cancel
Showing results for 
Search instead for 
Did you mean: 

How to perform manual decryption and recover data from DETech Standlone Disk

We have seen same issue in another system also of Lenovo. Error message is same there also.

 

We have tested every possibility of getting the data back from recovery process. We would like to perform one last step from WinPE as well as from Force Crypt Sector.

 

Here we need some help from you, what will be the sector start and Number of Sector from below details as well as on workspace.

 

Disk Crypt List:

Crypt List region Count: 1

Crypt List region 0 Start: 50270208

Crypt List region 0 Count: 449643104

 

Disk partitions:

Partition Count: 5

Partition 0 Type: GPT(0xEE)

Partition 0 Type Name: Unknown

Partition 0 Start Sector: 2048

Partition 0 Sector Count: 1021952

 

Partition 1 Type: GPT(0xEE)

Partition 1 Type Name: EFI System

Partition 1 Start Sector: 1024000

Partition 1 Sector Count: 204800

 

Partition 2 Type: GPT(0xEE)

Partition 2 Type Name: Microsoft Reserved

Partition 2 Start Sector: 1228800

1 EC.jpg2 EC.jpg3 PC .jpg4 PC.jpgPartition 2 Sector Count: 32768

 

Partition 3 Type: GPT(0xEE)

Partition 3 Type Name: Windows data

Partition 3 Start Sector: 1261568

Partition 3 Sector Count: 498651744

 

Partition 4 Type: GPT(0xEE)

Partition 4 Type Name: EFI System

Partition 4 Start Sector: 499913312

Partition 4 Sector Count: 204832

1 Reply
Reliable Contributor ninov_n
Reliable Contributor
Report Inappropriate Content
Message 2 of 2

Re: How to perform manual decryption and recover data from DETech Standlone Disk

Hello,

I think the main issue here is that all your partitions are GPT which is currently not supported for the boot partition of MDE 7.x:

https://kb.mcafee.com/corporate/index?page=content&id=KB75750

Regarding decryption, that error shows that you most probably did not enter correct sectors or there is an issue with the table itself as per the guide:

https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/27000/PD27694/en_US/...

I hope you made a full backup/clone of the disk before trying to decrypt because once started it is irreversible.

Most probably you need to decrypt only partition 3 - Windows data:

0 Unknown
2048
1021952

1 EFI
1024000
204800

2 Microsoft reserved
1228800
32768

3 Windows data
1261568
498651744

4 EFI
499913312
204832

In case above information was useful or answered your question, please select "Accept as Solution" in my reply, or give a Kudo. Thanks!
Nino
More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator