Endpoint Encryption

Basic Information :

- Laptop running Windows XP

- HDD fully encrypted by PGP V 10.3.0 MP1 Build 9060 - Licensed to IBM Corporation

The Problem :

- When the HDD is installed in the original laptop, as the main HDD :

      - boot passes PGP authentication

      - when Windows XP loads, it always stops at agpCPQ.sys, which then results on a blue scree with the message UNMOUNTABLE_BOOT_VOLUME

      - the 'agpCPQ.sys problem' is known by Microsoft and there is a solution presented by them but involves the use of the Windows Installation disk, which is not an option in this scenario because the entire disk is encrypted.

- When the HDD is a USB slave drive connected to another laptop running PGP V 10.3.0 MP1 Build 9060 - Licensed to IBM Corporation

      - PGP asks for the password

      - PGP application shows the HDD disk in the "Encrypt Disk or Partition"

      - Windows Disk Manager shows the HDD disk, but indicates that free space = total space (no data)

      - No further options are available through PGP (Decrypt and Re-Encrypt options are not available)

      - After some time, I get the message " You need to format the disk in drive E: before you can use it. Do you want to format it ?"

- I tried the HDD on two other laptops, as the main HDD, and the problem persists

- I pluged the HDD through USB to four different computers, laptop and desktop, Windows XP and Windows 7, and the problem persists

I have some important information in this HDD that I need to recover and your help or suggestions would be really appreciated.

Thank you

Alberto

Perhaps this will help.  The below articles describe how to perform a forced decryption using various methods (plus links to the bootable recovery disks):

http://www.symantec.com/docs/TECH149679
http://www.symantec.com/docs/TECH199905

I was using Recuva and most of the files were successfully recovered (about 30 GB). However, Recuva doesn't work all the time and crashes when it tries to recover some specific files.

Following the instructions in the above articles, after some hours I got this :

C:\Program Files\PGP Corporation\PGP Desktop>pgpwde --stop --disk 1 --passphrase
 gigsdu2grucgh
Request sent to Stop encrypt or decrypt was successful

Then :

C:\Program Files\PGP Corporation\PGP Desktop>pgpwde --stop --disk 1 --passphrase
 gigsdu2grucgh
Request sent to Stop encrypt or decrypt was successful

C:\Program Files\PGP Corporation\PGP Desktop>pgpwde --status --disk 1
Disk 1 is instrumented by bootguard.
  Encryption removal process interrupted by user request
  Current key is valid.
Request sent to Disk status was successful

At least Recuva is still reading the HDD. It is a great application, but keeps crashing on the very same files.

Would you recommend any other tool similar to Recuva ?

Thank you !

Alberto.

You might be in a bit of a pickle now tbh.  My normal recommendation should a decrypt partially fail, would be to contact Symantec support.  Given you've used a third party program though, they may not be able to help you out.  Worth a try nontheless though!

As far as I can tell, you've sent to commands to pgp telling it to stop whatever it's doing (wther that was an ecrypt or a decrypt action), and a command to check status.  I don't see an attempt to actually tell pgp to decrypt.  Why is this?

Also, have you tried the PGP Recovery disk images?

Hello,

just now I realized that I had pasted twice the same command. Let me make the necessary corrections.

I had executed this:

pgpwde --enum
pgpwde --status --disk 1
pgpwde --list-user --disk 1
pgpwde --decrypt --disk 1 --passphrase gigsdu2grucgh

After some hours, I had decided to check the status of the ongoing decrypt process :

C:\Program Files\PGP Corporation\PGP Desktop>pgpwde --status --disk 1

I no longer have the original message, but it was about the decrypt process have stopped due an error

So, it was clear to me that it would not work and I decided to give a chance to another application - TestDisk - which worked like a charm. It took way longer than Recuva, but ALL my files were successfully recovered.

Thank you very much for all your support. This thread can be closed.

Alberto

I'm glad to hear you got it sorted.

Should you encounter any similar issues in the future, I'd recommend you try using the boot images I posted earlier when I first mention performing a forced decryption, rather than using 3rd party tools (in case you need Symantec support).

You can close off the thread yourself by marking whichever post you want as the "Solution".