I am using a Laptop with safeboot encryption. A few days ago, I stupidly deleted a large file Folder (too large for the recycle bin...). What is the best procedure to recover the deleted data?
I already tried some standard file reovery tool. It has found most of the data, but they are not usable after recovery. I understand that the reason for this is because they are still encrypted. Is it possible to encrypt them after recovery with the standard tools?
Or is it possible to decrypt the entire harddisk (without loosing the deleted data!), and to use a standard recovery tool to recover the data?
Or is there some better solution for solving my Problem?
It depends on whether you're using EEPC or EEFF, With EEPC The disk will be transparently decrypted within Windows, so as long as you run your recovery tool in Windows, it does not matter if the disk is encrypted or not - the recovery tool still sees the decrypted sectors. I don't think you'll have any better luck after decrypting the drive.
You say "SafeBoot" though - exactly what product/version are you using?
Thank you for your quick reply. But how can I see what type of encryption (EEPC or EEFF) and which version of Safeboot is being used?
You said if it is EEPC, the recovery program sees the decrypted data? Even if they are already deleted? In this case the recovered files should have been readable, but they aren't.
What does the revovery tool see if it is EEFF? Are the files still enctypted after recovery? Is there any way to decrypt them?
It's best if you contact your corporate IT department for help - decrypting data won't be possible without their support anyway and they will know what product they installed on your work pc.
The most likely explanation is you are using a really old version of SafeBoot device encryption, your whole hard disk is encrypted, and you're just unlucky re recovery - SBDE doesn't do anything to stop a windows file recovery program from working.
however if you are using SafeBoot file encryption, then the files should be readable after recovery as long as the recovery program doesn't change the file names.
You might be able to tell from the SafeBoot tool tray icon - it will tell you what products and versions are installed.
as I said though, contact your IT team - it's their laptop after all so they are best placed to help you.
Sure, its their laptop. But it was my own mistake which caused the problem. And the deleted files are mostly from my private files folder, and there have been a lot... So I dont want to bother our IT team with my private issues. Another point is that I am in an Engineering profession. I personally like solving technical problems. 😉
From the tray icon I could open a status window. Among other things, there is shown "Starting Endpoint Encryption for PC Client Manager (v5.2.12)". And in "Modules", I found some Safeboot related modules of version 126.96.36.199 with date Feb. 17, 2012. Is this a "really old" version of safeboot?
Yes, the shipping version is 7.1.3 if I remember right - your version was designed over 10 years ago.
Well, the problem is not the encryption - it's your file recovery program or the data I'm afraid - you could try decrypting the disk (with the assistance of your IT team), but I doubt it will change the result.
I'd try an alternate recovery program and see if you have any better luck.
Now I tried some other recovery tools. The last one I tried is Wondershare Data Recovery. It has found more than 300.000 deleted files. Some of them are shown with their original file path, others are shown with "Lost location". It seems that the files with original file path are readable after recovery, while files with "lost location" are not. Now guess what kind all the files are I would like to recover. Right, _all_ of them are in lost location... 😞
What can I do now? Do you have any idea?
Edit: I try deep scan now. This will take more than 2 hours it seems. I let you know the result.
sorry no - you're doing all the right things. Recovering deleted data is always a matter of luck unfortunately. The encryption is not doing anything to stop you - your files are simply deleted.