I am new here, so please excude me if I ask a stupid question. I need a little advice if you have the time.
I have been given a badly corrupt SATA drive from a laptop that was virused. I believe it was running safe boot when it was hit.
I dont know what has happened to the disk before I got it.
I am using a low level disk recovery tool called "Mini tool data recovery", which has been very successful in the past. I thnik it is finding encrypted files.
So, is it possible to decrypt these file? I do have the users SafeBoot pass password , but thats all.
Any advice is welcome, that might help recover some of the data
Thanks in advance and best regards
It won't be possible for your tool to find any data if indeed the disk was encrypted - The files will be totally encrypted.
Was the laptop encrypted with "SafeBoot", or was it encrypted with "Drive Encryption for HP ProtectTools" ? If it was the former, then the only people who can decrypt it are the helpdesk of the company who own the laptop. If it's the latter, then you need the recovery USB stick that the original user created when the initialized the encryption. Without that, it's unlikely you can recover it.
What happens when you turn the machine on? What does it display?
Thanks for your prompt reply.
All I have is the disk, not the laptop. The disk has ben through many "helpfull hands", so I don't hold out much hope. I do not know if this is a HP tool or SafeBoot. I suspect it is HP, as I can find traces of a HP partition on the drive. As for a initial USB stick, I might be able to get this if it exists.
As far as I can tell, the disk will not boot. It just shows up in Windows as size 0 bytes.
When I recover the drive a find lots and lots of dat files and attribute file. I assumed these were encrypted files that I could decrypt
Thanks for the help, but I get the feeling this is a dead loss
name.dat and attribs.dat? If so that's the pre-boot file system. Nothing useful there for you.
I would plug the drive in and see what it does - if it boots, and you have a good user name and password, it's entirely possible to recover the data. It all depends on what version of the product they are using, and whether it's HP's product or McAfee's.