I am stuck at one recovery. Data is important that needs to be recovoered.
[i know new version is released and I should upgrade to latest and we will upgrade soon. but here concern is Data recovery for particular this case. So i request you to suggest me in that way]
Drive is full encrypted and machine was working fine till we got error "Operating system is missing" no PBA was there.
So we have decided to Eboot system.
1. we have authorised and authenticated with database
2. tried to restore EEPC MBR
No Boot disk was not found
Now tried to recover data through Wintech > Authorised > authenticated with DB
But Drive letter is showing in A43 File Management utility but no Data.
than tried to remove safeboot from wintech but giving same error.
I thought its SATA drive problem so Cloned image to IDE drive and treid to recover data in Wintech but no luck.
Now i think i have one option left is Force crypt sectors [decrypt sectors forcefully].... but here something is strange...
My querry starts here (SEE Disk information.jpg)
1. booted system with wintech > Authorised only not authenticated > Disk > Get Disk information
[Got Disk information which is strange (see attached Disk information.jpg)
It is showing all confidential information with even Key Check also.. should it show this confidential information ?? as I was not authenticated.. ? how ever this not my concert right now)..]
2. than authenticated
now I should force crypt sectors >decrpt...
but just to confirm that SDB is valid or not I always decypt sector 63 and tried to read information "NTLDR is missing"
I m also attaching Example of decrypted sector 63 for which i always look[see attached dectypted 63.jpg, attached image is example its not taken from this system.].
but in this case i was not able to read this message. [see decrypted 63.dat taken from original drive]
Than I check Disk info again and saw Machine ID which is 0000451c (check in Disk information image)
now in EEM Machines's ID is showing different 00000cae [check Image1] (How it is possible ? )
Than I thought lets try with the machine which has 0000451c ID in EEM [how ever this is defferent machine and working] but i though this is the id showing in Wintech >disk inforamtion , So i should try and decrypt sector 63 even though i m not able to see that "NTLTD Missing message"
Now sugguest me what sould i do ?
also attaching encrypted sector 63, 2048 and decrypted 63, 2048. [note : I decrypted both sectors with 01HW209472.SDB file]
Message was edited by: Ram Dudani on 8/6/10 1:58:59 AM CDT
Desktop.zip 445.4 K