2 Replies Latest reply on Jun 7, 2013 6:22 AM by tom0815

    Recover a sector-copied disk

      Hello,

       

      One of our User had a harddisk crash. The disk was encrypted with McAfee EE 6.2.1.

      The disk isn't readable from the system, so i can't performa a recovery with EETECH.

       

      Because the data is very important we send the damaged disk to a data recovery company. The could create a sector copy of the disk.

       

      1) Now, when I attach the new harddsik to my system it shows me two partitions and windows ask me to format the new attached disk.

           In EETECH I receive the message "NO DISK FOUND" or failes to load drivers with other eetech menu options.

       

      2) When I boot from the sector copied HD, is shows me the error:

           McAfee Endpoint Encryption

           Fatal Error: [0xEF000008] Failed to load cryptographic module.

       

      3) When I boot with WINPE and launch EETECH then the disk also will not recognize.

          "NO DISK FOUND" message when I press "Disk information"

       

       

      Further I'm not sure to have the correct algorithmus xml file for this machine.

       

      Maybe the options "Repair Disk information" or "restore MBR" could resolve the problem, but I don't know extactly whta's happen when I press it.

       

      Does someone see a possibility to restore data from this disk ?

        • 1. Re: Recover a sector-copied disk

          you've got to get the disk visible first - I expect there's a problem with your WinPE image, maybe you forgot to include the hard disk drivers from the manuf?

           

          You could try setting your bios to "compatibility" mode - or you need to find the right drivers.

           

          My gut feeling is it's completely recoverable still, since it boots to an EEPC message - you just need a working WinPE environment.

           

          You could always use EETech standalone - it will take a LOT longer to decrypt, but you won't need to find the right hdd drivers for WinPE...

          • 2. Re: Recover a sector-copied disk

            Thanks for your answere.

             

            My PE CD has the correct hard disk controller driver build in.

            A checked it by booting another, not encryted, hard disk.

             

            What exatly does the "Repair disk information" Option?

            Maybe the disk will be available after pressing this button?