Community Help Hub

thejoefletch · ‎07-22-2014

My system information.

IMB Thinkpad Lenovo T420
Windows 7 64 bit
Hard drive is encrypted with McAfee Endpoint Encryption v6
320GB hard drive
2 partitions; 1 main partition, the other partition is labeled BDEDrive (which I think is a standard Windows 7 partition)

This past Friday, my Windows 7 machine locked up. I waited for it to respond for about 15 minutes. It didn't! So I held the power button down to give it a fresh boot. The machine blinked a blue screen of death and rebooted to a standard Windows diagnostic screen. The machine automatically ran the diagnostic with no solution. This was in an endless loop. I ran CHKDSK from a DOS prompt without any success.

I then pulled the hard drive to hook up to another system to see what I could find. It asked me to reformat, which I did NOT do. I did some Google research and it appears that the MBR or partition was potentially damaged. So I downloaded TestDisk and tried to scan the partition (Intel - without logging); quick scan and deep scan did not return anything to recover (but was able to completely scan the drive). So at this point I logged a help desk ticket with my company.

I brought the machine in Monday morning and they told me that the hard drive is encrypted with McAfee. They tried to run some software on my machine from a USB drive (I did not catch the name of it) but it locked up and they did not try it again. They pulled the hard drive from the machine to test it via a diagnostic machine and got an I/O error. At this point they told me that they could not do anything because the hard drive crashed. But I didn't believe it since I did not get any errors from connecting through my personal USB hard drive adapter. So I was able to get the hard drive in order to continue testing on my own (which may or may not be a good idea since they didn't want to give it up).

So here are my screen shots and log from TestDisk.

Quick Analysis shows the following; the first partition appears to be listed twice.

Results of Quick Scan does not show the first partition...

Looking at the files (they all appear to be from the BDEDrive partition)...

There appears to be some logs listed with the date of my initial problem.

Could the BCD or BCD.log files be used to troubleshoot this problem?

I also did a deep scan. Below are the results.

Looks like TestDisk found the first partition, but when I go and look at the files...I get this! Which I guess I would expect since the hard drive is encrypted.

Looking at the Advanced -> Boot option in TestDisk, I see the following. Is this expected with an encrypted drive?

And I ran a scan with Crystal Disk Info. Results here look good.

Should I create an image of this drive before doing anything else?

Not sure what else to do here.

Any help with this would be much appreciated!

I can post the TestDisk log if that will help troubleshoot the problem!

SafeBoot · ‎07-23-2014

Normally, when you boot your machine, do you have to enter a password, or does it show a message like "Starting McAfee Drive Encryption" etc?

regardless though if the drive is encrypted, you're going to need your helpdesk to decrypt it - it's not something you will be able to do on your own.

thejoefletch · ‎07-23-2014

Normally, when you boot your machine, do you have to enter a password, or does it show a message like "Starting McAfee Drive Encryption" etc?

No, I have never seen a message that states Starting McAfee Drive Encryption.

regardless though if the drive is encrypted, you're going to need your helpdesk to decrypt it - it's not something you will be able to do on your own.

That's what I thought. Problem is that my company's IT group gave up so easily and wanted to send out the drive. I understand that this is probably a low priority and time consuming recovery, but sending the drive out has to cost more than keeping it in-house.

SafeBoot · ‎07-23-2014

sending it out won't help either if it's encrypted.

If you've never seen the banner, then the drive can't be encrypted. You might just have missed it though, it flashes up fast. If you've never had to enter a password either though the encryption was pretty pointless.

odd situation. But the only people who can recover your data is your IT helpdesk. No "data recovery agency" is going to be able to do it without their help either.

thejoefletch · ‎07-23-2014

SafeBoot wrote:

If you've never seen the banner, then the drive can't be encrypted. You might just have missed it though, it flashes up fast. If you've never had to enter a password either though the encryption was pretty pointless.

I usually hide the splash screens from showing so that Windows will boot fast (something that I picked up a numer of years ago and I'm not sure if it is true anymore). So either that is why I do not see it anymore, or, as you stated, I simply missed it.

SafeBoot wrote:

odd situation.

That about sum up my life! Haha!

SafeBoot wrote:

But the only people who can recover your data is your IT helpdesk. No "data recovery agency" is going to be able to do it without their help either.

I can only assume that the outside agency would have a contract with our company to restore a decrypted hard drive. So they would have access to the McAfee daily codes, software, or anything else that is necessary to decrypt it. Can you confirm that is possible? If so, then I will consider going back to my IT organization to see if I can convince them to look at the drive again.

Does it make sense that my machine will not boot? In other words, has this happened before? (I'm can't imagine this not happening in the past.)

I wonder how or if I can get the details of the Blue Screen of Death. I guess I can record video of the bootup process to get a screen shot, but besides that, I do not know how I would get the details/dump from the BSOD.

Any other thoughts would be much appreaciated!

Thanks for your reply.

SafeBoot · ‎07-23-2014

If your drive is encrypted, but you're getting a BSOD, then your machine is booting - enough to start Windows anyway.

It all depends on what is encrypted - maybe only your data drive, and not the OS itself.

Chances are it can be recovered easily though - your helpdesk have all the tool available to do it. It's their call whether they want to or not though.

I suspect if they genuinely believed there was a hardware error on the drive, they wouldn't bother trying to decrypt it. Maybe getting them to take another look would be worthwhile.

