File Share Encryption

 View Only
  • 1.  Several oddities after cloning drive

    Posted May 02, 2015 12:10 AM

    I cloned an encrypted HD to a new one.  When booting from the new one, I got bootguard however I would get a 'missing operation system' after entering my password.

     

    I booted up a windows install cd and ran /fixboot and /fixmbr.  These commands seem to have worked and on a reboot, it now goes straight to windows and bootguard is entirely skipped.  However this makes no sense to me.

     

    1.  How is it that running these commands essentially bypassed the entire encryption proccess?  Or is the encryption part not copied over when cloning a hd?  SDE shows the disk as unencrypted. I did the clone while Windows was running using EaseUS Todo Backup.  I am leaning toward this being the reason, it copied over the windows installation only, which was basically unencrypted. 

     

    2. (RESOLVED) I cannot seem to re-encrypt this new hard drive.  I get the following error: 

    Unable to encrypt: resources unavailable (-11973)

    and then it will ak me for a passphrase to unlock the disk (and my previous password doesn't work).  Also this is weird because this drive shows up as unencrpyted in the first place.  

    3.  After resolving issues 2 and encrypting my boot drive, I can no longer mount a third data drive that I had.  After entering the passphrase on the windows client, nothing happens.  No error comes in but the drive does not mount and let me access my data.  Windows only recognized a RAW partition and wants me to format it.  I was able to mount this drive just fine before encrypting the boot drive.



  • 2.  RE: Several oddities after cloning drive

    Posted May 19, 2015 02:05 PM

    While Windows is running, any data accessed from the drive (such as data accessed by a backup/cloning utility) would be decrypted on the fly, so it makes sense that your backup would not be encrypted.

    When imaging a drive from a backup/clone, there are a few different things that can happen.  The most common is this: when the cloning utility clones the boot sector, that sector will still contain the pointers from the encryption Bootguard, which clearly would not be pointing to a viable location on the now-unencrypted file system, so the system is unable to boot.  Usually a boot repair using Windows installation media can fix this.

    For issue 2, it may have been reading the old PGPWDE00 or PGPWDE01 file from the root of the C drive, which contains information related to the encryption, and may have been cloned over.  This can lead to some issues where the software effectively can't decide if it is encrypted or not.

    For issue 3, is the drive internal or external?  If it was mounted internally, it may have been added to the same disk group as the boot drive when it was encrypted.  If that is the case, the access list and key to unlock the drive would be stored on the boot drive.  Since it no longer has access to that key, it will not be able to unlock.

    In your case, however, it sounds more like it is external, in which case the access list might have been damaged somehow.  If it reads as RAW to Windows and unencrypted in Symantec Encryption Desktop (SED), it may have some damage to that access list.  Open a command prompt as Administrator, and try the following:
    cd "Program Files (x86)\PGP Corporation\PGP Desktop"
    pgpwde --enum
    pgpwde --status --disk X

    Disk X would be whatever number the --enum command lists for the drive that is experiencing the issue.  If it shows as unencrypted, you can try the following:
    pgpwde --recover --disk X --passphrase P@ssw0rd
    where P@ssw0rd is a valid passphrase for the disk.  This will try to repair the access list.