I have hdd with 2 partitions which was encrypted with safeboot. Both partitions( 30gb, 200gb ) are deleted and then created new partition of 30gb and installed xp without safeboot, now looking for data in 2nd partition which was encrypted and deleted (not overwritten ). I have Bart-pecd and machine config file (SDB file). I took the image of entire hdd. Now is there any way to decrypt entire hdd so that i can recover files from 2 nd partition or any way to run data recovery tools along with SDB file and Bart-Pe cd. When i run sbwintech.exe its asking for logical drive but no option for physical drive.
Thanks for any help
Yes - you can just use the hard disk functions of WinTech to decrypt a sector range (from the disk info screen). WinTech is asking for a physical drive - it does not care too much about logical drives.
This a bit complex..
Even though you recreate new same 30gb partition you may not partition it on the same sector
unless youre pretty sure you repartition it the same sector as before..
- using wintech restore eepc mbr
- check diskinfor for crypt list
- used crypt list infomation for force crypt option (sector by sector decryption)
I'm not sure after decryption you can be able to read your data content, if you're lucky you may able to read it if you're not destroy the old partition information by repartition it..
If NOT then I would sugest you get third party recovery tools to analyze your disk structure and recover back your files on 2nd partition after your decryption done..Message was edited by: mirrorless on 5/13/11 3:18:33 AM CDT
Thanks alot for the replys,
Now i came to know that there is a possibility to decrypt the sector range .
Yes , the 1 st partition may be overlapped (overwritten ) the initial part of the 2nd partition, in that case boot sector & MFT some entrieswill be damaged , still we can retrive ntfs data from remaining portion using virtual boot record creation or third party tools.
I am new to BART PE . My doubts are very basic and may be silly for pros. , but this is only site i found reliable and dependable.
1. Am i using right cd? when i try to boot through cd its showing at starup " 2008-06-07-BartPe-Safeboot/Wintech support ver 4 & 5 Encryption". Or i need create another one?
Because i have not found option to run wintech.exe but sbwintech.exe is available which is working with logical partition
2. Right now i am not using access/autherisation code,to get more options. is it required?
3. Presently i am working on cloned drive , Can i try something
Thanks for any help/ guidence
The best advice I can give you is to let your IT team handle this - they will have been through training etc on this kind of thing and should be familier with all the tools.
Agree with simon if possible get your IT team to handle..
but my experiance not all It team would have experiance to do recovery.. so hopefully you can get IT team with recovery knewledge.
To recover you will need key SDB file from your MEE server..
Since the location of SBFS has been destroy or may rewriten after you install new OS.
After you get the key/sdb file check whether it's valid key for decryption.. using workspace..
check sector outside partition 1 because partition 1 already installed with new OS so data alrady rewriten..
check the partition which is not touch by installation and partitioning ..
if you confirm that the key is correct then use force crypt and do sector by sector decryption..
only after decryption you can get recovery tools to analyze your hardisk..