Drive decryption issue

[guillaumec.]

Hi all,

I'd like to ask a question to the community about a big problem we have actually.

A disk has been decrypted with an incorrect .xml file and user's data are now inacessible.

I'd like to know if there's any possibility to retrieve user's data or to do a "rollback" ?

I thank you in advance for all the help you could provide me.

(Please excuse me for my bad English)

[Peacekeeper]

What program is this with respect to?

[guillaumec.]

Program ? I'm not sure to understand what you mean ?

Drive is encrypted with McAfee Drive Encryption, is this what you want to know ?

[Peacekeeper]

Is it EPO  or epo managed  or EEM managed just need the program you are using so i can move post to a better area

[guillaumec.]

What is the différence between EPO or EPO manage ? I retreived the decryption file from EPO console if this can help to determine which one.

[exbrit]

He is asking because you've posted in an area devoted to Community Support only.   What exact McAfee product(s) are you using so he can move the topic over?

[Peacekeeper]

I will try the EPO forum

[guillaumec.]

Yes please. Issue is still unresolved and the McAfee specialists from my enterprise can't help.

[Peacekeeper]

Well it has been moved hope someone can assist you

[cyberbm]

Hi there,

since you're talking about .XML recovery file, I'm assuming that you have the machine encrypted with McAfee Drive Encryption managed by ePO server. Your IT team should have used the McAfee Disaster Recovery tools to apply the wrong .XML file, although that's not so easy...in the same tools there is an option called Force Crypt Sectors where you can apply the same key (.XML file) but this time to encrypt the drive. This will "revert" the state and then they can apply the correct .XML file to decrypt.

Note that it's best practice to create a sector by sector copy of the original disk before doing any further actions and work with the cloned hard drive.

Keep us posted.