SafeBoot / McAfee Endpoint Encryption for PC (at HP)

[irisel]

thread1726-1644700

Hi,

I am trying to recover an encrypted partition, the partition was corrupted while making a backup with Acronis (actually I am quite sure the corrupted partition was the source one!).

The encryption software was McAfee EE 5.1.8 and I believe, according to the referenced thread, that Acronis may have corrupt the MBR.

I managed to download SafeTech / WinTech but I can't authenticate, how can I obtain the SBFS file, or which program of the SB suite would allow me to connect manually to retrieve the key to decrypt the partitions? -Or how to obtain the HP recovery key?-

I need my data back :'(

Thanks in advance!
Jose

 

[linney]

Any clues in these?


safeboot has been corrupted (error 92h)
thread1726-1644700



Help! Old SafeBoot fails to boot

https://community.mcafee.com/thread/45855?start=0&tstart=0

Hard disk now corrupt

http://forum.piriform.com/index.php?showtopic=17452&pid=134586&mode=threaded&start=#entry134586

How to use the WinTech CD to remove the encryption and boot sector from the hard disk

https://kc.mcafee.com/corporate/index?page=content&id=KB61117

Difference between WinTech (CD) and SafeTech (Disk)

https://kc.mcafee.com/corporate/index?page=content&id=KB53428

http://www.google.com.au/search?q=s...&ie=&oe=&redir_esc=&ei=qbzPT_qnOKOtiAeo5JD2Cw

 

[irisel]

Thanks Linney, much appreciated since I knew only a couple of them.
I guess the answer is, the .dat file is provided during the encryption process, and the SBFS is somewhere in my encrypted disk.
I have not yet read anyone succeeding in finding the safeboot.fs/rsv in an encrypted partition and fixing the boot sector to load them. That is research, am I right?
I suppose these files are not encrypted -I read they are hooked in a fixed place so that SB is platform-independent- so the challenge is to find the beginning of it, and finding the pointer in the MBR.
I have a working encrypted laptop but still didn't find any program that tells you the lba address of a file, which I need to locate the hook in the MBR.
Tough days ahead...

 

[linney]

It is all research until you find the answer, I can't help you much further as I make a conscious effort from avoiding encryption of the hard drive as a matter of course. If on the rare occasion I want to encrypt a file or folder I make use of a secure USB drive and a zipping program that can password protect.

 

[irisel]

Hi,

I got my data back!

As for others, in my case, full HD encryption was mandatory for all employees to protect customer's data, to comply with the data protection law and contractual conditions.

What worked for me...

- SafeTech 5.2.9 ISO (found

http://www.dpms2.com/tools)

in Compaq G62
- [WinTech crashed in ASUS A55A, HP ProBook, G62, worked in a old compaq presario, but didn't recognize HD or USB/Memory Cards or network).]
- HD had been encrypted with McAfee 5.1.8
- Acronis replaced the MBR to customize the boot process -BUT the encrypted disk was the SOURCE hard disk in a bulk copy, so NO MERCY with Acronis, SOURCE disks should not be touched, especially the MBR, and without user confirmation!
- After AUTHORIZATION with the daily code -changed date in BIOS- and AUTHENTICATION with SBFS provided by Sys Admins of the solution (Thanks to J.W.!) copied to a Memory Card which was detected properly. Selected my machine name.
- Selected Algorithm FIPS AES 256 bit (0x12) for workspace and disk
- Clicked Restore EEPC MBR and the system booted up properly again.

Lessons learned...
- Always keep a backup of your data... at least the MBR, boot sectors, partition info...
- MBRs of EEPC are unique for each machine -they contain Disk Info, the SBFS Map -position unencrypted where SBFS resides- so replacing the MBR with another EEPC MBR from a different machine does not work, even if you fix the partition table.
- Somewhere (MBR or SBFS section in hard disk) must contain an encrypted version of the encryption key, which is decrypted with the 6-digit password.

Thanks to all for your knowledge sharing, without it the recovery would have not been possible!

Kind Regards

 

[DanH68]

hello all
one more question,
i don't have a HP recovery FIle (.dat extension)(my fault,no backup at all)
but found GregsSDBD302HJ4J.SDB in safetech529.iso(seems useless)
can anyone provide me " AUTHENTICATION with SBFS provided by Sys Admins of the solution "

please help me

 

[linney]

This link mentions " change the date and time to match one of the 'day codes' ", perhaps that might be a clue for you?

Bitlocker: safeboot has been corrupted (error 92h)
thread1726-1576191

 

[DanH68]

sorry, i was not very specific
" After AUTHORIZATION with the daily code -changed date in BIOS-"
this worked ok
" and AUTHENTICATION with SBFS provided by Sys Admins of the solution (Thanks to J.W.!)"
here is my question:
AUTHENTICATION from
1 sbs """SBFS provided by Sys Admins """"
2 database
3 hp recovery file (surrely i don't have it)

i have none of these above, don't know what files to search for
how to pass this step

" copied to a Memory Card which was detected properly. Selected my machine name"
when i choosed 2 GregsSDBD302HJ4J.SDB in safetech529.iso the machine id showed there for sure is not mine's

one more step to regain my laptop,thanks for your patience

 

[linney]

Sorry, I have gone as far as I can on this subject which is not surprising seems as I don't have any experience with the subject other than what I can decipher from Google. I hope someone else can guide you further.

When searching for files do make sure that you show Both Hidden and System Files, and also to uncheck "Hide known file types" in Control Panel/ Folder Options/ View, to navigate or search for files.

.SBS File Extension

http://www.fileinfo.com/extension/sbs