8 Replies Latest reply on Aug 3, 2009 3:46 PM by SafeBoot

    Need Safeboot Recovery CD

      Dear McAfee Support,

      1) I am trying to recover some important files from HDD from a friend.
      My friend formatted the HDD with Safeboot without backing up the files.
      No program on an external Windows or Linux HDD can recover files from the encrypted HDD.
      I tried installing Windows XP on the Safeboot HDD which completed without any problems. If I set the HDD as primairy boot Windows boots without asking for Safeboot. If I select the boot options list in the BOOT I came into the Safeboot login screen where I logged in (I have both username and password) but then I got the message: Error loading Operating System.
      I then reconnected the other SATA HDD with Vista on it to see what my options were because I was certain that I would not be able to recover the files in question when booting Windows without first having logged in to the Safeboot system. (I still don't understand why I could boot WinXP in the first place without logging in to the system).
      The Vista boot somehow got corrupted so I fixed it using the Vista DVD.
      After that the Safeboot HDD got corrupted (92h).

      This is the point I'm stuck at, because I only have the login / pass and no possible recovery software.

      I read in this article that as of tomorrow (31st March) I can get the Code of the Day automatically by supplying the login / pass through the web system. The only problem is that I do not have the recovery software to fix the error 92h.

      Is there any possible way to obtain the recovery software that belongs to my Safeboot, considering I have the login / pass? (Wintech?)


      2) Next question:

      With the recovery software, after fixing the error, is it possible to (temporarely) remove Safeboot and low-level scan the HDD for the lost files and recover them? (which is impossible when Safeboot is active)


      Thank you in advance for answering!

      EDIT: Safeboot 4.2 is used on the Safeboot HDD.
        • 1. RE: Need Safeboot Recovery CD
          this is not McAfee support - this is the community forums?

          For help, the best thing to do would be for your friend to call >his< IT department - they will have all the necessary tools to get the data back off your friends machine. We don't sell encryption to individuals, so your friend's machine must be protected by some corporate owned software?

          so.

          1. Your friend can work with his IT department to get the recovery package.
          2. Doubtful - you've tinkered a lot with this machine - if you actually re-installed XP on the machine you must have formatted the drive (thus all the data is probably gone now).

          probably the reason the data is gone is because you formatted the drive while trying to bypass the security by reinstalling XP?

          Can you explain what the original reason to reinstall XP was? It's not mentioned in your post what you were trying to achieve, or what the original problem your friend has was?
          • 2. RE: Need Safeboot Recovery CD
            SafeBoot, thank you for replying.

            I did not notice this isn't the McAfee support forum, for some reason.

            The fact is that this computer belongs to a certain bank which has an IT department which can not recover the HDD files that were on there either. Only the external company which they let do all the SafeBoot work claims to be able to repair this problem, for at least 1000.- Euro and probably a lot more, which is plain ridiculous. Hence the reason my friend gave me the HDD to try to recover his lost data.

            Recovering lost data from a previous format isn't a problem at all on hard disks. With standard programs one can recover up to 8 layers of formats, I've done so many times before, hence another reason my friend hopes I can recover this one too.

            The only previous formats that are found are a mere two, which are both empty except for the NTFS file structure, which wonders me too. My friend's IT department formatted the HDD and there lost the important files. After that it has been formatted (NOT low-level, just standard) once more, not by me either.
            I do not know whether my friend's IT department has Low-Level formatted the HDD and then put SafeBoot back on (which would mean all data is physically gone) or just made a standard format, which should mean there are differnet layers of files which I should be able to recover.

            Factually, before I installed XP on the clean HDD (I NEVER formatted it) I tried several data-recovery programs which only found the previously called two NTFS file structures, and nothing reasonable to recover.
            There is only one program, EASEUS, which gives a different result, with only the following three extension:
            .gz = 50MB files
            .doc = a file of 2GB
            .swf = ranging from 400MB to 4GB

            These files could be recovered but were RAW data.

            The reason I installed XP was because I wanted a normal bootable OS on the HDD. I could then log in to SafeBoot which would load the OS in which I hoped then to be able to recover the lost files, because I got past the SafeBoot.
            Then the following occured, as posted in my first post:

             

            If I set the HDD as primairy boot Windows boots without asking for Safeboot. If I select the boot options list in the BOOT I came into the Safeboot login screen where I logged in (I have both username and password) but then I got the message: Error loading Operating System.



            His original problem was that he said he had all files backed up, the IT-department formatted the HDD and they then figured out they lost two important .nfs (Lotus Archives) files.
            Figuring they want to recover those two files they called the external company which is responsable for the operation of SafeBoot and they claimed to be able to recover these files for a horrifyingly high sum.

            Hence I am trying to recover these files for free.


            If the last, most ever last, solution is that he/she has to send the HDD in and has to pay for it, then so be it, but until I've tried my very last I will keep trying my best.


            I figured I will be able to restore SafeBoot tomorrow with the given Code of the Day, as long as I simply have the recovery software on the so-called Wintech or Safetech CD, hence the reason I'm trying to obtain this software.

