1 2 Previous Next 11 Replies Latest reply on Jun 3, 2011 9:05 AM by SafeBoot

    Can somebody help me? My encrypted disk MBR rebuilt by Fdisk

      My disk is protected by McAfee Endpoint Encryption v5.x.    Last week I got a 'no operation system' error message when I started my computer. One IT person rebuild the MBR use fdisk /mbr command. After that the sector 0 was changed to the standard format instead of Safeboot format.

       

      Fortunately, I got the .SDB file from the server, but it seems that this file cannot decrypt the data.  We use SafeBoot WinTech, use menu 'Authenticate from Database' with .SDB file. My C disk is still blank.  And we followed the KB61022 to restore the MBR, but  we can not get some readable data @ step 10 of solution 1, so I guess my SDB file is incorrect.  After the study, I found that that .SDB file was generated one year ago (June 2010). (SDB filename format :   <MyComputerName>.SDB)

       

      https://kc.mcafee.com/corporate/index?page=content&id=KB61022

       

      Can somebody give some ideas to help me on this situation? I really need my data back. Thanks.

        • 1. Re: Can somebody help me? My encrypted disk MBR rebuilt by Fdisk

          SDB file was generated one year ago (June 2010) should be :

           

          The last modified time of .SDB file is  June 23, 2010.

           

          Message was edited by: wonzery on 5/31/11 12:11:21 AM CDT
          • 2. Re: Can somebody help me? My encrypted disk MBR rebuilt by Fdisk

            First of all make sure the *.SDB file that you are using is the correct one by using Workspace functions.

             

            Is your HDD encrypted ?

            And what is the error messeage when you normally boot the system ?

            • 3. Re: Can somebody help me? My encrypted disk MBR rebuilt by Fdisk

              I can make sure the .SDB file matchs my computer name.  But can not  get some readable data by using Workspace to check data sector 63.

              My question: Does this .SDB file on server changed after created?  (Since the last modified is June 23, 2011)

               

              My HDD encrypted (SB V5.1). Current error message as below :

                   Resetting Hardware ...

                   Starting Operation System ...

                   Error Loading Operating System ...

              • 4. Re: Can somebody help me? My encrypted disk MBR rebuilt by Fdisk

                I think this should be a lenovo laptop.

                 

                You can decrypt your HDD by performing decryption process sector by sector. (Force fully decrypt)

                 

                Note :- You should take clone image to do the same to be on a saffer side

                Also make sure that status of the SDB file should not be disabled in the object property > General TAB.

                 

                Message was edited by: keyurshah on 5/31/11 4:03:54 AM CDT
                • 5. Re: Can somebody help me? My encrypted disk MBR rebuilt by Fdisk
                  mirrorless

                  You site it only fdisk /mbr? does they do something else?

                   

                   

                  To check you got right SDD file check use workspace and browse through

                  of course you can't do removal or decrypt because tha mbr has been changed.. the decryption will depends on MBR or SBR information..

                   

                  Using wintech after aothorize (with code of the day) & authenticate 

                  try - restore eepc mbr this will rewrite sector 0 with EEPC mbr

                   

                  If there no changes except your sector 0 you should able to fix it..

                  authorize and authenticate and using 143 file management you will be able to view your data..

                   

                  Try above first..

                   

                  if there a problem we continue with sector by sector decryption..

                  the problem may accour if there change in partition table and restoring eepc mbr doesn;t help much..

                  there other procedure to recover that..

                   

                  Message was edited by: mirrorless on 5/31/11 4:43:32 AM CDT
                  • 6. Re: Can somebody help me? My encrypted disk MBR rebuilt by Fdisk

                    I restored the EEPC mbr by WinTech CD.  But the problem is still there.  Now I'm Force decrypt sectors on an image disk. Hope this could solve the problem.

                     

                    Some information of my computer:

                         My laptop is HP 6930P. 

                         Disk is 160G, only C drive

                         Start sector : 63

                         End sector: 0312576704

                         Sector count: 312576642

                    • 7. Re: Can somebody help me? My encrypted disk MBR rebuilt by Fdisk

                      if you could not decrypt sector 63 in the workspace using your SDB file, then you are using the wrong SDB file - without the correct one, there is absolutely no way to recover your data now.

                       

                      The correct file should be in the database though, otherwise your machine won't have syncronized its policy?

                       

                      You MUST get the correct SDB file, no other file will help in the slightest. Perhaps looking for (your machine name)0001, 0002 etc will help?

                      • 8. Re: Can somebody help me? My encrypted disk MBR rebuilt by Fdisk

                        Status Update:

                         

                        I think my computer lost the synchronization with the server.

                         

                        It took the whole night to decrypt sectors from 63 to 112850000 (Only 1/3). Now I could resotre some my files. So from my case, even if I could not get readable data of sector 63 or 2048, I still can use this .SDB file to decrypt the disk.

                         

                        So next step is to ghost another disk and decrypt all sectors. While it should take a long time to do it on a 160G disk.

                        • 9. Re: Can somebody help me? My encrypted disk MBR rebuilt by Fdisk

                          Here I have a one question that even if decrypting sector 63, I was not able to get desired output. At the same time when I performed force decryption i was able to get the data.

                           

                          The actual problem was something like in normal boot there was an error "Missing Operating System" and when we performed Restore EEPC MBR I got the error Safeboot has been currupted error 92 h and then i performed force decryption and data was recovered.

                           

                          And many times when i performed Restore EEPC MBR, i am getting error as "Safeboot has been currupted error 92 h" could you please explain this.

                           

                          Message was edited by: keyurshah on 6/3/11 12:21:29 AM CDT
                          1 2 Previous Next