1 2 3 Previous Next 54 Replies Latest reply on Nov 9, 2016 12:51 PM by powershell_guru

    Detech decrypt for Mac OSX (encryption problem on Macbook Pro BootCamp partition)

    niallmca

      Hi,

       

      We have MacBook Pro with BootCamp (Windows) partition which has been encrypted (or maybe partially encrypted) by ePO.

      The encryption seems to have failed.  The disk won't boot into Windows, and OSX can't mount the BootCamp partition.

      The error at boot is:

      McAfee Drive Encryption

      Fatal Error: [0xEE020006] Getting disk info

       

      With a HexViewer, I can see that the NTFS boot loader at the start of the partition has been overwritten.

      The disk partition is not recognised or mountable by OSX.

       

      Start of the partition:

      Before:

      00000000  eb 52 90 4e 54 46 53 20  20 20 20 00 02 08 00 00  |.R.NTFS    .....|
      00000010  00 00 00 00 00 f8 00 00  3f 00 ff 00 00 e0 22 1d  |........?.....".|
      00000020  00 00 00 00 80 00 80 00  ff 8f 1a 1d 00 00 00 00  |................|

       

      After:

      00000000  b5 f9 97 de 0f c4 0f a4  19 1c db a6 e6 76 b4 c6  |.............v..|
      00000010  d7 9c 4e 05 e0 dd 5b b8  72 87 ef ae 24 31 d6 13  |..N...[.r...$1..|
      00000020  5d 02 61 37 df e4 0f a2  68 ec 86 ef 1e a2 3a e3  |].a7....h.....:.|

       

      I would like to try to decrypt this partition with Detech. First, I think we will need to replace the start of the

      partition with the original NTFS boot loader - because OSX cannot mount the partition.


      For Detech, we can download the Windows version from here, but the Mac OSX version isn't there. 

      How could I get the Detech utility for OSX?

       

      Thanks.

      Best regards,

      Niall.

        • 1. Re: Detech decrypt for Mac OSX (encryption problem on Macbook Pro BootCamp partition)

          There is no DETech for OSX, because EEPC software encryption is only supported under Windows.

           

          I'm not sure there is a solution for this - since EEPC is not supported on Mac hardware either. You could perhaps image the partition and then copy it onto a regular PC ?- Then you'll be able to use a DETech/EETech bootable version etc.

          • 2. Re: Detech decrypt for Mac OSX (encryption problem on Macbook Pro BootCamp partition)
            niallmca

            Many thanks for your response.

            It has taken me a while, but I have imaged  the partition to a regular PC, and

            then decrypted with EETech bootable version.

             

            With HexEditor, I can see lots of data (strings, email text etc) on the

            decrypted partition.

             

            I then re-imaged this decrypted partition back to the Mac SSD. 

            When I reboot, I get "Missing Operating System".

             

            I noticed that the first sector on the original encrypted partition was not

            actually encrypted(!).  This sector contains the "NTFS" oem id in the

            first few bytes. So, I copied just this original first sector to my decrypted partition.

            Note:  I can't tell for sure from which sector the encryption started.

             

            Then when I reboot, I get " disk read error occurred. Press Ctrl+Alt +Del to restart."

             

            Next I will try imaging the decrypted partition to a regular USB disk, and I will try

            to repair it on a Windows PC (chkdsk, etc.).

             

            If you can offer any insight, or any suggestions, that would be greatly appreciated.

            Because I can see the user data on the decrypted partition, it seems tantalisingly close.

             

            Thanks.

            Best regards,

            Niall

            • 3. Re: Detech decrypt for Mac OSX (encryption problem on Macbook Pro BootCamp partition)
              exbrit

              Moved to Mac and Linux Products

              ----

              Peter

              Moderator

              • 4. Re: Detech decrypt for Mac OSX (encryption problem on Macbook Pro BootCamp partition)

                If you think you decrypted the partition (unless you wrote down EXACTLY what you did, it's not really possible to offer any suggestions), then the only thing I can think of is to use a file recovery tool.

                 

                The last sector of a partition is a duplicate of the NTFS boot sector so you can always copy it back from there.

                • 5. Re: Detech decrypt for Mac OSX (encryption problem on Macbook Pro BootCamp partition)
                  niallmca

                  Hi,

                   

                  Yes - I'm sure I decrypted the entire partition (including the first sector which wasn't encrypted).

                  So, then I unencrypted the first sector which has the NTFS boot sector.

                   

                  Next I transferred it to a partition (of the same size) on an internal SSD.  However I noticed the starting

                  sector of the target partition was different to the starting sector of the original partition.

