cancel
Showing results for 
Search instead for 
Did you mean: 
davidd
Level 7

Windows XP won't boot, can't get at encrypted data

Hello.

My laptop has McAfee Enpoint Encryption 5.1 installed.  It's a Windows XP machine.

At bootup, I log in to EE and Windows starts loading, then it crashes with the error:

STOP: c0000218 {Registry File Failure}

The registry cannot load the hive (file):

\SystemRoot\System32\Config\SOFTWARE

or its lor or alternate.

It is corrupt, absent, or not writable.

Is it possible to get the data off this machine?  My IT department has given up and gave the laptop back to me as-is.

I've tried connecting the drive to another EE protected machine, but Windows doesn't recognize the drive.

I sure hope I haven't lost all that data.

Thanks,

Dave

0 Kudos
4 Replies
SafeBoot
Level 21

Re: Windows XP won't boot, can't get at encrypted data

Unfortunately your it team can decrypt it, but you cant without their help :-(

0 Kudos
davidd
Level 7

Re: Windows XP won't boot, can't get at encrypted data

What do I need from them, the .SDB file and the "daily code"?  Is there anything else?  Can I get the daily code from McAfee, or does it have to be from my IT department?  (I don't know how far they'll go in assisting me in this).

If I follow the directions at the link below, will I get access to the data?

How to use the WinTech CD to remove the encryption and boot sector from the hard disk

https://kc.mcafee.com/corporate/index?page=content&id=KB61117

0 Kudos
davidd
Level 7

Re: Windows XP won't boot, can't get at encrypted data

So I created the WinTech bootable CD (with the MakePECD3.02 batch file provided by your blog) and ran it on my laptop.  I don't have the SDB file yet nor the daily code, but I wanted to see the interface.

It appears to load a version of Windows, and presents a DOS box open to the X: drive.  No Windows Explorer or any other GUI available, and no explorer.exe file either.

Is this normal or did I mess something up?

Should I be using the Windows AIK or the BartPE for EE 5.1?

Thanks again

0 Kudos
SafeBoot
Level 21

Re: Windows XP won't boot, can't get at encrypted data

You need the right version of wintech for your machine, and all the supporting files, if you have working creds you won't need the sdb file.

Yes it sounds like things are missing from your cd - you should find it starts up wintech. You might find the bartpe version easier to work with as it includes  WinPE does not include explorer.

Really this is what your IT team should be doing though, and you will need to get the daily access code from them.

0 Kudos