            I'm not at all familiar with Safeboot so I'm trying to do the right thing as much as possible, trying not to break anything nor ending up having to pay a lot for the recovery.


            I hope this was of any help.
            Thanks for replying in advance, I will be back tomorrow late or the day after.
            • 3. RE: Need Safeboot Recovery CD
              If you decrypt the drive, you will be making serious changes to the sectors of the disk and it's quite possible this will make more advanced recovery unsuccessful. Recovery techniques used by 3rd party companies rely on as little change to the disk as possible, and you've already made drastic changes (not just re-imaging the machine but re-encrypting the machine as well which touches each and every sector of the disk).

              Further more, if the drive was encrypted when his files were there the first time (which I suspect it was), then your recovery software would not be able to read the erased encrypted sectors. Well, it could read the sectors, but it wouldn't be able to make heads or tails of them and in all likelihood wouldn't be able to find any specific files spread across one or more of the sectors of the hard disk.

              If there's any hope of recovering the data, you really need to get the pros involved before you muck around with the drive any more. Make sure before you send them anything that they understand that the drive used Full Disk Encryption and that they support attempting to recover data from an encrypted drive.

              This is **very different** than file and folder encryption where they'd be able to see the file existed but not be able to get at the data and use your decryption key to get at the info.

              But, with all that said, for what it's worth, yes, with the recovery software and the Code of the Day, and your friends username and password, you will be able to decrypt the drive. But your friend really should be working with his or her IT department. If the data is business critical, they need to take over now.
              • 4. RE: Need Safeboot Recovery CD
                Thank you for your reply.

                I suppose that pretty much sums up what needs to be done.

                Most probably the data couldn't be recovered in the first place because they were as smart to format the drive twice.

                The only thing I did, was basically installing Win XP which somehow to around the SafeBoot as explained (probably because it reinstalled a MBR).

                If there's any more input on this I'm open to hear so.

                If not, I'll let him send the disk in asap.

                Thank you again.
                • 5. RE: Need Safeboot Recovery CD
                  if the drive was encrypted, you're done for. There's no way any data recovery agency will be able to recover any files from the encrypted drive without the key file for it (which your friends IT department will have). That's the whole point of "SafeBoot".

                  I agree, quick format does not change the contents of the drive, it just marks the sectors as free, BUT, I've never heard of anyone successfully scraping previous data from a modern fully formatted drive - the track sizes and magnetic variances are simply too small now - there's no overspill like there was 10 years ago.

                  What worries me is that your quote:

                  Most probably the data couldn't be recovered in the first place because they were as smart to format the drive twice.

                  Someone didn't want this data to be accessible - I'm tempted to leave it at that - if it was a corporate machine, it was their data, not your friends. If his IT department chose to scrub it then that's their choice. By trying to recover the data you may be putting yourself in an interesting legal position.

                  Reinstalling XP didn't get around anything - it just put a completely new OS on the drive, overwriting the previous encrypted data with fresh plain-text information. The only stuff that could possibly be recoverable is the data in the sectors outside your new partition.
                  • 6. RE: Need Safeboot Recovery CD
                    Hi

                    I have really big problem with HP Drive encryption preinstalled on my HP 2230s. I use this program from HP Protecttools. I enter the password. I create HpDriveEncryptionBackup too.after notebook restart, i wrote password, but it showing Error: 0xe0010002 and bellow text Authentication parameters incorrect.i used HpDriveEncryptionBackup.dat file, when i select local recovery in option and used recovery file.It took it but during starting Windows need password again. Im trying to use the password but always incorect. I should reinstall or format disc but bios is locked via protecttools too, that i cant change boot sequence.I CAN DO NOTHOING!!!!! What i can do? I have only recovery file and when i click on WEB recovery there is the number which i can send you. I cant understand why my password is incorrect.
                    Im send many email to HP or on protecttools@hp.com but no answer

                    I NEED HELP AS SOON AS POSSIBLE PLEASE

                    best regart Milan Zubricky
                    • 7. I have really big problem with HP Drive encryption
                      Hi

                      I have really big problem with HP Drive encryption preinstalled on my HP 2230s. I use this program from HP Protecttools. I enter the password. I create HpDriveEncryptionBackup too.after notebook restart, i wrote password, but it showing Error: 0xe0010002 and bellow text Authentication parameters incorrect.i used HpDriveEncryptionBackup.dat file, when i select local recovery in option and used recovery file.It took it but during starting Windows need password again. Im trying to use the password but always incorect. I should reinstall or format disc but bios is locked via protecttools too, that i cant change boot sequence.I CAN DO NOTHOING!!!!! What i can do? I have only recovery file and when i click on WEB recovery there is the number which i can send you. I cant understand why my password is incorrect.
                      Im send many email to HP or on protecttools@hp.com but no answer

                      I NEED HELP AS SOON AS POSSIBLE PLEASE

                      best regart Milan Zubricky
                      • 8. RE: I have really big problem with HP Drive encryption
                        please don't spam threads with unrelated questions? You also started a new thread with this very same topic.