cancel
Showing results for 
Search instead for 
Did you mean: 

need to recover a removable drive

Hi guys.

I am in very difficult situation that you guys must help me.

I have many expriences in recovering data in the enrypted HDD(I am using 5.2.9).

But, this case is the very first time : (

One user visisted IT helpdesk to format his PC. Before he do that, he did tranfer his files to his own External HDD drive.

A file transfer completed successfully and carried out formatting his PC.

After formatting, he tried to copy the backed up files to the newly installed PC.

But the external drive was not recognized properly and asked for formatting, which meant it was encrypted.

Here is a weired thing, coz, policy does not allow to encrypt a removable media, and only allows to encrypt C: / 😧

Anyway,  what I did to solve this issue was that I tried  a wintech recovery with a previous SDB database.

I tried "Remove EEPC" but it gave me an error, and tried to look up information in "Edit Crypt state", but it displayed as "0" .

None of functions to decrypt worked.

I think one thing I can do is "Manual Decryption". But, here is the question.

How can I determine how many sectors of the disk are encrypted? I am sure this disk is not fully encrypted, but partailly.

Decrypting all the sectors for the disk that are partially encrypted does not help resolve this issue. Right?

Any advices for me?

4 Replies
Reliable Contributor SafeBoot
Reliable Contributor
Report Inappropriate Content
Message 2 of 5

Re: need to recover a removable drive

You need to select the removable drive in wintech before doing anything, otherwise it will be working off the boot drive.

Then you can view the disk info, load up the sdb and decrypt the correct sector ranges

Highlighted

Re: need to recover a removable drive

You mean selecing the Removable disk in "Disk --> Edit Crypt State" ?

Still Region, Start Sector, and Sector Count 's value is "0" .

Re: need to recover a removable drive

I think I need to find out using workspace if sectors are encrypted or not .

How can I distinguish btw encrypted and normal sectors? Any documents I can refer to?

Reliable Contributor SafeBoot
Reliable Contributor
Report Inappropriate Content
Message 5 of 5

Re: need to recover a removable drive

you have to just guess - if there are no patterns, then it's either encrypted or compressed. If there are ANY patterns, it's certainly not encrypted.

no, don't edit the crypt state - you need to select drive 1 (or whatever drive your drive is), not drive 0, which is the boot drive. 

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community