I am in very difficult situation that you guys must help me.
I have many expriences in recovering data in the enrypted HDD(I am using 5.2.9).
But, this case is the very first time : (
One user visisted IT helpdesk to format his PC. Before he do that, he did tranfer his files to his own External HDD drive.
A file transfer completed successfully and carried out formatting his PC.
After formatting, he tried to copy the backed up files to the newly installed PC.
But the external drive was not recognized properly and asked for formatting, which meant it was encrypted.
Here is a weired thing, coz, policy does not allow to encrypt a removable media, and only allows to encrypt C: / D:
Anyway, what I did to solve this issue was that I tried a wintech recovery with a previous SDB database.
I tried "Remove EEPC" but it gave me an error, and tried to look up information in "Edit Crypt state", but it displayed as "0" .
None of functions to decrypt worked.
I think one thing I can do is "Manual Decryption". But, here is the question.
How can I determine how many sectors of the disk are encrypted? I am sure this disk is not fully encrypted, but partailly.
Decrypting all the sectors for the disk that are partially encrypted does not help resolve this issue. Right?
Any advices for me?
You need to select the removable drive in wintech before doing anything, otherwise it will be working off the boot drive.
Then you can view the disk info, load up the sdb and decrypt the correct sector ranges
I think I need to find out using workspace if sectors are encrypted or not .
How can I distinguish btw encrypted and normal sectors? Any documents I can refer to?
you have to just guess - if there are no patterns, then it's either encrypted or compressed. If there are ANY patterns, it's certainly not encrypted.
no, don't edit the crypt state - you need to select drive 1 (or whatever drive your drive is), not drive 0, which is the boot drive.