cancel
Showing results for 
Search instead for 
Did you mean: 
Reliable Contributor SafeBoot
Reliable Contributor
Report Inappropriate Content
Message 11 of 18

Re: Need help/advice data recovery from Endpoint encrypted laptop

fixboot just resets the MBR - so far more changes than that must have occurred.

if usually you have to authenticate with the pre-boot, then one day you got that windows error without authenticating then somehow an OS was installed on your machine - perhaps a recovery console?

regardless though, the correct response from your IT team was an emergency boot, or a decryption - that will fix the problem you describe.

However, if something other than fixboot has affected the machine, we would need to know what that was to suggest the solution to it.

You can't usually get the pre-boot screen after doing a fixboot - that's impossible as fixboot changes the MBR - how did you run fixboot though? Off a recovery CD?

are you sure you're not suffering from a root kit virus?

capri
Level 7
Report Inappropriate Content
Message 12 of 18

Re: Need help/advice data recovery from Endpoint encrypted laptop

First of all thank your for your replies, keep them coming !

I booted off  Windows XP CD and ran fixboot from recovery console.

My laptop is/was set up in such a way that I always have to authenticate with pre-boot (have to enter my ID and password into a McAfee window before

laptop boots).

This McAfee window (I need to be very graphic here) always shows up .

Even after I ran fixboot and tried to boot the machine again this window came up, I have entered my credentials than I got "missing operating system "message.

Nothing elese was done on the laptop so I have no clue what could have affected it ?

The laptop is protected by McAfee anti-virus , never had any issues.

Hoe does root kit virus manifest itself ?

Thanks again.

capri
Level 7
Report Inappropriate Content
Message 13 of 18

Re: Need help/advice data recovery from Endpoint encrypted laptop

I was re-reading SafeBoot's post #3 ...Windows error messages always appeard AFTER pre-boot (McAfee screen) after  I supplied my ID and Password.

There was no intallations of ANY sort.One day I work from home all works, shut down the laptop normally.

Next day I got to work fire up the machine and after authentication I get those Window error messages.

Re: Need help/advice data recovery from Endpoint encrypted laptop

Capri,

Did you ever able to recover the data? If yes, how did you able to do that? I have bit of same problem.

Highlighted
Reliable Contributor SafeBoot
Reliable Contributor
Report Inappropriate Content
Message 15 of 18

Re: Need help/advice data recovery from Endpoint encrypted laptop

Contact your IT department - only they can really help you.

Re: Need help/advice data recovery from Endpoint encrypted laptop

So in my case, what happened is this. I was working on laptop then lock it the screen and came back after 4 hours and found windows is down. I try to start and found that it keeps coming back our Auto OS Install screen as windows can not be started anymore. On Auto OS Install screen, I continue to reinstall OS and in that process it doesn't let me go further until I answer yes for formatting hard drive. So after install, new bar drive encryption were done. Since old encryption key is overwritten by our IT department, I only left with new one. I called hard drive recovery vendor and they are saying they need old encryption key file. I think they call it sdb file. I don't know why our IT department would keep at least one previous sdb file. Any help how I can recover data now. my IT department wash hands saying they don't do data recovery s they expect users to have backup.

Reliable Contributor SafeBoot
Reliable Contributor
Report Inappropriate Content
Message 17 of 18

Re: Need help/advice data recovery from Endpoint encrypted laptop

I guess you're saying your data is not on the same partition as your OS (because you formatted your OS partition)?

The key never gets overwritten, unless your company deliberately made/used some script to do that - by default every activation event is unique. It is conceivable they chose to use some tool to do the overwrite though (in which case your data is totally irrecoverable).

If your IT team can't/won't give you the SDB file, there is absoutely no way to recover your files. That's the whole point of the security product.

capri
Level 7
Report Inappropriate Content
Message 18 of 18

Re: Need help/advice data recovery from Endpoint encrypted laptop

Had some trouble logging in as I forgot the password to this site and it seems it is ran by a bunch of "security freaks" cause

I had to reset my password but they were all "too weak "  ...shish....

OK back to subject at hand , yes I was able to get my data back.My IT Dept guy had to do all the decription staff but I told him to run

1-fixmbr

2-fixboot

3-checkdsk took very long time to run but in the end all my data was intact.

Windows however was unusable, missing drivers, missing files etc , so after getting my data the IT installed new image on my laptop.

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community