Printable View
hi got a mates laptop and need to get some files off it ,but before i can into windows it has a logon screen " mcafee endpoint encryption login". ive tried taking out the hardive and putting it in another pc which it shows up but with no files , and when i click on it it says this hardrive need to be formatted.
is there anyway i can see the files
thanks
I'd be very surprised if you could de-crypt it without the encryption keys. We used this before McAfee bought them out and it was hard enough even with them!
The entire idea of encryption is the files cannot be accessed without the password so if you don't know it then I would either look at data recovery services (very expensive) or give up.
Basically impossible unless you want to spend a fortune. If it was easily crackable then no one would use them. had a sim issue when my works machine crapped up. they had to re-image it
Could you not just ask your mate what his user name and password is to login to safeboot? Then get the files from windows you need.
he has the user name but forgot the password
I know this is an older thread, and I don't have an identical situation...
But here it is:
I have a work laptop that died, just stopped working and won't power on. We have McAfee endpoint encryption. The company's solution is to issue me a new laptop, oh happy day. The new laptop also has McAfee endpoint, so I thought I could just pull the drive from the dead one and attach as an external and pull the data, but I can't get a prompt or anything for the password. Win 7 just says the drive needs to be formatted before use.
Any idea, knowing the username and password, how to decrypt a drive that has McAfee endpoint encryption?
Thanks for any help.
Firstly, welcome to DF. It is good manners (and forum rules) to post an introduction when you first join so you are not suspected as being a leech.Quote:
Originally Posted by chromeBuddha
The reason your Windows install doesn't recognise the drive is because of the encryption, it 'scrambles' the data. I am not sure if McAfee have a tool to mount an external drive. The best thing to do is to put the old drive into your new laptop and boot from it so it will ask for the password at boot and then launch windows. You can then copy your data off onto an external drive, USB, across a network etc.
This assumes the encryption doesn't pair the drive to your laptop and just uses an encryption key to decrypt the drive.
Encrypted drives are easy enough to access if you can meet any of the below criteria:
1) You have the keys
2) You can power the system on and have it load the OS
3) Freeze the ram inside the machine with liquid nitrogen.
You can get the keys from an active memory dump using forensic password recovery software, such as http://www.lostpassword.com/kit-forensic.htm
You can dump the memory over fireware connection to the running machine as welll.
This information will not help you in any way.
DJ OD
Not sure what a leech means in the environment of this forum? Didn't intend to be one. The thread seemed dead, so didn't think I was thread jacking...
And not sure why a post was made where the intent was to post nothing helpful...
I was able to borrow a colleague's laptop of the same model, etc. and recover the data, but the problem still interests me. If I plugged the dive into my current laptop, would there be issues with drivers, or would I just boot windows in Safe Mode and then pull the data?
I understand that the encryption software tries to safeguard the data, but in the case of a catastrophic system hardware failure, it seem it leaves you with a drive that cannot be recovered. I guess I am thinking of the older versions of Windows where taking a harddrive from one system to another would have strange and usually undesireable results.
A leech would join the forum to get something they want and then move on. I wasn't accusing you but you just joined and your first post was a request so maybe you can see why I mentioned it ;)
DJOD was answering your question with facts, most people here like to expand their knowledge of various subjects even if it may not prove useful to them.
If you just intend to grab the data then I wouldn't worry about drivers being a problem. You can always install crucial drivers if needs be. What OS is on the drive you are pulling data from?
It is on Windows 7.
Leech...I may be. I belong to a lot of forums and don't often post to more than a few. But as a relatively inexpert person, though I have spent 15 years in IT, I would guess I will do much more learning than enlightening here...
How often is it practical to use liquid nitrogen anywhere, much less in data recovery. Maybe overdose would be better as overkill?
With Endpoint Encryption you can get files off a machine that won't boot by using the eepc recovery tools. You can download the tools from the McAfee website using your grant number and then install onto a WinPE boot disk. Once you've got the recovery tools you've need the McAfee code of the day and the recovery xml from the ePO server or the user name and password that has permissions to unlock the drive. Once its unlocked you can freely browse the drive and recover any data from it.
