I have a notebook that was given to me by my employer. It has McAfee Endpoint Encryption installed on it. A few days ago I connected an external HDD to it via eSATA. No messages or dialogs were presented to me, and at first, everything worked perfectly, drive was accessible and readable. Next day, the drive was totally inaccessible. When I attach it to the notebook, I see two new drives appear in my Explorer (that is correct, the drive has two partitions) but when I try to open them, a message "Drive is not formatted, do you want to format it?" appears. At first, I thought that I was unlucky to have a HDD failure, and tried to use several recovery tools. None of them produced any results, so that led me to conclusion that the drive might have been encrypted by McAfee fully (or partially) during the first session.
I am attaching a screenshot of a window that appears after I click "Show Endpoint Encryption Status".
Please help me understand what happened and get my data back.
Windows sees eSata as internal so EEPC applies the encryption.
Microsoft says they made a hotfix that should sort things out, but it never worked for me.
Thanks for the reply.
My HDD is not accessible when I connect it via eSATA again, so I guess the proicess of encryption didn't go well. Is there a way to know the status of the encryption on the HDD? If it is completely encrypted, then why I can't read from it?
Can you describe exactly what tools you used, and what changes they made to the drive? Without knowing that it's hard to work out if the drive can be recovered.
Your helpdesk could decrypt the drive, but depending on what the tools did, it may not solve the problem.
I did't use any tools. McAfee Endpoint Encryption software acted on its own, so to speak. And it didn't communicate with me at all in the process, so I am not sure what changes exactly were made to the drive.
Or do you mean "what recovery tools I used"?Message was edited by: n1313 on 7/24/12 10:09:31 AM CDT
I tried R-Studio and GetDataBack and I hope they didn't make any changes to the drive.
I mean, I'm trying to read from the drive, why should they write to it?Message was edited by: n1313 on 7/24/12 10:15:04 AM CDT
Not sure. You would need to ask those vendors. I think your best best bet is to ask your it team to decrypt the drive, and hope that the changes were not too critical and that one of these tools can recover the files once the drive is in plain text.