1 2 Previous Next 10 Replies Latest reply on Nov 28, 2011 8:25 AM by SafeBoot

    Stuck in recovery and need sugguestion from experts

    rbdudani

      Hi All,

       

      I am stuck in recovery where i need your valuable suggestion whether data will be recover or not.

       

      Safeboot 5.2.5 installed with encryption on windows XP machine. suddenly system decide not to boot. and PBA (preboot was missing)

      so there was no change to authenticate from SBFS so I tried to restore EEPC MBR after authenticating with SDB.

       

      I got below error

       

      Endpoint Encryption Error

      Error: 0xe002001b

      No boot disk was found

       

      when I clicked on Get DISK info in safetech  I got as below

       

      Disk Information

      Logical Disk Number: 0

      Disk Information (error=e002000a)

      • -          Crypt List

           Region Count: 0

      • -          PowerFail Status

          Status: Unknown

       

      So I concluded there is some issue with HDD and its not detecting.. (note : I checked with all SATA/IDE/AHCI options)

       

      HDD given to HDD vendor and they restored partition table saying it was missing. after than we performed cloned the hdd to another hdd

       

       

       

      After that Disk is showing disk information as Diskinfo.jpg attached. (its showing two partition ? PS: as per safeboot server this client machine have only one drive C:)

       

      Now a safeboot expert only can help to figure out whether this disk info is correct or not ? as its showing two partition 0. Which I never saw on any system.

       

      I even treid to Restore EEPC MBR again but disk info not changed even after succuesfully restoring EEPC MBR.

       

      I tried to check sector 63, considering that I will force fully decrypt hdd if sector 63 decryption shows some “NTLRD missing” (as I always test to figure out whether hdd is encrypted or not and whether I have correct SDB  or not) but as attached image (before_decrypt63.jpg/afterdecrypt63) its showing already in plain text.

       

      I even tried to get part info with partinfo.exe but its showing nothing

       


      PARTINFO 1.09
      Copyright (C) 1996-2003, TeraByte Unlimited.  All rights reserved.

      Run date: 10/21/2011 16:45

       

      Can you suggest me next step?  Can you tell me what the current disk info is saying ? restoring original MBR will help as restore EEPC MBR is not working ?

       

      what I am feeling is something went wrong at client place while clonning image , I concluded this seeing current disk info and sector63 infomation .. hdd is already in plain tect.. What is your opinion ?

        • 1. Re: Stuck in recovery and need sugguestion from experts

          63 is in plain text already, which implies that the vendor blew a new MBR and partitions onto the drive - perhaps they even formatted it?

           

          the restore MBR functions in SafeTech do just that - restore the MBR, they don't restore the partition tables as EEPC never overwrites them.

           

          What does sector 64 look like - is it encrypted still? If the partition is encrypted and you can find the right key, you can still probably recover the data - most good file recovery tools can reconstruct a partition table easily enough, in fact, you only really need the start sector for it to work in the first place.

           

          The key thing here is what was the exact original message?

           

          suddenly system decide not to boot. and PBA (preboot was missing)

           

          What technically does this mean - do you remember exactly what happened?

          • 2. Re: Stuck in recovery and need sugguestion from experts
            rbdudani

            hi Simon,

             

            thanks for your reply. I will check for sector 64 (however I am always confused how to check whether perticular sector is encrypted or not ) I am able to check sector 63 just because i know how sector 63 look when its in plain text (the "NTLDR is missing" message)

             

            I have right key (.sdb file ). I am sure about the SDB file.

             

            only thing i m worried about is current DISK info. which says there are two Parition 0. is it because vendor restored partition table ?

             

            What technically does this mean - do you remember exactly what happened?

            -This all started as all other normal case. sudenly Preboot gone. so we decided to restore EEPC MBR.

            • 3. Re: Stuck in recovery and need sugguestion from experts

              where did the "vendor" get a partition table from? Most likely they just put a standard one back on the drive - it does not mean it's correct.

               

              How did you know the preboot was gone? what evidence/problem did you have?

               

              To know if a sector is encrypted or not, just look for patterns in the data, a few bytes in a row the same etc - if it's encrypted, there will be no paterns at all.

              • 4. Re: Stuck in recovery and need sugguestion from experts
                rbdudani

                Yes, I am also thinking that vendor have restored standard one. (but again not sure as machine is on remote site)

                 

                we got error 50001 "safeboot not activated" instead of preboot

                 

                 

                thanks, I will try to figure out that ... the explanation will help me to figure out the encrypted and plain sectors.

                 

                 

                One question :

                 

                If I restore Ogirinal MBR with the help of Safetech . will it help ? will fixmbr command help ?

                 

                once partition table fixed (changed by vendor) I will tried to get Disk info (sectors) and will force fully decrypt them.

                • 5. Re: Stuck in recovery and need sugguestion from experts

                  you get that message as soon as you turn the machine on? That sounds impossible - it should come up with 92h if anything... No pre-boot at all?

                   

                  Restoring the original MBR might help, it depends on how wrong the current one is - it won't fix the partition table though.

                  • 6. Re: Stuck in recovery and need sugguestion from experts
                    rbdudani

                    hi Simon,

                     

                    as said machine is at remote place and I really did not get into that (what was initally error ) , I am also wondring why I did not asked that.. ? ( I always look for the reason first)

                     

                    Client came saying that "laptop can not start and while tyring to authenticate with SDb file sytem reboots every time.

                     

                    so instead of get into initial error I directly get into the why sytem is restarting while performing authentication..

                    • 7. Re: Stuck in recovery and need sugguestion from experts
                      rbdudani

                      I will ask for initail error in my next communication with them

                       

                      FYI: system reboot stoped when I renamed sdb to short name (it was xxxxxxxxxxxxxx(xxxxxx).sdb) I renamed it to short name. Please note Machine name in console also was long I renamed it to short name (<8latters) and copeid to pen drive. than only I was able to succesfully authenitcate

                      • 8. Re: Stuck in recovery and need sugguestion from experts
                        rbdudani

                        simon : did you notice the two parition 0 in disk info ? what does it says ? .. I never seen tow patition zero (0) on one single drive. it should like parition 0 and then parition 1 .. right ?

                        • 9. Re: Stuck in recovery and need sugguestion from experts
                          rbdudani

                          Hi Simon,

                           

                          As we disccused intial error was " OS was down" and in safetech we were getting No Disk error.

                           

                          Need your help to check attached Sectors are encrypted or not ?

                           

                          also now when we restore the original partition table , Disk information is as below

                           

                          Disk Information

                          Logical Disk Number: 0

                          Disk Information (error=e002000a)

                          • -          Crypt List

                               Region Count: 0

                          • -          PowerFail Status

                          Status: Unknown

                           

                           

                          Q: will it help if I check Disk inforamtion of same Make & Model laptop which has same size hdd and with the help of that Disk information I will  Force Decrypt said hdd .

                          1 2 Previous Next