cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

EEPC 5.1.8 with XP SP3 - On-Disk Structure Being Destroyed

Jump to solution

I have run into a number of encrypted machines that have failed with a "SafeBoot is not installed" message and when the disk is examined with WinTech, the partition exists but there is no on-disk structure -- no SBFS, folders or files, presumably because the MFT is missing/corrupt. I always confirm that I have the correct key by loading the starting sector of the partition into the Workspace and decrypting it. I also run SpinRite on the drive to confirm that the problem is not a hardware failure -- such drives are always "clean"; i.e. no bad sectors.

While I understand that a Force Decrypt can be done followed by a recovery tool such as TestDisk to rebuild the MFT, my question is not about recovery but about cause. Has anyone else seen this situation and if so, does anyone have any idea as to what is causing this type of catastrophic disk corruption. This is happening enough that people are beginning to blame EEPC and it is hard to counter such claims with no information.

1 Solution

Accepted Solutions
rmmiles
Level 10
Report Inappropriate Content
Message 7 of 7

Re: EEPC 5.1.8 with XP SP3 - On-Disk Structure Being Destroyed

Jump to solution

This is a duplicate thread, the error number is likely "0xe0050001". You don't have to decrypt to get around this issue, try the options outlined here: https://community.mcafee.com/thread/29096. Most likely, the systems have been infected with a MBR virus of some sort. Once the systems are back up and running, be sure to do a thorough virus scan (using something other than McAfee VirusScan).

View solution in original post

6 Replies
SafeBoot
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 2 of 7

Re: EEPC 5.1.8 with XP SP3 - On-Disk Structure Being Destroyed

Jump to solution

can you describe the error state more - what's the exact condition the machine is in when you get it?

Re: EEPC 5.1.8 with XP SP3 - On-Disk Structure Being Destroyed

Jump to solution

The machine will not boot (we are using autoboot) and there is an EEPC pre-boot error message indicating that SafeBoot is not installed (sorry don't have the actual error #).

I didn't mention in the original post, but SafeTech (floppy-based) Emergency Boot also doe not work because it can't find the SBFS.

SafeBoot
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 4 of 7

Re: EEPC 5.1.8 with XP SP3 - On-Disk Structure Being Destroyed

Jump to solution

It's odd to get that message - are you SURE it says "SafeBoot is not installed" ? That would usually mean that something has redirected the SBR elsewhere - so the trick is to look at sector 0 and see what's in it.

Re: EEPC 5.1.8 with XP SP3 - On-Disk Structure Being Destroyed

Jump to solution

Unfortunately I don't have a failed machine with that problem at the moment.

Note that the exact error message can vary, but the underlying symptom on the drive is the same -- *nothing* can be found, including the SBFS, so the only option is Force Decrypt followed by reconstruction of the on-disk structure using a third-party tool -- no other SafeTech/WinTech functions work, all giving an error message of one kind or another.

SafeBoot
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 6 of 7

Re: EEPC 5.1.8 with XP SP3 - On-Disk Structure Being Destroyed

Jump to solution

That would be expected if the SBR has been moved off sector 0 - the pointer to the disk info is in that sector.

You could be under attack by an APT - introducing a root kit is classic APT/Malware behavior - I would be sure to grab a machine and look at sector 0 to see if there's something odd there. You might want to also run a robust root kit detection tool as well.

rmmiles
Level 10
Report Inappropriate Content
Message 7 of 7

Re: EEPC 5.1.8 with XP SP3 - On-Disk Structure Being Destroyed

Jump to solution

This is a duplicate thread, the error number is likely "0xe0050001". You don't have to decrypt to get around this issue, try the options outlined here: https://community.mcafee.com/thread/29096. Most likely, the systems have been infected with a MBR virus of some sort. Once the systems are back up and running, be sure to do a thorough virus scan (using something other than McAfee VirusScan).

View solution in original post

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community