1 2 Previous Next 12 Replies Latest reply on Mar 14, 2017 3:18 PM by bprice05

    Wintech / Safetech - not much is working

      Hello Forum Members,

       

      I hope I am in the right place and this is my first post here.  Please advise if you are able.  Here is some minimal pertinent info:  Not exactly using Endpoint protection but have an HP elite book protected by protecttools and drive encryption, I assume same expertise applies.  My encrypted partition appears as an unformatted drive and windows boots to startup recovery but cannot repair.  3 other partitions on the drive are intact.  biometric autentication still working and I have my encryption key on a usb drive.  I lost access to widows following an attemt to clone using acronis.  To recover, I made a disk with from a Wintech iso and I have authorized and authenticated properly.  Not much is working from that point.  I do not see the installed HD listed at all, just B: X: and my usb drive with the key.  I get an error trying to reset int13.  I have basically stopped there, obviously I am missing someting here.   Like I said, hope I am in the right place.   I have more info to provide if needed.  Thank you.

        • 1. Re: Wintech / Safetech - not much is working

          First, make sure you've read this doc. https://community.mcafee.com/docs/DOC-3338

           

          Second, If the drive does not appear in Wintec, it's because your cd does not have the right drivers for your hdd controller installed. Either swich to compatibility mode into Bios or install the drivers

           

          Third, what version of dept? If its a v6 version wintech won't help you as that's for v5 only.

           

          Finally, don't reset int13 - it's not going to help you. Your only chance is a decryption as long as acronis did not move too much stuff around.

           

          Do you remember exactly what acronis did to write to the drive? It must have done something...

          • 2. Re: Wintech / Safetech - not much is working

            Thank you for the reply Simon.  I read your post re: HP product, I understand.  I am going to try the HP DiskTech to see if that gets around the driver issue first.  I believe my product is v5 because that is what is offered at HP support page for my laptop as the latest version for download or update.  I am not too sure what Acronis actually did... modified the boot loader maybe.  I was trying to do a clone (seems silly for me to try that now that I know what I know) with acronis installed on the laptop drive (as opposed to using a boot CD), the source drive installed in the laptop and the target sata connected via usb.  Acronis must have modified the boot process somehow and needed to reboot probably to an OS environment to do the clone.  The machine simply never returned from the reboot, but does return to startup recovery, and runs until that fails.  SYSTEM, HP_RECOVER, and HP_TOOLS partitions seem to still be OK, only the main Partition is unavailable and appears to be an unformatted drive.  Does that sound normal with a good chance of recovery?  I did try looking at the drive with some partition tools but did not comit to any changes. Again, silly after what I know now.  I am proceeding cautiously now with much  valuable data at risk.  Ironically, I was using acronis to protect my data because I knew I did not have any good backups.  Sad but true.

             

            Brad

            • 3. Re: Wintech / Safetech - not much is working

              Update: HP's Disktech seems to think I have access to my encrypted drive but the drive has no files.  If this were any other non-encrypted drive I would think its a recoverable partition error of some type. Now I am wondering how the drive encryption affects things like boot sectors, MBR's, Backup MBR's, MTF's and Backup MTF's, etc.  While in this "unlocked" Disktech/wintech environment will patition tools work properly or differently?  Any suggestions?

              • 4. Re: Wintech / Safetech - not much is working

                Any "in windows" tools should work fine, but as we don't know what acronis did, it's hard to say.

                 

                Encryption encrypts everything, mft, every sector, and once encrypted, you can't move sectors around - they only decrypt if they are in their correct location.

                 

                For your drive to appear valid, but empty, acronis must have moved all the data somewhere else - I would speak to them and ask what can be done.

                • 5. Re: Wintech / Safetech - not much is working

                  Obviously something has been changed, but Acronis did not have enough time to move all of the data.   Right now I am focusing on why the partition size is completely wrong.  Sectors? Head?  isnt that a function of the BIOS?  After DiskTech gives me access to the Drive I can see all 4 Partitions on it in the file browser.  3 partitions are perfectly fine - C:(SYSTEM), E:(HP_RECOVERY), and F:(HP_TOOLS), but D: which is actually 215GB partition about 200GB full of data, is reported by the file browser as 4250KB Total Size and 4969248GB Free Space.  5 Million Gig of Free Space?  Are you Sure the INT13 Reset won't help?

