This content has been marked as final. Show 12 replies
call your helpdesk and confess ;-)
You've trashed the boot sectors, it's recoverable of course, but you need your helpdesk really to assist you through the process.
Thanks for your prompt reply.
I did consult my helpdesk and that were the only 2 ways they advised me to do, and they told me that's all they can help, i need to format and reinstall windows.... but I don't want to as I have a lot of critical data inside.
Please let me know the process, you can email me at email@example.com if it's not convenient for you to post it here
it's not so much inconvenient, in that it's your helpdesk who have responsibility for the data on your machine - if they don't want to help you it's not my place to bypass them - maybe they have a good reason not to want your data recovered?
But, simply the fastest way to get your data back would be for you to boot off a WinTech CD, authenticate with the SDB export from the corporate recovery system, then mount the drive a nd copy the data off.
What if LBA "0" that contained the SafeBoot information was damaged and lost? Would the .SDB be able to provide the missing information about the disk parameters and missing SafeBoot FS and still mount the drive in WinTech to recover the data?
no. In that case you'd need to restore the MBR first using WinTech/SafeTech, then decrypt the drive.
I've tried to rebuild the MBR from WinTech, but the result is that the "can't find a system boot drive".
I assume that the area (sector) of the drive that indicates how much of the partition is encrypted is also damaged or blank.
I replaced the failed block (lba 0) with SafeBoot info from another drive (different capacity). It was successful seeing the drive in WinTech, but the Crypt List was still "0"d out. When attempting to recover the data the recovery application running in the background to WinTech indicated physical 160GB, but partition was relative to the other drive (320GB). So, the recovery wasn't successful at all. Basically, I believe the .SDB allows the pass through to the data, but only to the sectors mapped out in the Crypt List.
This is where my problem is. I can't rebuild the MBR, can't mount the SBFS, can't see the data.
Is it possible to use the same capacity, same computer name & then pull lba "0" and apply it to the bad drive to recover the data?
Thanks in advance
in a word, no.
you need to use a safetech disk, load the details from an export of the machine from your db, then restore the original MBR.
the crypt info is gone as the link to that was in the original SBR. you might find the disk info through safetech and the imported definition, but you might not.
if not, you'll have to do a manual decryption of the sector ranges.
write down everything you do which writes to the drive, otherwise if you make a mistake it will be impossible to recover from.
When you refer to the export are you meaning the .SDB file that was generated for that system?
If so, then that's what I have. It doesn't generate any errors when applied, but the crypt list data is still zeros.
If the next step is utilizing the SafeTech CD (and that's different from WinTech) how would obtain that CD?
The original problem was that when the notebook was undocked the screen was blank. So, the user hard powered off the system. When she turned it back on it basically stated "no bootable devices".
It was obvious that SafeBoot was updating LBA "0" as that sector then was reported as an ECC error. Once, corrected the defect was gone, but the data in that sector (SafeBoot data) was also gone.
It would be nice if the disk information could be manually rebuilt and the original .SDB could be used to decrypt the drive.
it can. you just need to use the right tool for the job.
I guess WinTech told you there was no boot disk because you don't have the right SATA drivers in your WinPE image? If you can't see the drive in my computer, then this is the case.
you can build a SafeTech disk straight out of the recovery menu in SBAdmin.
We only update sector 0 once (on activation). I guess you might have something else in the way though (like computrace?)
you might want to start a new thread next time if your info is not related to the original problem happy