I'd like to ask a question to the community about a big problem we have actually.
A disk has been decrypted with an incorrect .xml file and user's data are now inacessible.
I'd like to know if there's any possibility to retrieve user's data or to do a "rollback" ?
I thank you in advance for all the help you could provide me.
(Please excuse me for my bad English)
since you're talking about .XML recovery file, I'm assuming that you have the machine encrypted with McAfee Drive Encryption managed by ePO server. Your IT team should have used the McAfee Disaster Recovery tools to apply the wrong .XML file, although that's not so easy...in the same tools there is an option called Force Crypt Sectors where you can apply the same key (.XML file) but this time to encrypt the drive. This will "revert" the state and then they can apply the correct .XML file to decrypt.
Note that it's best practice to create a sector by sector copy of the original disk before doing any further actions and work with the cloned hard drive.
Keep us posted.