File Share Encryption

 View Only
  • 1.  Partitions lost (NTFS -> RAW)

    Posted Jun 03, 2015 03:32 AM

    Dear all.

     

    I had a spontaneous failure on my work laptop contaning critical professinal data: Windows boot Manager inviting my to "repair your computer".

    I precise that the hard drive does not show any sign or noise of physical malfunction.

    The concerned hard drive is internal with 2 partitions : primary (60 GB) extended (440 GB)

     

    Below a quick synthesis of all actions i've tried (without success):

    1- Tried the repair option of Win 7 cd : failed to repair partition table (error code : 0x3bc3)

    2- Followed this support tutorial: https://support.symantec.com/en_US/article.TECH149679.html

         + As i cannot even reach the PGP BootGuard screen the section 1 is irrelevant

         + Section 2 did not work either

         + Section 3: tried nearly all the recovery CDs proposed without sucess = even with the disk in internal or USB. No activity ... the lost HD led never blink during the scan even waiting for an hour ... The PGP tool seems il can search for ever without finding anaything. In fact the recevory tool says something like "searching for PGPWDE previous install" ... how can he manage that as partitions are lost :/. And i don't what is the difference between all versions of PGD recovery disk as i don't know which version is on my laptop

    3- And finally i tried Testdisk 7.0 = can see the RAW partition but cannot recover partitions. It justs re-write FAT table resuslting with now one RAW partition instead of two

     

    So as i wasn't able to acheive anything by myself (or with my local technical support), i am crying and despairing to recover my precieuse data. In one word : Help.

     

    Thanks

    PB



  • 2.  RE: Partitions lost (NTFS -> RAW)

    Posted Jun 04, 2015 11:45 AM

    Your best option at this point would be to slave the drive to another system that has Symantec Encryption Desktop installed.  From there you can use the command line arguments in section 2 of the article you mentioned above to see if the encryption is recognized.

    Unfortunately, there is a chance that the data is unrecoverable.  Windows repair while the drive is encrypted can cause data loss.  If it attempted to change the boot sector and alter the partition table while encrypted, it can overwrite the access list and encryption keys.

    Even when that happens, there is a backup access list, which can possibly be found using the pgpwde --recover command.  It looks like the drive was reformatted as FAT with one partition, which most likely will prevent that command from having any success.

    The drive may be recoverable by a third-party, such as Drive Savers, but I think it would be highly unlikely.  You may wish to contact them and explain the situation.