6 Replies Latest reply on Dec 9, 2008 12:46 PM by MiloPod

    Eorr Loading OS

      Hi,

      I forgot I had safeboot installed and resized one of my partitions on my HD. I have one hard drive split into two partitions and just wanted to juggle the sizes around a bit.

      Obviously SafeBoot doesn't like this (I can't believe I did it!) and it now gives me an error saying 'Error Loading Operating System'. I'm guessing the MBR doesn't tie up with the disc content anymore. Is there any fix for this?

      I have the UBCD with SafeTech plugin if that's of any use? When I try setting a safe MBR etc it gives me the error 'SafeBoot Client Not Activated'.

      Using MBRWizard I can see the MBR consists of:

      Pos MBRndx Type/Name Size Active Hide Start Sector Sectors
      0 0 07-NTFS 41G Yes No 63 84,758,877
      1 1 05-FAT16x 35G No No 84,758,940 71,537,445

      Surely there's a way of getting the data back?

      Thanks in advance.
        • 1. RE: Eorr Loading OS
          Which version of "SafeBoot" I guess it must be v3.2 as that's the last time that name was used for the product? grin If it is v3/4, then you're out of luck as neither version supports partition movement. You could try a manual decryption I guess but it's not a supported situation.

          I guess you must have toasted the MBR as the same time - strange as partition moving software doesnt usually mess with the MBR code, it should just change the partition tables.

          If it's v5, doing an emergency boot should fix the problem as long as certain files didn't get moved about. V5 supports partition movements as long as the files in the root of C: don't get moved (which is normally impossible to do anyway).
          • 2. RE: Eorr Loading OS
            Thanks for the response, greatly appreciated :)

            I think it was version 3 or 4 as the most current version had issues being installed.

            Any pointers on performing a manual decryption or any ideas where there may be a how to? :confused:

            I have EnCase forensic edition with the SafeBoot decryption plugin at my disposal so I may give that a try tomorrow if the manual decryption is a no go... thing is I'm guessing that may look for a valid MBR...

            Thanks again.
            • 3. RE: Eorr Loading OS
              your MBR is valid, it's just a normal MBR rather than a SafeBoot MBR.

              your internal helpdesk should be able to decrypt the machine for you - we train pretty much every customer how do do it. Failing that, they can raise a ticket with McAfee support and they will walk the helpdesk through the decryption. If you are an end user, it's not something you can do on your own.

              For the EnCase plugin you're going to need your machine key. Again, unless you're a SafeBoot administrator you're going to need their help to get that anyway. Encase won't let you decrypt the drive, it will just let you inspect the data on it.
              • 4. RE: Eorr Loading OS
                Okay many thanks.

                The IT dept told me earlier that all they could probably do is reformat the drive so I'll tell them what you've said etc.

                I'll also get the machine key for the PC re the EnCase plugin and will take an image of the HD before giving to the IT helpdesk as that way I'll at least be able to get some of my old data off the drive if all else fails!

                happy
                • 5. RE: Eorr Loading OS
                  Encase can't give you the machine key - only the SafeBoot Administrator can do that. You have to give the key to encase, not the other way around.
                  • 6. RE: Eorr Loading OS
                    Yep sorry I didn't explain my intentions very well.

                    Thanks for your help.