cancel
Showing results for 
Search instead for 
Did you mean: 

How to perform manual decryption and recover data from DETech Standlone Disk

We have seen same issue in another system also of Lenovo. Error message is same there also.

 

We have tested every possibility of getting the data back from recovery process. We would like to perform one last step from WinPE as well as from Force Crypt Sector.

 

Here we need some help from you, what will be the sector start and Number of Sector from below details as well as on workspace.

 

Disk Crypt List:

Crypt List region Count: 1

Crypt List region 0 Start: 50270208

Crypt List region 0 Count: 449643104

 

Disk partitions:

Partition Count: 5

Partition 0 Type: GPT(0xEE)

Partition 0 Type Name: Unknown

Partition 0 Start Sector: 2048

Partition 0 Sector Count: 1021952

 

Partition 1 Type: GPT(0xEE)

Partition 1 Type Name: EFI System

Partition 1 Start Sector: 1024000

Partition 1 Sector Count: 204800

 

Partition 2 Type: GPT(0xEE)

Partition 2 Type Name: Microsoft Reserved

Partition 2 Start Sector: 1228800

1 EC.jpg2 EC.jpg3 PC .jpg4 PC.jpgPartition 2 Sector Count: 32768

 

Partition 3 Type: GPT(0xEE)

Partition 3 Type Name: Windows data

Partition 3 Start Sector: 1261568

Partition 3 Sector Count: 498651744

 

Partition 4 Type: GPT(0xEE)

Partition 4 Type Name: EFI System

Partition 4 Start Sector: 499913312

Partition 4 Sector Count: 204832

1 Reply
Highlighted
Reliable Contributor ninov_n
Reliable Contributor
Report Inappropriate Content
Message 2 of 2

Re: How to perform manual decryption and recover data from DETech Standlone Disk

Hello,

I think the main issue here is that all your partitions are GPT which is currently not supported for the boot partition of MDE 7.x:

https://kb.mcafee.com/corporate/index?page=content&id=KB75750

Regarding decryption, that error shows that you most probably did not enter correct sectors or there is an issue with the table itself as per the guide:

https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/27000/PD27694/en_US/...

I hope you made a full backup/clone of the disk before trying to decrypt because once started it is irreversible.

Most probably you need to decrypt only partition 3 - Windows data:

0 Unknown
2048
1021952

1 EFI
1024000
204800

2 Microsoft reserved
1228800
32768

3 Windows data
1261568
498651744

4 EFI
499913312
204832

In case above information was useful or answered your question, please select "Accept as Solution" in my reply, or give a Kudo. Thanks!
Nino
More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community