cancel
Showing results for 
Search instead for 
Did you mean: 

e002001b - Safeboot login not starting, cannot emergency boot

Jump to solution

I have a PC with Safeoot version 5.1.3 that will not boot.  I receive an "unable to find boot disk" error before I receive a Safeboot logon prompt.  Safetech will not authenticate via SBFS - SDB works, but an emergency boot attempt throws the same error, as does an MBR repair attempt and a Safeboot removal.  Wintech cannot mount/see the disc. I can load sectors in the workspace and decrypt them, so I know the data is still there.  It seems to me like some sort of MBR issue, but I don't know how to fix it if the built-in tools won't do it.  I have attached a dump of the first few sectors of the disc, if that is helpful to anyone.

Thanks!

1 Solution

Accepted Solutions

Re: e002001b - Safeboot login not starting, cannot emergency boot

Jump to solution

You can try forced decryption but then you seriously risk data loss. Unless you first take disk sector image as a precaution.

As for MBR, there is always MS FixMBR.

View solution in original post

9 Replies

Re: e002001b - Safeboot login not starting, cannot emergency boot

Jump to solution

Was disk fully encrypted? Did you try to use SafeTech and check disk info? Does it say it is fully encrypted (sector range). Can you check if last sector of encrypted partition is also encrypted?

Re: e002001b - Safeboot login not starting, cannot emergency boot

Jump to solution

I can't give a definitive answer right now because I don't have the PC, but I am almost positive that I was able to view the last area of the disc without decrypting the workspace.  And it did report encryption from sector 63 to some large number. But yes, I believe the workspace showed some plain text near the end. Does that indicate something?

Re: e002001b - Safeboot login not starting, cannot emergency boot

Jump to solution

If you have seen plain text (rather than decrypt to see clear text) then that is not so good. It might indicate that disk is partially encrypted.

If that is the case, and disk info shows how much of the disk was encrypted, then you could try to remove SafeBoot.

If data is very valuable, I would perform sector disk image first, as a backup, to be able to restore disk to the current state.

Re: e002001b - Safeboot login not starting, cannot emergency boot

Jump to solution

The standard Safeboot removal process fails with the error about not finding a boot disc.  Is it safe to decrypt the section of the drive that is reported as encrypted?  I wouldn't think that would really work as a safeboot removal, as it would still be trying to boot to safeboot.

Re: e002001b - Safeboot login not starting, cannot emergency boot

Jump to solution

You can try forced decryption but then you seriously risk data loss. Unless you first take disk sector image as a precaution.

As for MBR, there is always MS FixMBR.

View solution in original post

Re: e002001b - Safeboot login not starting, cannot emergency boot

Jump to solution

Thanks for the help!  I did a force decrypt based on the disk info reported.  Obviously the partition info was lost, but I was able to remedy that with a great little program called TestDisk

Highlighted
rbarstow
Level 10
Report Inappropriate Content
Message 8 of 10

Re: e002001b - Safeboot login not starting, cannot emergency boot

Jump to solution

Do a very careful virus-scan. We've tagged several of our machines in the last week with the exact same symptoms back to a Stealth MBR -type virus.

Re: e002001b - Safeboot login not starting, cannot emergency boot

Jump to solution

That's good to know, and I will keep an eye out for that.  I think this particular case was somehow related to the user attaching/formatting another hard disk on the same machine.  Out of curiosty, which antivirus software did you have loaded on the infected machines? And what software was able to detect it?

rbarstow
Level 10
Report Inappropriate Content
Message 10 of 10

Re: e002001b - Safeboot login not starting, cannot emergency boot

Jump to solution

McAfee A/V 8.5(?). I'm still waiting for the last machine to finish decrypting so we can try and figure out some of that stuff.

We're guessing, based on a spike of detections/blocks for those on other machines.

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community