4 Replies Latest reply on Aug 6, 2015 10:39 AM by nosys70

    Fallo al obtener el Key Check del disco primario

    jorgealmazan

      Buen dia

       

      Tengo una laptop con Windows 8.1 encriptada con Drive Encryption 7.1, hoy marcó error de boot y no puedo recuperar el Windows. Quiero desencriptar el disco para poder tener acceso a mi informacion asi que cargué el McAfee EETech.exe desde un CD. Cuando selecciono el archivo XML del equipo me marca el siguiente error:

      EETech error XML.jpg

       

      Y por consecuencia no puedo iniciar el proceso de "Remove EE":

      RemoveEE error.jpg

       

      Que puedo hacer para recuperar mi informacion? Agradezco cualquier apoyo

        • 1. Re: Fallo al obtener el Key Check del disco primario
          jhall2

          DETech cannot verify the keycheck of the system. The keycheck is found in the MBR located on sector 0 of the primary disk. One of two things is occurring:

           

          1. The HDD DETech is querying is not the primary disk but rather a USB or some other disk. You need to "Set Boot Disk" to point to the HDD of the system. It is often easier to remove all USB disks from the system to reduce the number of disks displayed in "Set Boot Disk".

          2. The MBR has been damaged or overwritten. You can verify this by loading sector 0 with a sector count of 1 in the workspace. SAFEBOOT should be seen in the first line of the MBR. If not, assuming you are querying the correct disk, the MBR will need to be replaced. You will want to verify that the key is correct by loading the first sector of the C: partition and decrypting workspace and verifying that there is clear text seen. After verifying the key is correct, if you are running MDE 7.1.x, you can authenticate with the XML and then select Restore MBR and restore the MDE MBR. Do not select the option to replace the partition table.

          • 2. Re: Fallo al obtener el Key Check del disco primario
            nosys70

            Hello, i got the same question.

            I got the XML file , code of the day and same error message for the "failed to retreive key check..."

            i know the encrypted partition start at sector 2052 on disk 0 and loading sectors in workspace and decrypting them is ok, so it means i got the correct XML file..

            I created a crypt list region with the sectors (there were none in the disk info) but i am unable to do anything else.

            The "remove EE" fails the same a described in previous post and restoring MBR did not bring any improvement.

            Strangely, despite the crypt list editor warns about writing disk, the crypt list is not available after reboot.

            Why is there no button to force decrypt the sectors like there is a "force crypt sectors".

            i can really not plan to decrypt 6 billions of sectors manually by using the load/decrypt/save workspace ...!

            i use EETech 7.1

             

            So the question, is where do i go from there to get the sectors decrypted.

            I do not really need a fully bootable disk or even a clean disk structure because if disk is decrypted i can run some recovery utility.

            • 3. Re: Fallo al obtener el Key Check del disco primario
              jhall2

              The force crypt option will allow you to either force encrypt or force decrypt. Prior to performing any force crypt operation, it is highly recommended to copy down the sectors in Disk Information, verify they key by decrypting workspace for both the start sector and end sector (start + count - 1) of the partition, take a sector level backup of the drive, and ensure the machine has battery backup.

              • 4. Re: Fallo al obtener el Key Check del disco primario
                nosys70

                thanks for the info, i already work on a clone of the disk, so i am safe to experiment.

                my fault for not having clicked the force crypt button and see that it also allow to decrypt..!!!