Some companies though don't bother decrypting drives, especially those with strict backup policies - Reimageing and restoring from your backup is meant to be quicker.

thejoefletch · ‎07-23-2014

SafeBoot wrote:

If your drive is encrypted, but you're getting a BSOD, then your machine is booting - enough to start Windows anyway.

I never see the Windows logon screen. I suspect that I get to a point just before that. I have to see if I can get a dump or details from the BSOD. Maybe that can help with troubleshooting.

SafeBoot wrote:

It all depends on what is encrypted - maybe only your data drive, and not the OS itself.

Since I cannot see anything, my guess is that it is the whole partition, so both OS and data.

SafeBoot wrote:

Chances are it can be recovered easily though - your helpdesk have all the tool available to do it. It's their call whether they want to or not though.

And that's what I would think. But I personally feel that they gave up too easy.

SafeBoot wrote:

I suspect if they genuinely believed there was a hardware error on the drive, they wouldn't bother trying to decrypt it. Maybe getting them to take another look would be worthwhile.

I cannot imagine that there is a hardware error on the drive. I ran quite a few disgnostics on the drive and never received an error.

SafeBoot wrote:

Some companies though don't bother decrypting drives, especially those with strict backup policies - Reimageing and restoring from your backup is meant to be quicker.

Ok, I can see how this could make sense from their standpoint. But it's still frustrating!

thejoefletch · ‎07-23-2014

SafeBoot wrote:

I suspect if they genuinely believed there was a hardware error on the drive, they wouldn't bother trying to decrypt it. Maybe getting them to take another look would be worthwhile.

Would the TestDisk log help at all?

TestDisk Log:

Tue Jul 22 13:46:10 2014

Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013

Christophe GRENIER <grenier@cgsecurity.org>

http://www.cgsecurity.org

OS: Windows 7 (7601) SP1

Compiler: GCC 4.7, Cygwin 1007.17

Compilation date: 2013-07-30T14:08:52

ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504

disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=160041885696

disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=320072933376

disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=160041885696

disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=320072933376

disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=159713853440

filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:

filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:

disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=319744376832

disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=314572800

Hard disk list

Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63, sector size=512 - HITACHI HTS723216A7A, S/N:----------, FW:EC1Z

Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - ST320LT0 07-9ZV142

Partition table type (auto): Intel

Disk /dev/sdb - 320 GB / 298 GiB - ST320LT0 07-9ZV142

Partition table type: Intel

Analyse Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63

Geometry from i386 MBR: head=255 sector=63

check_part_i386 failed for partition type 07

NTFS at 38873/127/39

Current partition structure:

Invalid NTFS or EXFAT boot

1 P HPFS - NTFS 0 32 33 38873 127 38 624500736

2 * HPFS - NTFS 38873 127 39 38911 189 62 614400 [BDEDrive]

search_part()

Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63

NTFS at 38873/127/39

filesystem size 614400

sectors_per_cluster 8

mft_lcn 25600

mftmirr_lcn 2

clusters_per_mft_record -10

clusters_per_index_record 1

HPFS - NTFS 38873 127 39 38911 189 62 614400 [BDEDrive]

NTFS, blocksize=4096, 314 MB / 300 MiB

file_pread(5,1,buffer,625143807(38913/102/37)) lseek err Invalid argument

file_pread(5,1,buffer,625143808(38913/102/38)) lseek err Invalid argument

file_pread(5,14,buffer,625143809(38913/102/39)) lseek err Invalid argument

file_pread(5,3,buffer,625143823(38913/102/53)) lseek err Invalid argument

file_pread(5,3,buffer,625143870(38913/103/37)) lseek err Invalid argument

file_pread(5,8,buffer,625143886(38913/103/53)) lseek err Invalid argument

file_pread(5,11,buffer,625143933(38913/104/37)) lseek err Invalid argument

file_pread(5,2,buffer,625145855(38913/135/6)) lseek err Invalid argument

Search for partition aborted

Results

* HPFS - NTFS 38873 127 39 38911 189 62 614400 [BDEDrive]

NTFS, blocksize=4096, 314 MB / 300 MiB

interface_write()

1 * HPFS - NTFS 38873 127 39 38911 189 62 614400 [BDEDrive]

simulate write!

write_mbr_i386: starting...

write_all_log_i386: starting...

No extended partition

Partition table type (auto): Intel

Disk /dev/sdb - 320 GB / 298 GiB - ST320LT0 07-9ZV142

Partition table type: Intel

Analyse Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63

Geometry from i386 MBR: head=255 sector=63

check_part_i386 failed for partition type 07

NTFS at 38873/127/39

Current partition structure:

Invalid NTFS or EXFAT boot

1 P HPFS - NTFS 0 32 33 38873 127 38 624500736

2 * HPFS - NTFS 38873 127 39 38911 189 62 614400 [BDEDrive]

search_part()

Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63

NTFS at 38873/127/39

filesystem size 614400

sectors_per_cluster 8

mft_lcn 25600

mftmirr_lcn 2

clusters_per_mft_record -10

clusters_per_index_record 1

HPFS - NTFS 38873 127 39 38911 189 62 614400 [BDEDrive]

NTFS, blocksize=4096, 314 MB / 300 MiB

file_pread(5,2,buffer,625143808(38913/102/38)) lseek err Invalid argument