Issue: Can't recover client data. WinTech doesn't identify partition information, won't rebuild SafeBoot MBR, displays "0"s under all fields in the Crypt List. The error message when attempting to restore the SafeBoot MBR is "can't find system boot drive". (The drive IS seen and listed, but no partition info is displayed)
Root Cause: Notebook generated "black screen" and forced client to hard power off the system rather than a graceful shutdown (Vista). Obviously, SafeBoot was updating LBA (logical block address) "0" when power was lost. Upon restarting the system "no bootable devices detected" message was displayed. LBA "0" then returned an error as the write being performed was incomplete.
Possible Solution? : If I rebuilt an image on the original target system using the same computer name and allowed SafeBoot to encrypt it could I then obtain the LBA "0" data and apply it to the bad drive in order to recover the data?
Prevention: What would be a viable solution to eliminate this problem in the future? If SafeBoot updates this sector everytime a "shutdown" command is issued, then it's very likely to see this kind of problem again.
2. McAfee EEPC only updates the boot sector on activation, no other time.
3. You can't swap MBR's between drives unless they were exactly the same to start with
4. the orgiginal MBR is in the machine export, you can install it just by doing the "restore original MBR
5. the disk information is linked off the SBR, so if you've trashed that, you won't see it in SafeTech/WinTech
to recover, probably the best way is to:
a) restore the original MBR so you can get the partition info b) check the key is correct by workspace decrypting the first and last sectors of the partition c) force decrypt the partition if all above is good.