cancel
Showing results for 
Search instead for 
Did you mean: 

decrypted HDD with wrong SDB file

Recently, the number of PC crashed after deploying EEPC to our staff(appox. 3000) has been increasing significantly.

All most errors are something like 'system being halted on booting', displaying "safeboot has been corrupted" or similar.

Through documentation, I learned how to restore data using recovery tool kit. Using the tool kit, I was able to recover most of cases except for a few hardware fault related cases.

However, I'm having a problem with one HDD which I have possibly decrypted with wrong SDB file. There was one SDB file with client's name on the server, so I no doubted that's the right SDB to use.

I manually decrypted the HDD, and completed successfully. But data's still not showing up!!!

Unfortunately, I didn't clone HDD before doing a decryption job.

I heard that once decrypted with wrong SDB, there is no way to turn it back. Is it right?

any suggestion for me, plz? : (

8 Replies
Reliable Contributor SafeBoot
Reliable Contributor
Report Inappropriate Content
Message 2 of 9

Re: decrypted HDD with wrong SDB file

call support, or your platinum person. As long as you remember EXACTLY what you did, and you have both the wrong, and right SDB file, it's entirely recoverable.

You just have to re-encrypt with the wrong file, then start again.

But, call support, or professional services.

Reliable Contributor SafeBoot
Reliable Contributor
Report Inappropriate Content
Message 3 of 9

Re: decrypted HDD with wrong SDB file

Are you sure this is EEPC6, and not EEPC5?

Re: decrypted HDD with wrong SDB file

it's eepc5..any differences?

and thing is I can  find only one SDB file on the server, that turned out wrong SDB

it maybe another issues..

the HDD has been sent to the data recovery company, and I've just told them to re encrypt with the SDB file as you told..

Reliable Contributor SafeBoot
Reliable Contributor
Report Inappropriate Content
Message 5 of 9

Re: decrypted HDD with wrong SDB file

wrong commuity if it's EEPC5 - you started it in the EEPC6/EPO community 😉

without the right SDB file it's game over - there's no way of recovering the data.

BUT, it must have registered its keys (unless you are using offline install mode?) - so the key might be in a backup of your DB perhaps?

did you look for machinename0001/0002 etc?

Re: decrypted HDD with wrong SDB file

oops,,,I didn't know I posted in the wrong community,,: ) , but you would answer me anyway, wouldn't you?   I always thank you guys

yes, I did check for the duplicated files starting with 0001, 0002 ...

anyway, what I have to do now in this stage is to bring it back to situation where it had been decrypted.

Just one more question, when decrytping manually,  how do I know if the HDD decrypted fully or partially?

Becuase I started decryption job on Friday night, and there was a black out for 6 hours here on Sunday....

I found the computer turned off after coming back to office on Monday. But I am pretty sure it must have been completed. By the time I checked the status on Saturday, about 80 % of progress rate was running.....

thanks

Reliable Contributor SafeBoot
Reliable Contributor
Report Inappropriate Content
Message 7 of 9

Re: decrypted HDD with wrong SDB file

if you did a normal decrypt, it would follow the disk information, so that will tell you what is and is not decrypted.

if you forced it, then there is no record - you'll have to work it out by inspection.

Re: decrypted HDD with wrong SDB file

You can get partition info from MBR, then using load sector to workspace (and decrypt) you could see if you get clear text info or not.

In NTFS, partition boot record is at the begining and if decrypted shows some english words. Backup of PBR is on last sector in the same partition.

Of course if you mishandled SDB, you need to perform more workspace operations in reverse order.

Re: decrypted HDD with wrong SDB file

You can completely work out the same process in reverse. I have done that.

But first learn how to use SafeTech/WinTech workspace functions. Like load disk sector to workspace, decrypt workspace, save workspace to file, display workspace, etc. Those will test your procedure without re-encrypting or decrypting anything.

You should also create sector based disk image, to be able to repeat your steps from the beginning, if something still goes wrong.

Please post exact version of EEPC that you have.

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community