is still encrypted?
So we can do manual sector by sector decryption?
Since you have got Disk Information error, automatic continuation of disk decryption is not possible.
You have to find out manually where decryption stopped.
exactly what i mean by openning this post..
is there a way to find where the decryption stop? because the decryption continuation is not possible.
Any Idea?Message was edited by: obelicks on 12/1/10 11:57:27 AM MYT
Use binary tree to inspect disk sectors from a given sector range. It might take more tests if you are unsure about the difference between encrypted and non-encrypted data.
Use workspace functions to read and decrypt sectors.
i totaly forgot about the workspace..
I;m not sure since this machine is not in front of me and the site is thousands kilometer away from here..
hopefully the site it know how to do this..
I've sent intruction on using workspace the problem i asume is to identify the diffrientiate between encypt and unencrypted sector.
There are 3 partition C, D and E
If what i known...
normally 3 partition will have 5 partition info - with sector gap (63) in between..
But looks like the disk information only shown 3 partition list..