To be able to decrypt a disk, is important to check the status of the disk drive. To be able to check if the disk is encrypted or not, or if you have the correct key, is important to get the disk information first. To get disk information you must boot the system to CD or USB using the EETech/DETech tool.
The EETech/DETech tool can be download from McAfee Website , and by following the “Drive Encryption 7.1 DETech User Guide” on page 54. I also have couple of the ISO’s on my google drive, that can be downloaded here.
- Start your computer with the bootable EETech/DETech USB or CD, once booted you will see the following screen. Click on “Disk Information”.
- The next screen will show detail information of the disk. The most important information we are looking for is the Key Check, Disk Crypt List information, start sector and sector count.
- Scroll down to see any additional information, if you have multiple drives, it is important that the following information is collected for each disk.
This information is important, depending on what is showing here, we have couple of option for recovery.
- Key Check – If you cannot find the .xml file from ePO searching for the hostname of the computer, this information can be used to search for recovery information based on Disk Keycheck. The follow KB73184 gives you step by step on how to get this information.
- Crypt List Count – If this information is there, we can try emergency boot, Remove EE/DE, WinPE or Force Crypt Sector. Without the crypt list the only option we have is to use WinPE or Force Crypt.
- Start Sector and Sector Count – This information allow us to know where the first sector and last sector for each partitions is.
This information will be crucial for the recovery option. This concludes how to gather the disk information needed for recovery.