cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
coconut
Level 7
Report Inappropriate Content
Message 1 of 14

external hdd with endpoint encryption needs to be read

Jump to solution

Hi guys,

I have the problem that i have had a small disk (60 gb) and wanted to extend to a bigger one (320 gb).

Therefore I tried to deinstall the ee and tried to access my data. But somewhere i make a mistake and saw to continue press anykey to format or f11 to terminate. I pressed F11 and the last I saw was formating ....

now I have reinstalled my os and reencrypted. I have my login for the disk and my password but i cannot access the disk. I have build a bartpe with old safetech tools 5.1.0.1.

I have the code of the day, I can see the disk, but I am not able to access or mount the disk, it says: "Safeboot client not activated" and error code 0xe0050001

Is there an newer version of the tool to build within bartpe (wintech cd or safeboot cd) to give it a new try ?

Regards

coconut

Message was edited by: coconut
uploaded photo from disk info  on 12/7/10 2:49:40 AM CST
1 Solution

Accepted Solutions
SafeBoot
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 7 of 14

Re: external hdd with endpoint encryption needs to be read

Jump to solution

ok,. well to decrypt the drive you need a copy of the key used to encrypt it, which only your helpdesk have. Once you have that you can use SafeTech to decrypt it, then some rescue tools to reconstruct the files if possible. Note though chances of success could be slim, as mostly the MFT is at the beginning of the drive.

It also depends on whether you did a quickformat or a real format, the chances are less if it's the latter etc.

But, all this depends on the assistance of your IT team - without them there is no possibility to recover anything.

View solution in original post

13 Replies
peter_eepc
Level 15
Report Inappropriate Content
Message 2 of 14

Re: external hdd with endpoint encryption needs to be read

Jump to solution

If the disk was owerwritten (formatted), then data is most likely gone.

Re: external hdd with endpoint encryption needs to be read

Jump to solution

First, when slaving a drive to recover data, you must keep one very important aspect in mind...

When you use the Wintech CD, you authorize with the code of the day, but you authenticate with your login to the LOCAL database.  Every install has a unique database and machine key and you must authenticate to the one on the drive in question.  Someone may need to enlighten me, but I've always had to authenticate using the database file option, not the SBFS option in this scenario.

This is done by getting the machine key by doing an export when right clicking the machine in EEM.  This file is placed on a USB and must be inserted prior to bootup because the 5.1 recovery disks cannot mount drives plug and play.

When you authenticate this way, your primary drive will appear to be un-readable so don't freak out.  Due to the possible format of the slave drive, it may not be readable in the A43 utility either.  However, you should be able to open the workspace and view the raw data to find how far the format went.  You would need to do a force decrypt of the drive to hopefully recover data, but it's critical to use the proper machine key and find the end of that formatting.

Message was edited by: TechSecurityNate on 12/7/10 6:41:01 AM CST
coconut
Level 7
Report Inappropriate Content
Message 4 of 14

Re: external hdd with endpoint encryption needs to be read

Jump to solution

Hello all together,

perhaps I need to tell you that this is hp internal. So I do not have those files in question. We have only our login name and password.

So I have contacted my support team and they told me that they could not help me and that the files are lost.

I am not willing to accept this and managed to build a bart pe with safeboot tools (old ones 5.1.0.1) but I am not able to get access to my disk (were still important files for me are stored)

The format did not run quite long, just a few seconds but now the disk states it is not bootable.

As you might see in the picture before you see my 2 partitions (one hidden 5 - 6 gb and one normal c with 55 gb) so I belive that all my files are still available or perhaps accessable. But i need to bypass the encryption.

I saw in other forums a screen from safe boot with a login and password field - this is where I want to get ..

Do you see any chance to get there ?

Best regards

coconut

SafeBoot
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 5 of 14

Re: external hdd with endpoint encryption needs to be read

Jump to solution

you post is a little confusing.

Are you saying you formatted and reinstalled, plus reencrypted your C drive with a new OS, and partially formatted your E drive (which was also encrypted previously), and now you want to recover your E drive.

BUT your internal support people don't want you to recover your E drive?

coconut
Level 7
Report Inappropriate Content
Message 6 of 14

Re: external hdd with endpoint encryption needs to be read

Jump to solution

Hello,

no it starts with my old smal 60 gb drive and a new 320 gb drive

i wanted to uninstall ee and then do a cloning of the disk

i made a mistake - the screen with format or press f11 come up, it started shortly to format and now will not boot anymore

then i left the 60 gb drive as it was unable to boot and installed the new 320 gb drive and newly installed all what i needed

this is now also encrypted (no problem at all) but i want to get access to my old encrypted hdd to try with any recorery software to get my data back after formating ...

so right now the situation is that i have the old disk in an external hdd cage and connected to an pc running from the bart pe with safetech tools and trying to access it ...

this old hdd is splitted in two partitions with 5 gb (now shown as "d" and 55 gb now "e". the 5 gb partition was hidden, and the 55 gb drive was the normal c drive

SafeBoot
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 7 of 14

Re: external hdd with endpoint encryption needs to be read

Jump to solution

ok,. well to decrypt the drive you need a copy of the key used to encrypt it, which only your helpdesk have. Once you have that you can use SafeTech to decrypt it, then some rescue tools to reconstruct the files if possible. Note though chances of success could be slim, as mostly the MFT is at the beginning of the drive.

It also depends on whether you did a quickformat or a real format, the chances are less if it's the latter etc.

But, all this depends on the assistance of your IT team - without them there is no possibility to recover anything.

View solution in original post

Re: external hdd with endpoint encryption needs to be read

Jump to solution

IF you could get the machine key file from your support, which you stated they won't provide, then you could do a force decrypt of the 55Gb partition and potentially view those files in an unencrypted state as normal.

There are surely instructions for force decrypt out there, or someone could assist, but no need to get into that until you get the machine key you need.

coconut
Level 7
Report Inappropriate Content
Message 9 of 14

Re: external hdd with endpoint encryption needs to be read

Jump to solution

ok the statement is that it is not supported to decrypt the drive

so I am stuck

need now to find a way of force decrypting my drive ...

any helping hand is usefull....

SafeBoot
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 10 of 14

Re: external hdd with endpoint encryption needs to be read

Jump to solution

to decrypt the drive you need the key, your IT team has the key. That's the only way to move forward on this.

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community