We have a few laptops which at about the same time started blue-screening when booting windows. First prize would be to get into the machine so that I can investigate. Second would be to get the data. This is where my problem begins.
When booting from a DETECH disk/usb, I can Authenticate and Authorize, but when I click "Remove DE" it says "Removal process started" and then the window closes itself.
I've noticed also that if I click disk information, it says "ERROR: Disk Information not available". Everything else is a zero. Repair Disk Information does nothing and I can't restore the MBR or click Token as it says "no boot disk found".
I've used Set Boot disk and I've toggled taking the drive offline/online. It appears as if the disk is not being detected, however its a perfectly good disk which still tries to boot until it gets a BSOD.
So far I've got 3 laptops which have this issue and all of them are less than 3 months old. I tested the above options on identical laptops with exactly the same spec (that do not have the BSOD problem) and I was able to browse the drive and use the token option.
I suspect the MBR was corrupted however I can still log in from the mcafee screen when starting up from the HDD and it starts booting Windows.
I'm at my wits end. If anyone knows why I can't see the Disk information or why it tells me "Boot disk not found" please let me know. If there is a rootkit going around I'll need to quell it as soon as possible and I need to get back some important data.
We're running the Endpoint Encryption Agent version 188.8.131.523
The laptops are HP 430 G2's with 4gb ram and 128GB SSD.