                  So, I think the pointers (e.g. the address on the disk in the NTFS boot sector of the MFT, etc)

                  will be wrong unless the partition is restored to the exact same place (starting sector) on the SSD.

                   

                  Next I will try to restore the partition onto the exact same starting sector on the SSD.

                   

                  BTW, I found at least 4 NTFS boot sectors on the decrypted partition.

                  I'm assuming the first one is the correct one.

                   

                  Thanks.

                  Best regards,

                  Niall.

                  • 6. Re: Detech decrypt for Mac OSX (encryption problem on Macbook Pro BootCamp partition)
                    niallmca

                    ok ... still not working

                     

                    One thing I've noticed is that my internal SSD (which contains a sector image of the

                    original SSD which got encrypted and crashed) has two partitions:

                     

                    Partition 0 / type 0xEE  (Unknown) / Start Sector 1 / Sector count 411647

                    Partition 1 / type 0x07 (NTFS) / Start Sector 411648 / Sector count 976361472

                     

                    The first partition was never encrypted (i.e. I can see regular text in the workspace).

                    It looks like only the second (NTFS) partition was encrypted.

                    Also the first sector on the second partition (sector 411648) contains the

                    NTFS boot sector, and this one sector also was not encrypted.

                     

                    I have decrypted the second partition (except for sector 411648 which

                    has the NTFS boot sector).  As far as I can see the NTFS partition looks

                    good, and contains MFT and files, etc.  In the workspace, I can even

                    see text from files, and emails, etc.

                     

                    Maybe the problem is now because of the first (unknown) partition.

                    Is that the reason I can't mount the disk..?

                     

                    I wonder should I try delete the first partition (with DISKPART),

                    and then run CHKDSK to fix the NTFS partition..?

                     

                    Any thoughts ..?

                     

                    Thanks.

                    Best regards,

                    Niall.

                    • 7. Re: Detech decrypt for Mac OSX (encryption problem on Macbook Pro BootCamp partition)

                      I would think your MBR is the problem. Chkdsk is not going to resurrect a partition for you. You need a disk recovery tool.

                      • 8. Re: Detech decrypt for Mac OSX (encryption problem on Macbook Pro BootCamp partition)
                        niallmca

                        I've run CHKDSK, based on the NTFS boot sector which was at sector 0.

                        It has repaired and restored the BootCamp NTFS filesystem - but there are no files.

                         

                        On this BootCamp partition, I had previously counted several NTFS boot sectors

                        in addition to the NTFS boot sector at sector 0.  I know that BootCamp was installed

                        several times on this partition.

                         

                        I think that each time BootCamp is installed, then it creates a new NTFS boot

                        sector in a new place - i.e. the original one at sector 0 is not re-used.

                         

                        In that case, I will try to copy one of the other NTFS boot sectors (maybe

                        the last one I can find before the data) to sector 0, and then I'll try running CHKDSK,

                        which should rebuild/repair the NTFS filesystem based on the valid NTFS boot sector.

                         

                        I can see now why McAfee device encryption doesn't work on MacBook (BootCamp). 

                        If the NTFS boot sector isn't at sector 0, then when the PBFS starts, it won't

                        find any files (e.g. MS-Windows, etc).

                         

                        Thanks.

                        Best regards,

                        Niall.

                        • 9. Re: Detech decrypt for Mac OSX (encryption problem on Macbook Pro BootCamp partition)
                          niallmca

                          so, I've counted 10 NTFS boot sectors.

                          I tried copying one to sector 0, to overwrite/replace the original NTFS boot sector.

                          But CHKDSK, reported it as invalid, and used the copy (mirror) instead.

                           

                          Inspecting each NTFS boot sector, the entry for the MFT location is empty (all zeros).

                          So, these are invalid NTFS boot sectors.

                           

                          I think that what I need to do is find the starting sector of the real MFT, and

                          enter this into the NTFS boot sector (at position 0x30).  That way the boot sector

                          would be pointing to the correct MFT, and not pointing to the incorrect (empty) MFT.

                           

                          The current NTFS boot sector points to MFT at cluster 0x 00 0c 00.

                          In decimal, this is cluster 12, (sector 96, because there are 8 sectors per sector).

                           

                          Looking at sector 96, there is no MFT.

                          However, I can see that the MFT is actually at sector 24.

                           

                          So, something wrong with my calculations maybe ..?

                           

                          I guess I need to do the following...

                          1.     Find the correct start sector of my correct MFT.

                          2.     Convert this sector to the correct cluster number

                          3.     Update the NTFS boot sector (at position 0x30) with the

                                 cluster number of my correct MFT.

                          4.     Run CHKDSK

                           

                          Any comments welcome

                           

                          Thanks.

                          Best regards,

                          Niall.

                          1 2 3 Previous Next