Sanity Check Recovering Data w/McAfee Encrypted Hard Drive

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
TheJoeFletch
Posts: 9
Joined: 22 Jul 2014, 14:38

Re: Sanity Check Recovering Data w/McAfee Encrypted Hard Dri

#11 Post by TheJoeFletch »

Fiona wrote:Your disk looks absolutely ok.
TestDisk Advanced and the message that your boot sector and its backup are bad are probably a result of mcafee encryption.
If your boot sector and file system are encrypted, datarecovery software nor testdisk wouldn't probably find any reasonable result, like a valid boot sector nor file system (MFT).
Ok, that sounds good to me.
Fiona wrote:There shouldn't be anything changed using testdisk.
As far as I know, I have not changed anything related to the hard drive.
Fiona wrote:Did you already have a look for that link above and the description how to create a win PE builder CD and have a try to decrypt your disk?
It should be done first.
I did look at the details that you posted earlier. But I do not have access to any of the McAfee Endpoint Encryption software.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Sanity Check Recovering Data w/McAfee Encrypted Hard Dri

#12 Post by Fiona »

Did you try to create a win PE builder Live CD?
There should be a plugin as described in that link above:
3 Open Microsoft Windows Explorer and navigate to the
\pebuilderxxxxx\plugin folder.
xxxxx
denotes the version number of
BartPE
.
4
Extract EETech.zip
to the desired location. Copy Win32 folder from EETech\WinPE folder to the \pebuilderxxxxx\plugin folder.
It might be possible to run McAfee Endpoint Encryption within your PE builder live CD without getting a BSOD and have another try to repair and decrypt your partition?

Please let me know your OS.
It's important, because Bart's PE Builder is normally related to winXP.
Do you still have a WinXp-CD?
Often a normal Win-PE-Live CD works too.

Fiona

TheJoeFletch
Posts: 9
Joined: 22 Jul 2014, 14:38

Re: Sanity Check Recovering Data w/McAfee Encrypted Hard Dri

#13 Post by TheJoeFletch »

Fiona wrote:Did you try to create a win PE builder Live CD?
There should be a plugin as described in that link above:
3 Open Microsoft Windows Explorer and navigate to the
\pebuilderxxxxx\plugin folder.
xxxxx
denotes the version number of
BartPE
.
4
Extract EETech.zip
to the desired location. Copy Win32 folder from EETech\WinPE folder to the \pebuilderxxxxx\plugin folder.
It might be possible to run McAfee Endpoint Encryption within your PE builder live CD without getting a BSOD and have another try to repair and decrypt your partition?

Please let me know your OS.
It's important, because Bart's PE Builder is normally related to winXP.
Do you still have a WinXp-CD?
Often a normal Win-PE-Live CD works too.

Fiona
Fiona,

I did not try any of the items you mentioned above. I gave up and brought it into my company's IT department. But I brought it into a different IT location and I had a GREAT experience. They knew that they had to decrypt the drive and fix the Windows issue. Which they did, without a complaint. So I am back up and running.

Thanks for your help and responses!

Locked