QQ:Decrypt disk when client not connected to ePO?

[eg211]

Hi there,

I’m wondering without DeTech tool then if we can decrypt client machine when it’s not connected to ePO or has no internet connection.

Thanks in advance.

[sbalamur]

@eg211 Thank you for choosing McAfee Support Community.

If mu understanding is correct you have question on other decrypting tools apart from DETech .

If that is correct then yes we do have other tools for data recovery but no tools have direct option to decrypt a HDD however we have option to bypass drive encryption screen to load into windows using either XML key based or Token based authentication followed COD authentication method to retrieve the data.

The tools are : Winpe & EZEFI/EZMBR - These tools are not built or provided from McAfee as they require Microsoft License and its environment specific.

Please Refer below guide for more information :

Winpe : https://docs.mcafee.com/bundle/drive-encryption-v7-2-0-detech-product/resource/PD26657.pdf

EZEFI /EZMBR : Downloaded the latest EZEFI/EZMBR tool from the below link : https://www.mcafee.com/enterprise/en-in/downloads/free-tools/eztools.html

Reference Video created for EZEFI 9.3 : https://www.youtube.com/watch?v=ufS7tN97txU
Reference Video created for EZMBR 9.2 : https://www.youtube.com/watch?v=SW7JgUl3xRs

Let me know if you any questions !!

[eg211]

@sbalamur Thanks, btw can you elaborate a little more about how to bypass drive encryption screen by using XML key? I tried to find the information in the product guide but didn't find it.. thanks again in advance.

[sbalamur · Accepted solution]

Step 1: Boot the machine from the EETECH Standalone disk

Step 2: Authenticate and Authorize

1. Click on Enable USB

a. Under Authentication, click on File button and select the XML file from the USB Device.

b.Click on Authorize and enter the code of the day (taken from the EETECH Code Generator)

c. On successful authorization, you will see the below screen with status for Authentication and Authorization.

 Step 3: Click on Emergency Boot. This will bypass PBA and boot you into Windows. If there is no Windows loader error like OS corrupted or windows loader is missing .

Let me know if you have any questions.