We are trying to recover a Data HDD of a machine using EETech.. The C Drive (SSD 32GB) has been rebuilt but the Data HDD is still encrypted with the previous build.. Is the D Drive Recoverable? I have the XML and Daily Code and have built the PE and Floppy verisons..
i don't know if this is even possible now due to the C drive being wiped. Also, XML seems to have issues being seen by the EETech boot disk..
Any advice would be great.
You can use force decrypt on the partition after validating the key is correct. Rebuilding the C: drive before doing this obviously complicates matters, but it will work fine as long as you use the right key, and the correct sector range.
If you tell us what the problem reading the XML is, we might be able to help further.
The contents of the D:\ drive are fully recoverable as long as the XML is intact. The EETech version must match the Endpoint Encryption version used to encrypt the drive. When the XML is having 'issues being seen', are you referring to the XML file being present on a flash drive, but when EETech browses that drive the XML is not seen? If so, please ensure the flash drive is FAT32 formatted and that the XML file is one directory off the root of the drive - such as F:\<somefoldername>\<XML file> and then re-attempt to authenticate.
If you prefer to just copy the data off, you can boot via the WinPE w/EETech disk, authenticate with the XML, then browse the D:\ drive to grab what you need.
A force decrypt is only recommended as a last resort (and only after making a sector-level backup of the original drive), since it is generally a one-shot attempt. If it fails for any reason, then the data on that disk (or backup image) is generally very corrupted and possibly unrecoverable.