1 2 Previous Next 13 Replies Latest reply on Dec 16, 2010 10:22 AM by SafeBoot

    external hdd with endpoint encryption needs to be read

      Hi guys,

       

      I have the problem that i have had a small disk (60 gb) and wanted to extend to a bigger one (320 gb).

       

      Therefore I tried to deinstall the ee and tried to access my data. But somewhere i make a mistake and saw to continue press anykey to format or f11 to terminate. I pressed F11 and the last I saw was formating ....

       

      now I have reinstalled my os and reencrypted. I have my login for the disk and my password but i cannot access the disk. I have build a bartpe with old safetech tools 5.1.0.1.

       

      I have the code of the day, I can see the disk, but I am not able to access or mount the disk, it says: "Safeboot client not activated" and error code 0xe0050001

       

      Is there an newer version of the tool to build within bartpe (wintech cd or safeboot cd) to give it a new try ?

       

      Regards

       

      coconut

       

       

      Message was edited by: coconut uploaded photo from disk info  on 12/7/10 2:49:40 AM CST
        • 1. Re: external hdd with endpoint encryption needs to be read

          If the disk was owerwritten (formatted), then data is most likely gone.

          • 2. Re: external hdd with endpoint encryption needs to be read
            TechSecurityNate

            First, when slaving a drive to recover data, you must keep one very important aspect in mind...

             

            When you use the Wintech CD, you authorize with the code of the day, but you authenticate with your login to the LOCAL database.  Every install has a unique database and machine key and you must authenticate to the one on the drive in question.  Someone may need to enlighten me, but I've always had to authenticate using the database file option, not the SBFS option in this scenario.

             

            This is done by getting the machine key by doing an export when right clicking the machine in EEM.  This file is placed on a USB and must be inserted prior to bootup because the 5.1 recovery disks cannot mount drives plug and play.

             

            When you authenticate this way, your primary drive will appear to be un-readable so don't freak out.  Due to the possible format of the slave drive, it may not be readable in the A43 utility either.  However, you should be able to open the workspace and view the raw data to find how far the format went.  You would need to do a force decrypt of the drive to hopefully recover data, but it's critical to use the proper machine key and find the end of that formatting.

             

             

            Message was edited by: TechSecurityNate on 12/7/10 6:41:01 AM CST
            1 of 1 people found this helpful
            • 3. Re: external hdd with endpoint encryption needs to be read

              Hello all together,

               

              perhaps I need to tell you that this is hp internal. So I do not have those files in question. We have only our login name and password.

               

              So I have contacted my support team and they told me that they could not help me and that the files are lost.

              I am not willing to accept this and managed to build a bart pe with safeboot tools (old ones 5.1.0.1) but I am not able to get access to my disk (were still important files for me are stored)

               

              The format did not run quite long, just a few seconds but now the disk states it is not bootable.

               

              As you might see in the picture before you see my 2 partitions (one hidden 5 - 6 gb and one normal c with 55 gb) so I belive that all my files are still available or perhaps accessable. But i need to bypass the encryption.

               

              I saw in other forums a screen from safe boot with a login and password field - this is where I want to get ..

               

              Do you see any chance to get there ?

               

              Best regards

               

              coconut

              • 4. Re: external hdd with endpoint encryption needs to be read

                you post is a little confusing.

                 

                Are you saying you formatted and reinstalled, plus reencrypted your C drive with a new OS, and partially formatted your E drive (which was also encrypted previously), and now you want to recover your E drive.

                 

                BUT your internal support people don't want you to recover your E drive?

                • 5. Re: external hdd with endpoint encryption needs to be read

                  Hello,

                   

                  no it starts with my old smal 60 gb drive and a new 320 gb drive

                   

                  i wanted to uninstall ee and then do a cloning of the disk

                   

                  i made a mistake - the screen with format or press f11 come up, it started shortly to format and now will not boot anymore

                   

                  then i left the 60 gb drive as it was unable to boot and installed the new 320 gb drive and newly installed all what i needed

                   

                  this is now also encrypted (no problem at all) but i want to get access to my old encrypted hdd to try with any recorery software to get my data back after formating ...

                   

                  so right now the situation is that i have the old disk in an external hdd cage and connected to an pc running from the bart pe with safetech tools and trying to access it ...

                   

                  this old hdd is splitted in two partitions with 5 gb (now shown as "d" and 55 gb now "e". the 5 gb partition was hidden, and the 55 gb drive was the normal c drive

                  • 6. Re: external hdd with endpoint encryption needs to be read

                    ok,. well to decrypt the drive you need a copy of the key used to encrypt it, which only your helpdesk have. Once you have that you can use SafeTech to decrypt it, then some rescue tools to reconstruct the files if possible. Note though chances of success could be slim, as mostly the MFT is at the beginning of the drive.

                     

                    It also depends on whether you did a quickformat or a real format, the chances are less if it's the latter etc.

                     

                    But, all this depends on the assistance of your IT team - without them there is no possibility to recover anything.

                    • 7. Re: external hdd with endpoint encryption needs to be read
                      TechSecurityNate

                      IF you could get the machine key file from your support, which you stated they won't provide, then you could do a force decrypt of the 55Gb partition and potentially view those files in an unencrypted state as normal.

                       

                      There are surely instructions for force decrypt out there, or someone could assist, but no need to get into that until you get the machine key you need.

                      1 of 1 people found this helpful
                      • 8. Re: external hdd with endpoint encryption needs to be read

                        ok the statement is that it is not supported to decrypt the drive

                         

                        so I am stuck

                         

                        need now to find a way of force decrypting my drive ...

                         

                        any helping hand is usefull....

                        • 9. Re: external hdd with endpoint encryption needs to be read

                          to decrypt the drive you need the key, your IT team has the key. That's the only way to move forward on this.

                          1 of 1 people found this helpful
                          1 2 Previous Next