ProtectTools issue: Decrypting an encrypted ProtectTools HDD where windows will not boot.

[Fred72]

Hi There !

I have a HDD that was encrypted with HP ProtectTools drive encryption from within Windows7.

Computer is 8460p Elitebook.

For 2 years it started up fine and gave me no issue until my windows did not start as expected.

(The reason for windows not starting is a mix of me shifting from domain to local coupled with windows bug regarding these services)

In short: All passwords works and Windows 7 64 starts but kicks me out some way into the log in sequence.

Since I cannot start windows on the encrypted HDD I cannot decrypt the drive  ....

Since the drive is encrypted it cannot be read from outside

Since the HP PtotectTools , started from an external win 7 HDD neither can see that the drive is encrypted 

Since all of this I am totally stuck.

It really sucks that although I have all passwords accessable , saved them on USB sticks and  have them in mind, cannot reach the data.

Is there any HP tool that can decrypt the drive when I have all keys necessary??

regards/Fred

[Checkurtech]

Hi 

      Can you remove the Encrypted drive and hook it up to a working machine and do a Scan disk to see if the Windows instalation can be repaired ??? You will need an external caddy to achieve this . Also have you tried MEO File Encryption Software which can and will decrypt any files from drives internal or external .

 Checkurtech  

[Fred72]

Just to be clear. WIndows boots correct but due to some windows bug on group policies I cannot get in. 

If I cannot get in I cannot do anything.

@Checkurtech: The drive is encrypted that means that is cannot be read from outside since there is no standard file system to read.

MEO not tried

[Fred72 · Accepted solution]

My collegue found the right tools. Took me just 2 hours to recover all data !!! 

[Fred72]

Steps to Retrieve Data Encrypted with 2011 Drive Encryption for ProtectTools (vers. 6.x)

If the computer system does not boot, and displays a message similar to “McAfee Endpoint Encryption. Fatal Error: [0xEE020002]” or “pePC has been corrupted – ERROR 92h” on a hard drive encrypted with 2011 Drive Encryption for ProtectTools, there is a tool can be used to attempt to retrieve data from the hard drive.

Legal Notice:

DiskTech 2011 tool is provided “As Is” by Hewlett Packard Company and McAfee, Inc. Neither Hewlett Packard nor McAfee provide any warranties either explicit or implied that any encrypted files can be retrieved using DiskTech 2011 or any other tool.

Prior to encrypting any data, the user is advised to utilize backup utilities and perform frequent backups of their data to secure media.

Instructions:

You must have access to the backup encryption key (.dat file typically saved to a USB) and have the DiskTech2011.iso (ftp://ftp.hp.com/pub/caps-softpaq/TCE&Q/DiskTech2011.iso) burned to a CD.

• Before attempting to boot from the DiskTech 2011 CD, you will need to go into the notebook BIOS and temporarily switch the drive controller to IDE mode (F10>System Configuration>Device Configurations>SATA Device Mode). You will be asked to confirm this change to the Drive Controller, click the Confirm button to do so. A blue screen error (BSOD) will occur during boot if the drive controlled is set to any value other than IDE.

1. Boot from the CD.  Make sure the USB key containing your recovery key and any other external USB storage devices are attached to a USB 2.0 port (not USB SS port) before powering on.
2. After booting, select whether or not to start network support (probably no for most users).
3. Click "Go" at bottom left.
4. Select Programs>McAfee EETech.
5. Click "HP".
6. Navigate to the recovery key on your USB key.  Select "Open".  (If the encrypted drive is not mountable, it is here where you will usually receive an error)
7. The drive should now be mounted.  You can leave the Authentication window open.
8. Click "Go".
9. Select Programs>A43 File Management Utility.
10. You should now be able to access the files on your drive and move them to an external device.

• When finished, don't forget to go back into the BIOS and change the controller back to AHCI mode.

The files on the hard drive are still encrypted when this retrieval process is completed, and you will not be able to boot from this hard drive unless it is rebuilt. You may choose to store the hard drive in a secure location for future access to the files remaining on it. The files on the hard drive will not be accessible except through the DiskTech 2011 tool.

You may choose to rebuild the operating system on the computer using OEM disks, or entering the HP Recovery Manager by pressing the F11 key during the boot process (if the recovery partition remains on the machine).

• If the hard drive is formatted (by HP Recovery Manager or using the Quick Format feature on the OEM setup disks), all files on the hard drive will be wiped, and will no longer be accessible through any method.

Note:

If the data cannot be retrieved using the DiskTech 2011 tool, you may send your system to Hewlett Packard. HP may be able to retrieve the data through more intense data retrieval methods. However, HP cannot guarantee that any data can be retrieved from the hard drive. You must contact HP Support for instructions to ship your system.

[sabinabrauner]

What was the solution????

[scunningham12]

Following up to sabinabrauner, if the DiskTech doesn't work what's the next step?  I have two laptops that crashed within a day and I need to pull the data off but can't get anywhere.  Is there a another program that can help?

Thanks

[sabinabrauner]

I'm not able to get the DiskTech2011. I get the webpage is not available. How can I get it?

[scunningham12]

This link will download a word document and in that document is a link to download the .iso.

https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=7&ved=0CEoQFjAGahUKEwiZ5tqY_N3GAhWKHR4...

Steve

[scunningham12]

Just to follow up, I called McAfee since I was getting an error using this program.  They said because we're not using EPO to manage our encryption, we're screwed.  The dat/xml files were corrupted.  Am hoping HP has a brute force program that will allow them to pull files.