File Share Encryption

Hi there,

Recently one of our machines failed when doing a Windows update (it got stuck in a reboot loop that we couldn't get out of). We decided to remove the hard drive and decrypted it using Symantec Desktop Encryption on one of our other machines, however, since recovering the files we needed from it we've been unable to do anything with them. Symantec Desktop Encryption no longer seems to recognise them as encrypted but when we try to open them (either normally, in safe mode or by using 'Recover Text From Any File'), they fail. We've also tried other 3rd party apps to try and recover the text, but again these seem to think the files are still encrypted.

We have the passphrase for the hard drive - is there anything we can do to recover the data? For what it's worth, we've tried to decrypt them using Symantec PGP Command Line too, but that just throws up the error 3031: input does not contain pgp data.

Does the decrypted drive now boot as normal?  Are all files unreadable, or just these specific ones?

From what you've described, it actually sounds to me as if these files were additionally subject to a form of file-based encyption, on top of PGP's volume-based whole disk encryption.  Is this possible?

Hi,

No, unfortunately the drive is not booting as normal. We've tried a few different things, like trying to repair it with Windows 10 installation media, but it diagnoses and just can't seem to figure out what the issues is.

As far as I'm aware, there wouldn't have been another level of encryption. We do all have PGP keys set up, but rarely use them (and I'm fairly sure that the owner of this laptop didn't even know the passphrase for theirs). 

Is it possible to have Windows bitlocker turned on as well as having the hard drive encrypted by Symantec? To the best of my knowledge, we would have turned it off before using Symantec Desktop Encryption, but I couldn't be 100% sure. 

That does sound odd.

It's typically not possible to have 2 forms of drive encryption applied.  The fact that you are able to see individual files after the disk decryption, suggests there was only a single form of volume-based encryption, and implies that bitlocker was not also applied.

Are any files readable?  Can you, say, open up the hosts file from the decrypted drive, or run that drive's version of notepad.exe, for example?

It is certainly possible to have Windows individually encrypt specific files (file-based encryption), which is why I ask if it is just some specific files that are affected.