Your admins at work could easily do this for you, but i'm assuming they give you some method of backing up your laptop and will say if you have files not backed up then its your own fault and won't waste the time recovering anything else.
When you boot do you have to enter a user name and password or does it use autoboot? I think that if it uses auto boot it won't work too well in another type of laptop.
You seem to have quite an attitude for someone who has come here for free help (and is receiving it). You don't have to be an expert to stick around and post, this is a community with interesting (non-technical) discussions, tech news and all sorts of other info.
Livesey has just provided you with specific info which should get you out of your fix but as long as the encryption isn't tied to to the mobo using TPM or other methods then Windows 7 is very good at sorting it's own drivers out if connected to a new machine.
I wasn't trying to give attitude. I thought I was being self-deprecating. Most places I go I find I learn more than I teach. Not sarcasm.
But what I did think is that DJ Overdose was being sarcastic with the comment about using liquid nitrogen to freeze the system ram. But what it didn't seem, to some guy like me sitting in a cube farm/gopher farm, was useful. Maybe it was an inside joke, but it seemed like giving someone directions to the pharmacy that include the instruction, "Turn left at the moon." The only place I have seen liquid nitrogen used since a college classroom, was in an engine assembly plant where they cooled the cylinder sleeves before putting them in the engine block. But maybe Overdose is in a different industry where its use is much more common.
I completely agree, Livesey has provided a specific path to recovery that I will look into. The system required a login at bootup, so I have the username and passwords. I will see if I have access to the tools on McAfee's website. There was backup software available, but I didn't use it out of ignorance. I didn't think I could get it working from inside the customer's firewall or using remote access. Thanks for your help.
There is a flaw in certain tech whereby cooling the chips with liquid nitrogen can exploit a vulnerability. He was posting info (that IMO is interesting to know) rather than suggesting a procedure for you to follow.
Let us know how you get on and which method you end up using!
As long as the registry isn't encrypted by McAfee you could rip it from there as long as it hasn't been wiped a quick Google will find you loads of tools capable of doing this.
Sent from my Nexus 4 using Tapatalk 2
Freezing the memory chips actually makes them retain data after the system has been shut down.
RAM stores data for a few seconds after a system shutdown by default. Spraying with nitrogen will lower the temperature of the chips slowing the data rot considderably. You can improvise by using an upturned airduster spray to lower the temperature.
Once cooled, you can remove the ram, install in another laptop and use a memory dumping boot tool to image the ram. Then use a forensic cracking tool to extract the keys.
Some light reading: http://www.zdnet.com/blog/security/c...on-methods/900
My post was actual solutions to the scenario you posted. It woulnd't be of use to you, as you or most regular people would not have the tools or inclination to do the job.
I've been in IT also for 18 years, and I know a thing or two about security.
DJ OD
Quote:
Originally Posted by DJ Overdose
Hi DJ Ovedose and others!
I have a serious issue that I need help with. I have a corporate laptop, that hasn't yet been returned to my former employer. I have important files which was backup on an external hard drive, but I cannot locate the drive. Before, I mail back the laptop. I'd like to get my files off the computer. It has 3 years worth of Microsoft office files that I need.
Is there anyway I can get these files?!
The laptop is a Lenovo Thinkpad X1 Carbon, running Windows 7 (I think), and has Mcaffe Endpoint Encryption.
I can't remember the password for the endpoint encryption or maybe my profile is no longer active. Either way, can anyone help me?
Thanks! And I'll stick around to post on other threads. I just really need a bit of help here!
Ouch. Nasty bind to be in.
Endpoint protection is exactly as it says on the tin.
Usually I would recommend putting the drive into another system to copy the files from, but without the endpoint protection password, the drive will be completely encrypted.
The only advice I can give is either find that drive or remember that password. Not much else can be done I'm afraid.
I've been in a similar situation myself and had to forget about about the DATA I needed off the drive and gave it up as a 'Oh Well'.
McAfee is on there for a reason.