Endpoint Encryption

Ok I have a massive problem (Version 10.2).PGP WDE not recognizing my passphrase anymore and iam really stuck what to do. All the drama begins with Windows 7 that not started as usual and runned its recovery mode that didnt found any drives or running windows systems. I just clicked on try to repair disk and all is destroyed now. Since this action PGP WDE cant recognize my passphrase anymore.

BUT I can start my old windows system on my second drive with same passphrase and bootloader attached to my pc.

This second drive is encrypted with PGP WDE on my first drive (Windows 7) that not recognizing my passphrase anymore and not acessable anymore.

For one boot period it was able to mount the first harddisk with windows and never ever again. (No it ask for passphrase and returns its not matching)

I didnt set any "forgot passphrase" questions on both drives. Rescue disk not working and all command line options fails with different error messages:

a) Error code -12220 disk allready managed

b) Error code -11984 object not found (when i use --phassprase "mypassword")

When i enter PGP WDE it shows me some key with correct user that i used for encryption. But it only shows ONE KEY symbol that means no keypair so maybe private key is missing. I cant change my passphrase on this key. Looks like just a public key.

At all there is a running bootloader with same passphrase on my second drive that i encrypted with the first drive when all worked probably.

Question is how can i force PGP WDE to decrypt my first drive with the same settings used by the working device? There must be a solution or way to extract the key or copy the running bootloader to the broken pgp volume (MBR etc) and force the tool to encrypt it.  

best regards and thanks for you help

mololin

cleared the MBR now and tryd pgpwde --recover --disk X --p "passphrase"

it found something at SECTOR XXX but passphrase is not accepted (same with rescue disk)

so what happened....someone injected a trojan that overwrites sectors used by PGP WDE?

there must be a way to force PGPWDE to decrypt the disk using all the data aviable at my second drive.

I'm running PGP Desktop 10.0.2 on a Toshiba  Satellite C655 running 64-bit Windows 7. I did WDE on a 149G external USB drive, a WD1600JB. It worked fine for a few days and then I had a power outage 3 times in a one hour time frame while this disk was mounted, The disk was not protected by a UPS so it recycled 3 times to my utter dismay. I had two encrypted volumes on this drive as well. I've been experimenting with different methods of encrypting and backing up customer data in the hopes of making this accessible to low end users, so they can periodically back up family photos and movies, business data, and other data at low cost. After using Disk Manager and changing settings in different combinations I was able to get the disk to accept my passphrase, unless it was just coincidence. But after another couple of days it wouldn't accept the passphrase again. I don't know if it was the power outage or what that caused a deterioration of the disk or if my fiddling around with Disk Manager solved the problem the first time. Right now the passphrase doesn't work. What's worse is I can't delete PGP off the disk and start over. I Googled this and tried many methods of splatting the disk to no avail. Please help!

Thanks,

Nick

The fact that it is finding something is promising, but you will have to know a password it expects for the disk in order for it to allow you to recover.  You can't somehow use the information from a different drive for this authentication. 

If you are absolutely sure that you have used the correct passphrase in your command (please try again to double check), then the disk is likely unrecoverable. It is unlikely that there was any sort of virus overwriting sectors, but more likely something like a bad sector at wrong location, glitch from drive controller (or Windows) writing the wrong data to a sector, or some other program attempting to access the drive with custom calls instead of standard Windows calls, etc. 

After all above steps if you have got an access to the disk and you can bypass bootguard you can, decrypt the drive and then remove PGP.

HTH