OS: Win7 32 bit
I continually see computers coming to me with Error 92H (EpePC has been corrupted (error 92h))at bootup. I have tried repairing these computers by browsing documentation, reading these support forms, and plenty of googling. I am almost always unable to read the disk information (gives an error of ERROR: Disk Information not available) and can't authenticate with the Token. I am curious if there is a support document or known issue that I am missing with this.
Solved! Go to Solution.
depends on how much of the drive has been broken - I'd poke about at the beginning and see how far you have to go before things start decrypting. If it's not too far, do a force decrypt on the whole drive, and then use a file recovery tool.
The error means that the preboot loader can no longer find the preboot file system on the disk - the loader knows exactly which sector it's on, and it's no longer there.
so, things that can cause this:
1. third party defrag routines which move files marked as "unmovable"
2. formatting the boot disk and reinstalling the OS
3. using third party tools which claim to "delete" unneeded files
You'll always get a disk info error with a 92H because that's what a 92H means - the disk information has been moved or deleted. Some versions of EEPC have a "search for pre-boot file system" or "repair disk information" which can find it if it got moved, but not if it got deleted or overwritten.
interesting.. I always assumed it was a virus or root kit trojan. I guess my question would morph into how do you repair it if the file has been deleted (get disk information and repair disk information never work.)
Emergency boot should repair anything for you.
A rootkit usually manifests as "EEPC Not Installed" after a successful pre-boot auth.
I had a total of 3 machines come to me with this error today. Emergency Boot only worked with one of those. I was able to authenticate with token on the one that would emergency boot only. the other two failed to token authenticate and I had to use the .xml file for that machine. All 3 users reported to me that it happened after downloading something off the internet (thats why I assumed it was virus related).
possibly an unsuccessful root kit.
but, if you can auth with token then it's unlikey you need to do an e-boot, and if you e-boot a machine with a rootkit, chances are high the root kit will just put itself back.
Getting a 92H and still being able to auth from token would be very strange as it would indicate the disk info was still ok, so why would you get a 92H, unless that is that something broke the PBFS in the middle rather than completely.
I am always frustrated by users who "downloaded something".. - without knowing the specifics or spending a lot of time doing forensics it's hard to really get to the root cause.
Ok, so what is the next step if I have the 92H error and when trying authenticate with token I get the Error EE020006 (Endpoint Encryption disk information not present)?
Sorry to bug you with all the questions (I do appreciate you taking the time to answer). Is there a troubleshooting guide for this?
The next step would be to auth from the XML file from EPO - then you should be able to "fix disk information" in some versions, otherwise you'd need to either eBoot or force decrypt after confirming the key using the workspace.
This is where I'm looking for some sort of documentation. I know some general stuff on this as I have read what little documentation I have found. But I just wish there was something to answer the questions listed below.
"Fix Disk Information" fails to work - Why? What Versions does this work on?
How do you "confirm the key using the workspace"?
How do you force decrypt?
Best Practices for troubleshooting these errors?
When I try to auth from the XML file I receive an error "Failed to retrieve key check from disk the primary disk. Press OK to proceed to authenticate"
After I press OK and go to emergency boot I receive an error "The Current MBR contains invalid McAfee Endpoint Encryption Disk Information." Then it tries to search for the boot disk for valid info. but fails to find anything.
I think this user may just be out of luck on her data.Message was edited by: tcox8 on 1/27/14 9:26:42 AM CST