8 Replies Latest reply on Aug 24, 2014 7:49 AM by exbrit Branched to a new discussion.

    How to recover data from EEPC encrypted volume?

      Hi,

       

      I had Vista installed on my office laptop with EEPC. I had 3 drives, C, D and E. All my personal and some project data was there in D & E. There was some problems in the OS, so our IT guys formatted C and installed XP. After this, the volume D is shown as empty and clicking on E throwing this message "Drive not formatted. Do you want to format it now?". They have installed the Endpoint Encryption software again with the existing sdb file for the pc. But this does not help. Now they are saying the data cannot be recovered.

       

      Do I have any options to recover the data? Or there is no hope?

       

      Any help will be greatly appreciated.

       

      Thanks,

      Prasenjit

        • 1. Re: How to recover data from EEPC encrypted volume?

          they need to do a decrypt of the other two drives with WinTech.

           

          they should have done this before blowing the original OS away, now they have to force it. There's no reason why they can't get the data back though as long as they have your machines original database record.

           

          No, reinstalling would not help - the key changes when you install.

          1 of 1 people found this helpful
          • 2. Re: How to recover data from EEPC encrypted volume?

            Thanks SafeBoot. I'll forward your response to our IT guys. Lets hope for the best.

            • 3. Re: How to recover data from EEPC encrypted volume?

              Hi,

               

              Our network guys have force decrypted the entire harddisk, starting from sector 0. After restarting the laptop with SafeBoot CD, no partitions are being displayed. Now they are trying to force encrypt the entire harddisk again hoping to recover (rather undo the last mistake) the partition information. If this works, they will again decrypt the sectors for the two volumes (hopefully not the entire disk this time).

               

              Is it going to work? .. some word of encouragement please..

               

               

              Thanks,

               

              Prasenjit

              • 4. Re: How to recover data from EEPC encrypted volume?

                dprasen wrote:

                 

                Hi,

                 

                Our network guys have force decrypted the entire harddisk, starting from sector 0. After restarting the laptop with SafeBoot CD, no partitions are being displayed. Now they are trying to force encrypt the entire harddisk again hoping to recover (rather undo the last mistake) the partition information. If this works, they will again decrypt the sectors for the two volumes (hopefully not the entire disk this time).

                 

                Is it going to work? .. some word of encouragement please..

                 

                 

                Thanks,

                 

                Prasenjit

                 

                Decrypting everything from sector 0 onwards also means that the MBR and disk information gets decrypted, whereas this was originally not encryptdd (note: every partition has a partition gap of - usually - 63 sectors, we do not encrypt this). This means that when you would like to decrypt 3 partitions, you will need to do this on a per-partition basis.

                 

                By looking at the partition information (Disk Information from WinTech/SafeTech) you will see the start sector and the sector count. This is the range that you will need to decrypt. Do not include the partition gaps, as this will cause the damage you're having now.

                 

                As for if it's going to work - theoretically I would say "yes", I wouldn't see why not, assuming all goes well and assuming they are doing the process correclty (not decrypting data by accident rather than encrypting, or vice versa etc etc - the common mistakes). Suggestible if making a clone from the HD beforehand to be safe.

                1 of 1 people found this helpful
                • 5. Re: How to recover data from EEPC encrypted volume?

                  you could just re-encrypt sector 0 (the partition table), the rest of the gap does not normally matter. Then you should be able to see the plain text partitions at least?

                   

                  Your helpdesk might want to get some training ;-)

                  1 of 1 people found this helpful
                  • 6. Re: How to recover data from EEPC encrypted volume?

                    Based on "Network guys" doing the work, and clearly not understanding what they're doing...I'm betting you won't see this data again.

                     

                    Don't let network guys work on PC/software problems!

                    (And don't let security guys work on your network!)

                    • 7. Re: How to recover data from EEPC encrypted volume?

                      Thanks to SafeBoot and Eelco. I finally got my data back. It took me 5 days to get back 24.5 GB of 25 GB. 0.5 GB is lost.

                       

                      Partitions came back after re-encrypting sector 0. But the disk information in Wintech was showing 4 partitions, 2 of them overlapping. After force decrypt of the volums, I got back data from one volume. The other one was only showing system directories. We thought index entries might be missing, so tried one data recovery tool, Power Data Recovery. It recovered everything except one directory.

                       

                      Thanks again.

                      • 8. Re: How to recover data from EEPC encrypted volume?
                        exbrit

                        Anyone with similar issues please start a new discussion, thank you.

                        Thread locked due to age.

                         

                        Peter

                        Volunteer Moderator