5 Replies Latest reply on May 18, 2011 1:53 AM by mirrorless

    safeboot damaged

      Hello

      I have hdd with 2 partitions which was encrypted with safeboot.  Both partitions( 30gb, 200gb ) are deleted and then created new partition  of 30gb and installed xp without safeboot, now  looking for data in 2nd partition which was encrypted and deleted (not overwritten ). I have Bart-pecd and machine config file (SDB file). I took the image of entire hdd. Now is there any  way to decrypt entire hdd so that i can recover files from 2 nd partition or any way to run data recovery tools along with SDB file and Bart-Pe cd.  When i run sbwintech.exe its asking for logical drive but no option for physical drive. 

      Help needed

      Thanks for any  help

       

      B.V.Reddy

        • 1. Re: safeboot damaged

          Yes - you can just use the hard disk functions of WinTech to decrypt a sector range (from the disk info screen). WinTech is asking for a physical drive - it does not care too much about logical drives.

          • 2. Re: safeboot damaged
            mirrorless

            This a bit complex..

            Even though you recreate new same 30gb partition you may not partition it on the same sector

            unless youre pretty sure you repartition it the same sector as before..

             

            Maybe

            - using wintech restore eepc mbr

            - check diskinfor for crypt list

            - used crypt list infomation for force crypt option (sector by sector decryption)

             

            I'm not sure after decryption you can be able to read your data content, if you're lucky you may able to read it if you're not destroy the old partition information by repartition it..

             

            If NOT then I would sugest you get third party recovery tools to analyze your disk structure and recover back your files on 2nd partition after your decryption done..

             

            Message was edited by: mirrorless on 5/13/11 3:18:33 AM CDT
            • 3. Re: safeboot damaged

              Thanks alot for the replys,

              Now i came to know that there is a  possibility to decrypt the sector  range .

               

              Yes ,  the 1 st partition may be overlapped (overwritten ) the initial part  of the 2nd partition, in that case boot sector  &   MFT  some entrieswill be damaged , still we can retrive ntfs data from remaining portion using virtual boot record creation or third party tools.

               

              I am new to BART PE  . My doubts are  very basic  and may be silly  for pros. ,  but this is only site i found reliable and dependable.

               

              1. Am i using right cd?  when i try to boot through cd its showing at starup  " 2008-06-07-BartPe-Safeboot/Wintech support ver 4 & 5 Encryption".   Or i need create another one?

              Because i have not found option to run wintech.exe  but sbwintech.exe is available which is working with logical partition

               

               

              2. Right now i am not using access/autherisation code,to get more options.   is it required?

               

              3. Presently i am working on cloned drive , Can i try something

               

               

              Thanks for any  help/ guidence

               

              B.V.Reddy

              • 4. Re: safeboot damaged

                The best advice I can give you is to let your IT team handle this - they will have been through training etc on this kind of thing and should be familier with all the tools.

                • 5. Re: safeboot damaged
                  mirrorless

                  Agree with simon if possible get your IT team to handle..

                  but my experiance not all It team would have experiance to do recovery.. so hopefully you can get IT team with recovery knewledge.

                   

                  To recover you will need key SDB file from your MEE server..

                  Since the location of SBFS has been destroy or may rewriten after you install new OS.

                  After you get the key/sdb file check whether it's valid key for decryption.. using workspace..

                  check sector outside partition 1 because partition 1 already installed with new OS so data alrady rewriten..

                  check the partition which is not touch by installation and partitioning ..

                  if you confirm that the key is correct then use force crypt and do sector by sector decryption..

                   

                  only after decryption you can get recovery tools to analyze your hardisk..