cancel
Showing results for 
Search instead for 
Did you mean: 

Recover the first sectors of an encrypted drive REMOVE EE ERROR: EE02000A chain sector invalid

A customer of ours uses McAfee Data Encryption/Endpoint Encryption. Due to a malware incident, the first sectors of the drive have been altered.
With the XML file that is used for EETech/DETech we are able to restore the original MBR (not the windows one, but the McAfee MBR)

When trying to "Remove EE" in EETech I get the Error "EE02000A chain sector invalid". Emergency Boot does not work either (BOOTMGR is missing).

My guess is that not only the MBR has been overwritten by the malware but also further sectors that are required for the McAfee DE/EE boot process?!

Is there anything I can do to decrypt the volume?

Online sources claim that 34 sectors including the mbr have been altered.

Is there any essential information stored in the first 33 sectors behind the mbr that is not recoverable? (like the internal AES key in any form) ?
Or can the sectors 2-34 (or the subset necessary for decription) be restored havon the XML which contains the epe mbr?

I was able to recover data from non-encrypted volumes, but obviously I cannot "break" the McAfee Encryption.

2 Replies
Reliable Contributor catdaddy
Reliable Contributor
Report Inappropriate Content
Message 2 of 3

Re: Recover the first sectors of an encrypted drive REMOVE EE ERROR: EE02000A chain sector invalid

Note: Moved from Moderation Queue.

Cliff
McAfee Volunteer
Highlighted

Re: Recover the first sectors of an encrypted drive REMOVE EE ERROR: EE02000A chain sector invalid

You can try starting so called manual decryption. Use the XML to authenticate and the code of the day to authorize. Go to "Disk Information" and write down the starting sector and the sector count for the encrypted partition, then go to Force Crypt Sectors and enter the same values and press Decrypt.

Note that it's recommended to do a sector by sector copy of the disk and work on the cloned one, not on the original HDD.

Let us know if this worked.

Get secure. Stay secure.
More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community