topic How to recover the data on the encrypted Hard Disk (Full Disk Encryption) in Endpoint

How to recover the data on the encrypted Hard Disk (Full Disk Encryption)

Chinmaya_Naik — Thu, 18 Jul 2019 10:58:36 GMT

Hii Team,

Requirement: How to recover the data on the encrypted Hard Disk.

I follow the sk105523 to make the below process.

Step 01: Remove the HARD Drive from encrypted PC.

Step 02: Connect to the Another PC (Example: HOST_A) through USB port by using a converter to access the Hard Drive (Encrypted PC).

Note: HOST_A must have Endpoint Security Client installed with FD blade enabled. (E80.51 or Above)

Step 03: GO to location "%programfiles(x86)%\CheckPoint\Endpoint Security\Full Disk Encryption" on HOST_A.

Note: You found the "FDE_Drive_Slaving.exe".

After complete above step follows the below final step.

Step 04: Open the "FDE_Drive_Slaving.exe" then select the Drive of encrypted PC and start to recover.

NOTE: Make sure you open the FDE_Drive_Slaving.exe utility as an administrator, and once that is open connect the mounted drive. Connecting the mounted drive before opening the FDE_Drive_Slaving.exe utility may sometimes not work correctly. (Thanks Steve_Lander for this information)

Once the drive shows up on the list, you can click on it and unlock it with FDE credentials.

Also Please suggest If any other simple procedure apart from using "Dynamic Mount Utility".

Regards

@Chinmaya Naik

Re: How to recover the data on the encrypted Hard Disk (Full Disk Encryption)

G_W_Albrecht — Wed, 27 Mar 2019 08:45:59 GMT

The most dreaded issue nowadays with FDE is: After a Windows Update, Windows fails to boot anymore. For such events, we use the old PointSec way 😉 listed in sk90242: ATRG: Full Disk Encryption E80.40 Full Disk Encryption Recovery using Full Disk Encryption Recovery Media. The method from sk105523 must be used if the HDD Controller or mainboard is defective.

Re: How to recover the data on the encrypted Hard Disk (Full Disk Encryption)

Chinmaya_Naik — Wed, 27 Mar 2019 08:55:20 GMT

Thanks, @G_W_Albrecht I got your point.

Yes, the sk105523 is when HD Controller or mainboard is defective.

I need to validate the step that I shared.

@Chinmaya Naik

Re: How to recover the data on the encrypted Hard Disk (Full Disk Encryption)

Steve_Lander — Wed, 27 Mar 2019 13:49:51 GMT

Make sure you open the FDE_Drive_Slaving.exe utility as administrator, and once that is open connect the mounted drive. Connecting the mounted drive before opening the FDE_Drive_Slaving.exe utility may sometimes not work correctly.

Once the drive shows up on the list, you can click on it and unlock it with FDE credentials.

Re: How to recover the data on the encrypted Hard Disk (Full Disk Encryption)

Gerbelhunter — Mon, 23 Sep 2019 14:53:26 GMT

I'm trying to use this technique, however on the system that has FDE installed, I can't find a file path to "%programfiles(x86)%\CheckPoint\Endpoint Security\Full Disk Encryption"

I've trying installing CP_EPS_E80.51_Clients_Windows over the top - Master_FULL\EPS.msi - and I get an error;

Error 27559. No blades were selected. Check Point Endpoint Security installation aborted.

Does anyone know where I can get a copy of the FDE_Drive_Slaving.exe? What package do I need to install to access this?

Thanks,

Re: How to recover the data on the encrypted Hard Disk (Full Disk Encryption)

PhillipHuman — Thu, 06 May 2021 07:24:35 GMT

When I try this, I get a bluescreen of death.

Also, the drive i have is partially encrypted, windows wont boot up either so I cannot finish the encryption

Re: How to recover the data on the encrypted Hard Disk (Full Disk Encryption)

IamArt — Wed, 21 Jul 2021 03:21:26 GMT

Hi Shinmaya, if I installed FDE but system drive got an error and re-format without decrypt data drive first. Is it possible to use this method apply to get data back? Or do you have method to recommend? Thank you very much in advance.

Re: How to recover the data on the encrypted Hard Disk (Full Disk Encryption)

PhoneBoy — Mon, 26 Jul 2021 03:58:05 GMT

Pretty sure if you've already erased the disk, you're out of luck.