                  • 6. Re: Wintech / Safetech - not much is working

                    yes - it doesnt do anything useful to you.

                    • 7. Re: Wintech / Safetech - not much is working

                      Simon, First off I wanted to thank you for participating in this post, as I realize where I stand with my product.  Hopefull I can generate usefull info for others, and if you agree I would like to report back here as I continue with my effort.

                       

                      Could you confim that I have a correct understanding of the following.

                       

                      (all of these I ran early in the troubleshooting)

                      bootrec fixMBR - overwrites the MBR with a std. MBR but does not overwrite the partition table.

                      bootrec fixBoot - affects the boot sector of the system partition but not the encrypted partition.

                      bootrec rebuildbcd - searches for OS installations to update the BCD store on the system partition.

                       

                      I have manually examined the 64 bytes of partition table and it seems to correctly identify the sector boundaries of  the encrypted partition assuming the partition type is supposed to be identifed as NTFS.  The first sector of the encrypted partition sure looks encrypted - no plain text there or at the last sector.

                       

                      You have posted in other threads that the MBR, but not including the partition table, includes info specific to the encryption.  I see that the MBR can be restored to an SBR from a saved copy but I assume that that is a mcafee specific feature, probably not avalilable for a consumer designed product like mine unless its packed away in the key file.

                       

                      Just wondering I have a correct interpretation so far.  - MBR could be a problem.

                       

                      Brad

                      • 8. Re: Wintech / Safetech - not much is working

                        sorry - I can't comment on the functionality of "bootrec" - it's a Microsoft tool so you'd have to ask them what it does.

                         

                        Your MBR should be included on your USB stick, so just load up your record in SafeTech/WinTech and do "restore original MBR" - that will put the captured code back. It WONT change the partiton table though. EEPC never touches that.

                         

                        What you restore should be a standard MBR though, so I don't see the difference between that and bootrec fixMBR.

                         

                        If the partition is encrypted, then just test decrypt some sectors from the beginning and end with the workspace in SafeTech/WinTech and check they look good. If so, just decrpyt the range using the force decrypt option.

                         

                        You have to make sure you get it right though, and don't interupt the process.

                         

                        Finally though - Why don't you simply call HP support and ask them how to fix this? It's their product - they know far more about it than we do here?

                        • 9. Re: Wintech / Safetech - not much is working

                          The first sector of the encrypted partition "force decrypted" fine - looks like a good boot sector.  so I am running a force decrypt on the rest of the partition.  about 450 Million sectors at around 14 minutes per million = 52 hours.  Ill give an update on Monday.

                           

                          In regards to HP, It seems to be a common theme in threads from both HP and McAfee that HP is not too helpful regarding this product.  Right now I am fighting to get to level 2 support, but I assume I cannot get any real help until I can talk to someone from level 3 Support.  Lower level support techs simply do not fully understand the issue - Partition and File System errors complicated by Encryption.  On the support flowchart is seem I am categorized as "customer damaged partition" - Solution: Restore to Factory - not worth of escalation.  For me that is not acceptable when I am willing to spend as many hours as it takes, but a level 3 tech has tools and documentation I need.

                           

                          I absoulutely understand you going on record as being unable to support this product, I would not expect anything else given your positon.  That is why I greatly appreceate that you have given me enough information to bridge the gaps between all of the otherwise relevent information I have gotten online.  So thank you for that... And cross your fingers!

                           

                          ***Here is a good tip for others:  Wintech runs from the HP Disktech Bootdisk.  I copied the programs folder from the winteh CD and copied to a usb drive. Also have a hex edit program there.  I have the system date set to 10/27.  I boot using the HP CD, but use the HP file browser to find the Wintech app and run that instead.  The HP Distech app does not have all of the same tools.  Previously, the Wintech CD did not have the drivers to access the Disk.  Just FYI - hope this helps someone.

                          1 2 Previous Next