topic Re: Checkpoint FDE RAW partition no OS load in Endpoint

Checkpoint FDE RAW partition no OS load

Alex_Aitis — Thu, 28 Jun 2018 06:16:40 GMT

Hello to all,

We are the start of implementing FDE with Checkpoint and from 26 pc encrypted with preboot enabled we have 2 laptops that are not loading OS anymore after preboot authentification. We checked the disks and the partition that was encrypted its RAW (after preboot auth)

The common things are: Windows 10 Pro(1703 / 1709)

Endpoint client is 80.83

What can we do to try recovering the OS? Some hints and tips?

Thank you

Re: Checkpoint FDE RAW partition no OS load

Alex_Aitis — Thu, 28 Jun 2018 06:54:01 GMT

Also if anyone can point me how to collect the logs from that machine if it doesn't boot?

L.E: found the preboot tool

Re: Checkpoint FDE RAW partition no OS load

Alex_Aitis — Thu, 28 Jun 2018 09:40:20 GMT

So we did recover the data(with recovery media tool - decrypted the partition) and now Windows is still not loading giving us a blue screen with error "Page fault in non paged area"

Looking for advise

Re: Checkpoint FDE RAW partition no OS load

Steve_Lander — Thu, 28 Jun 2018 13:15:09 GMT

Can you try to boot into Safe Mode to see if you can get to the OS? From my experience if we can get the data off the laptop by mounting the drive, but it can't boot to windows, we have just been rebuilding those laptops (imaging a new OS).

I would open up a case with TAC if getting the actual data off the laptop is not possible even though you decrypted the laptop.

Re: Checkpoint FDE RAW partition no OS load

Alex_Aitis — Fri, 29 Jun 2018 08:20:19 GMT

Eventually, we will reinstall that laptop. The support told me that it was an issue with Fast Startup function from Windows.

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk122633&partition=Advanced&product=Endpoint

We are still looking for possible scenarios on how to avoid this...

Any tips and tricks?

Re: Checkpoint FDE RAW partition no OS load

Steve_Lander — Fri, 29 Jun 2018 12:08:38 GMT

In our BIOS settings, we use the new UEFI BIOS instead of legacy. We have Fast Boot in the BIOS off (to correct the issue with usb mouse/keyboards in the preboot environment) and also Fast Startup in the Windows Power Options turned off (via GPO).

Since we turned off that fast startup in Windows, we haven't had that screenshot thats in the SK article you listed.