did you remember the trick of flushing the key into the driver by test-decrypting a random sector of the disk first? I believe this is fixed with the latest patch 1 version of EETech, but personally I'm so used to doing it anyway to verify everything is ok, I've never tried a remove without doing it first.
Good troubleshooting advice Simon. I have not tried that. This is a test machine anyway so I will try it out here soon.
I decrypted a random sector successfully but Remove EE still hung afterwards. I am using EETech Patch 1. Everything seems to work except for Remove EE.
curious. Do the disk information and sector regions look sensible? Can you decrypt sector ranges successfully?
I would log a ticket, but I'm not sure what support will tell you - you seem to be doing everything right. The only thing I can think of is there's something in WinPE which is stopping access to the disk itself - maybe boot sector protection? Does it work with BartPE by any chance?
I forgot to mention I can only decrypt sectors by the Force Decrypt and not regular Decrypt. When I try the Crypt option it hangs just like Remove EE.
The Disk Information looks like this:
Disk ID: 00
Sector Map: 0000000000059E90
Sector Map Count: 7
Key Check: BFBE5A6CE23FA796
Disk Power Fail State: Inactive
Power-Fail First Sector: 0000000000000000
Power-Fail Sector Count: 0
Disk Crypt List:
Crypt List Region Count: 1
Crypt List Region 0 Start: 0000000000000800
Crypt List Region ) Count: 2449440
Partition Count: 1
Partition 0 Type: OS/2 HPFS (0x07)
Partition 0 Bootable: True
Partition 0 Drive Letter: C:
Partition 0 Start Sector: 2048
Partition 0 Sector Count: 25161728
Partition 0 Bus Type: Unknown
I will look into boot sector protection. I did not think of that.
I will build a BartsPE and give you a status report.
strange - the difference between the two is that the normal crypt option checks (and updates) the region lists with any changes you make - so it won't decrypt things that are not already encrypted (and won't crypt things that are).
Your part info is strange, the starting sector for example? But, since it has a region and disk info, it must be a hard disk - usually I'd get you to check that EETech was looking at the right volume..
It all looks good, so I see no reason why you could not force decrypt the range, then restore the original MBR. You might want to see what Bart does though just for interest.
What's in your WinPE image apart from the default Microsoft stuff?
I would check disk info using Standalone EETech, since that worked.
I have these programs and packages on the WinPE:
nothing odd there - imagex is not one I've used, but I can't see why it would cause these symptoms.