Guest User!

You are not Sophos Staff.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Encrypted External Hard Drive

Hi, all.

I've got a problem that I'm not sure if there is any way to resolve.

I've been working on setting up a test environment using a couple of machines in my domain in order to get SGE working properly.  I've tooled around with the settings quite a bit, but I haven't rolled anything out into production yet.  I had been playing with settings, creating installers, setting up machines, and essentially testing the possible ways a user could break things.

I was out of the office, and one of my coworkers leant out a laptop I had been using that was fully encrypted as a temporary loaner, not realizing the thing was encrypted.  Long story short, the user connected an external drive (which was encrypted without anyone realizing it). 

I came in today, and wiped the machine (because I had a user who was going to need it over Christmas break).  I then found out about the external drive.  Is there any recourse to recover the data on that drive?

I checked in the Policy Editor, but I can not find the key for the old machine anywhere.  I have no other machines at the moment that are encrypted, and any machine I connect this hard drive to wants to format the drive.

Let me know if I need to clarify anything, and can anyone give me a hand or some ideas to try and recover this user's data?

:7181


This thread was automatically locked due to age.
  • A quick update:

    I was able to boot using BartPE and plug the drive in to see the key.

    My hope is that I can image the encrypted drive to make a backup, then run a C/R, but I'm not entirely sure if that will work or not.  Crossing my fingers, and I'll let you know how it goes.

    :7193
  • Are you using SafeGuard Enterprise or Easy?

    If you are using Enterprise, here's a KBA on how to get a WinPE CD and use it (and the keyrecovery tool) to unlock the drive.

    Otherwise, if you're using SafeGuard Easy 5.50.x, you should be able to use the appropriate CD from that KBA article to unlock the drive, although I don't have any experience with this (as we run SGN instead of SGE).

    Also, one last possible pointer, have you tried seaching for the key using the key ID instead of the name?

    :7195