Good day all
We use Enpoint encryption to encrypt our laptop drives. One of the laptops crashed and the partition table of the hard drive was lost (displays as raw format when plugged in externally). There is some valuble email archives on the laptop that we need to recover. We have a wintech boot disk and the sdb file for the laptop. When logged in to the wintech disk it does not recognise the hard drive. We ran a normal data recovery app on the hard drive and it was able to recover data that was on the hard drive. This data is obviously encrypted. Is there any way to decrypt the recovered data?Message was edited by: stingray on 2013/03/28 5:55:14 AM
Not now no unfortunately as the encryption is sector location specific. What you should have done is decrypted the drive with wintech, THEN ran the data recovery app.
We did actually try to decrypt it with wintech before trying anything, but it did not recognise the drive at all. That was when we discovered that the whole partition was gone.
That's to be expected - wintech won't fix the partition table. But it will/would have decrypted the data.
Then you just had to run a partition recovery tool to put the mbr back together.