Recover Partitions After PGP WDE Decryption

ChristopherDunn
ChristopherDunn used Ask the Experts™
on
Hello,

Background: I recently got a malware infection which combined with a Windows update to yield a blue screen when any starting mode was chosen (safe, command prompt, regular, last known good). As the hard drive was PGP encrypted, I chose to decrypt it to begin troubleshooting.

Problem: I removed the hard drive from my laptop and plugged it into my desktop, where I mounted it as a hard drive to one of my virtual machines that has PGP. I decrypted the drive and everything looked fine from the VM. I then detached the drive and put it back into the laptop. I get the boot menu but then it immediately goes to blue screen.

Recovery console doesn't work (can't recognise the file system). I booted from an Ultimate Boot PE environment, and it sees two partitions but cannot access them. DiskPart and Disk Manager sees the partitions but cannot access them either. Chkdsk cannot read them either. One disk recovery tool "FileRecovery" sees the lettered partitions with nothing in them, and it sees 2 partitions called NONAME. If I look into the NONAME partitions, all of the data is there. How do I fix the partitions so that they point to the data?

PS I'm an IT professional, so I don't need baby steps.

Thanks!
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Hi there,

Sorry to hear about the trouble you're having as I have indeed been there.  However, I have some good suggestions for you to try out!

As a more obvious initial attempt, if the recovery console on XP won't recognize you can always try a Vista or Windows 7 DVD and use it's recovery option. It will recognize and repair when XP won't in many cases. If you don't have a Vista or Win 7 disc, you can Google Vista Recovery or Windows 7 Recovery and find a CD image that has the Recovery portion that you'll need.

If that doesn't work or you'd like to try a more aggressive method, here are my suggestions.

First, cloning the disk might be a good safety precaution since sometimes it can be risky to attempt multiple types of repairs on a failing HD. Norton Ghost may be able to perform a sector by sector copy to an image or drive and DiskPatch is another utility that can not only clone drives with damaged file systems and etc., but is also able to repair all these problems. Of course, neither of these is free so a purchase would be necessary.

For a solution that doesn't involve paying however EASEUS Partition Recovery is a free utility that can find and repair lost or damaged partitions and partition tables.

http://www.easeus.com/partition-recovery/


These programs can also all be run from their bootable CD's which saves some drive swapping time and effort. Also, after repairing the partitions you might still need to perform a repair with the recovery console.

Hopefully one of these solutions proves successful and you get your data back.

Good luck!!

Cory ; )

Author

Commented:
I'm making a forensic ghost backup right now. EASUS was unable to find anything useful. I have a windows 7 dvd but I'm hesitant to use an OS disc to repair an OS of a different type. Are you sure that a windows 7 disc can be used to repair XP? The frustrating thing is that I know all the data is there and perfectly fine, but I just can't access it. I'm nearly positive there is nothing physically wrong with the drive... I just think the decryption process wasn't able to do the final step because it was done through a virtual machine.
Yes you can use the Windows 7 disk to repair a drive with XP installed.

You'll need to perform the Startup Repair, this will fix the startup files that should be the root of your problem.

 I suspect a damaged partition table is the issue you've been having, repairing the MBR and startup files should fix this and any other potential issues that are preventing your computer from recognizing the file system or partition. That will get you access to the partition again.

After this, you'll have to possibly perform a Windows Installation Repair with your XP disc if windows won't boot, to get the OS running properly again. If it was damaged too badly though, you may need to reinstall the OS, hopefully this can be avoided!

Author

Commented:
Startup repair didn't help and I finally gave up and reformatted it and installed Windows 7. My last backup was only a couple days before the crash, and I was able to recover whatever was newer by using "the ultimate boot cd" to boot from -- something I had lying around, and using the "FileRecovery" application. When doing so, I found that some things were missing (like the somewhat important "Documents and Settings" folder) so there was actual damage to the files or file structure. The only thing I lost of importance was my iphone backup, which is a shame because my iphone was just stolen and i could really use the data that was in that backup - itunes stores it in a weird location so it wasn't included in the regular data backup.

So lessons here are to make a forensic backup before decrypting a volume and always keep a current data backup. Thanks for your help!

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial