8 Replies Latest reply on Aug 17, 2012 8:44 AM by SafeBoot

    Data Recovery

    Hemant Koli

      Hello Everyone,

       

      A laptop was Encrypted using EEPC 6.1.3 and after couple of weeks whille booting it showed the error message as "Windows could not start because the following file is missing or corrupt: \WINDOWS\SYSTEM32\CONFIG\SYSTEM" please refer attached screenshot for more details. So user tried repairing using Windows CD with no success, and user handed over laptop to me for Data Recovery as it was Encrypted, so i tried to recover using EETech but still no success, because user tried repairing windows usins Windows CD. Please help me to recover DATA.

       

      Thanks in Advance

        • 1. Re: Data Recovery

          If this is the error you get after booting the machine, then the user must have formatted their system drive

           

          If that's the case, all you can do is force decrypt the drive, then use some third party unformat/file recovery tools.

           

          But, start at the beginning and tell us exactly what state the machine is in right now to be sure.

          • 2. Re: Data Recovery

            If all of this do not work, have a try Windows Password Recovery Tool. 

             

            消息编辑者为:arabela123 on 12-8-13 下午09时23分57秒
            • 3. Re: Data Recovery
              Hemant Koli

              Hello Simon.

               

              Thanks.....

               

              I am able to boot from EETECH but the problem is HDD is not getting detected (i.e i m unable to see HDD Drives under A3 file management utility) So how can i perform Force decrypt.

              • 4. Re: Data Recovery

                First, let's confirm what the actual situation is - did the user format the drive?

                 

                Next, if you can't see the drive in EETEch, then you built your EETech CD without including the hard disk drivers for your device. Either fix the CD, or turn the BIOS into ATA/Compatibility mode and hope the default Windows drivers work.

                • 5. Re: Data Recovery

                  arabela123 wrote:

                   

                  If all of this do not work, have a try Windows Password Recovery Tool. 

                   

                  消息编辑者为:arabela123 on 12-8-13 下午09时23分57秒

                  That's not going to help at all - The windows password won't help us get access to formatted encrypted data.

                  • 6. Re: Data Recovery
                    flintstone1010

                    The way I explain it to my techs is, the laptop you are trying to recover must be able to detect the disc in the BIOS. If the BIOS can detect the disc, the EETech tools should be able to detect the disc when you look in the Disc Information Window. If  you can see in the Disc Info Window, you should be able to obtain the Start and End Sector information for review in the WorkSpace....this is a big difference from not being able to see the disc in A43 Filemanagement.

                    • 7. Re: Data Recovery
                      Hemant Koli

                      Hello Simon.

                       

                      No we haven't formated, we tried to repair............

                      • 8. Re: Data Recovery

                        Are you sure repair didn't try to format the drive though? It would seem strange to get this message from an unformatted drive, as there's too much information in it for it to have been created by the MBR alone...

                         

                        If you are 100% sure no format occurred, then you'd be able to mount the drive with EETech and get the data off. Remember, if you can't see the drive in WinPE then your WinPE build is faulty - it does not contain the right drivers for your hardware. Fix it, or change the HDD mode so the default Windows drivers work.

                         

                        The drive letter will ALWAYS appear in WinPE/BartPE - when you try to access it, Windows will tell you an encrypted drive is unformatted. If the drive does not appear at all, it's ALWAYS a WinPE driver issue, nothing to do with encryption.

                         

                        However, I think this is unlikely to work as all the evidence points to more changes than you realize.

                         

                        All I think you can do is force decrypt the partition after validating you have the right key, then try to use an unformat tool to recover the files.