3 Replies Latest reply on Nov 23, 2012 2:48 AM by dwebb

    Can we get Data from formated laptop which was Encrypted?

    Hemant Koli

      Hello Everyone.

       

      A laptop was encrypted using EEPC 6.1.3 & due to some issue we have froamted that laptop, And now we are unable to get data.

      So please let me know is it possible to get Data & how?.

       

      Thanks in Advance.

        • 1. Re: Can we get Data from formated laptop which was Encrypted?

          Decrypt it with eetech then use a standard unformat or data recovery  tool.

          • 2. Re: Can we get Data from formated laptop which was Encrypted?
            Hemant Koli

            Hello Simon.

             

            Thanks for your responce.

             

            What we have did is we have formated only C Drive from an Encrypted Laptop & D Drive remain Encrypted. And then after we have again installed a fresh OS & also installed EEPC & started encryption process, nad when we tried to access D Drive we were unable to get access to data as it is still encrypted.

            So to get data we tried to Decrypt Laptop through EETech CD, but it sucessfully decrypted C Drive & D Drive Data was not accessible.

             

            So please try to help me to get the DATA .

            • 3. Re: Can we get Data from formated laptop which was Encrypted?
              dwebb

              Hi Hemant,

               

              What you need to do is quite simple. 

               

              I believe that your D: drive is still encrypted with the old disk encryption key (I'm assuming it's on the same physical drive as C:).  I think you have basically double-encrypted the D: drive by reimaging the C: drive without deactivating first.

               

              Therefore, you need to extract the old key by going to epo, selecting the machine, and exporting all keys when you create the recovery file.  You should then see at least 2 machine key files in the result.  One will be to recover the system based on the current disk encryption key, and one will be for the previous "activation", which can be used to recover the drives that were encrypted by the old disk encryption key.

               

              Then use the WinPE version of EETech, with the old recovery file, and you should be able to see the D: partition and copy the data off.

               

              WARNING: in all cases when you are recovering data using EETech, please make sure you take a sector level copy before attempting anything other than an emergency boot.  EETech needs to be a powerful tool, but if you make a mistake you can end up with unrecoverable data.  I would definitely recommend a sector level copy, therefore, in case things go awry.

               

              If this doesn't work, then I would suggest that your next step would be to contact support.

               

              HTH