5 Replies Latest reply on Feb 18, 2015 2:43 PM by tcox8

    Second HDD was removed before Reimage, now not Showing Up

    tcox8

      Hello all,

       

      I had a field consultant remove a secondary hard drive in a machine that was encrypted with EEPC. He then reimaged the laptop and encrypted the primary hard drive. After that he attempted to plug the secondary drive back in but now it is showing up as "Unsupported" in the EEPC System Status window. Is there any way to recover from this and get the secondary drive working with the newly encrypted/imaged primary drive?

        • 1. Re: Second HDD was removed before Reimage, now not Showing Up
          jhall2

          The secondary HDD is encrypted with a different key then the primary disk. The only method of recovery is to utilize the EETech disk to load the old key exported from ePO and decrypt the disk.

          • 2. Re: Second HDD was removed before Reimage, now not Showing Up
            tcox8

            I figured that would be the answer.

             

            I exported the old key from ePO. I booted to WinTech and authenticated with the old key file (and Authorized with Code of the Day) but the hard drive still shows as RAW. I can view the workspace and see the encryption but why doesn't the drive show up as an unencrypted drive at this point?

             

            I am using WinTech on an unencrypted laptop with the encrypted drive plugged in externally.

            • 3. Re: Second HDD was removed before Reimage, now not Showing Up
              tcox8

              Searching elsewhere I found that there is the option of key re-use. The only problem is that you are supposed to select the key re-use option before you activate the newly encrypted primary drive. Because the field consultant had already activated the newly encrypted primary drive does this mean that the key re-use is not an option anymore?

              • 4. Re: Second HDD was removed before Reimage, now not Showing Up
                jhall2

                The partition table may be damaged or the MBR or partition gap info could have been overwritten. If this is the case, the crypt list would be missing and the driver would not know what sectors of the disk are encrypted. From the workspace, select the first sector of the partition (usually 63 or 1024) and decrypt workspace. If you can read plain text, you know this is the correct key. If this is the case, a force decrypt will need to occur. We always suggest a sector level backup be taken, the disk information copied down, and the key verified against the start and end sector of the partition prior to attempting a force decrypt.

                 

                You are correct that the key re-use can be used to utilize the same key and this is the typical use case for why this option was added. However, because the primary has been encrypted with a different key; however, I am unsure if the option would work the second time around. The system would need to be decrypted and deactivated then reactivated to test.

                • 5. Re: Second HDD was removed before Reimage, now not Showing Up
                  tcox8

                  Start sector was listed at 2048. I was able to decrypt the workspace and read what was there. I have started the force decrypt on the drive. Now it's just a waiting game! (1 TB HDD are not fun!)

                   

                  Thanks for the help!