Data Recovery from an encrypted drive that was formatted

Forum on data recovery, file unerase, disk unformat, and RAID reconstruction.
Forum rules
Discussion on the R-Studio, R-Studio for Mac, R-Studio for Linux, R-Linux, and R-Undelete software

Data Recovery from an encrypted drive that was formatted

Postby vt2017 » Wed May 03, 2017 4:13 am

By mistake I have formatted my external hard disk that had McAfee Encryption for removable media in place. There has been no action on this external hard disk subsequent to these steps. I tried some of the recovery tools, but none have helped. Is there any chance that I can recover my lost files?
vt2017
 

Re: Data Recovery from an encrypted drive that was formatted

Postby Alt » Wed May 03, 2017 9:18 am

I'm afraid no chances for recovery.
Alt
Site Moderator
 
Posts: 2222
Joined: Tue Nov 11, 2008 2:13 pm

Re: Data Recovery from an encrypted drive that was formatted

Postby RForce » Wed May 03, 2017 5:18 pm

You should get a clone of the drive, decrypt the clone, then scan to recover the files.
RForce
 
Posts: 31
Joined: Wed Jul 09, 2014 9:05 am

Re: Data Recovery from an encrypted drive that was formatted

Postby Wksk » Wed May 03, 2017 6:04 pm

What was the original file system and what did you format it as?

Have you done anything to it since or have you left it alone?
Wksk
 
Posts: 2
Joined: Wed May 03, 2017 6:02 pm

Re: Data Recovery from an encrypted drive that was formatted

Postby Alt » Thu May 04, 2017 7:16 am

I'm afraid the drive was formatted over the McAfee Encryption information on the disk, and thus cannot be decrypted.
Alt
Site Moderator
 
Posts: 2222
Joined: Tue Nov 11, 2008 2:13 pm

Re: Data Recovery from an encrypted drive that was formatted

Postby Wksk » Thu May 04, 2017 4:46 pm

Hi Alt,

I am not that familiar with McAfee but i have had success with formatted encrypted drives using other encryption methods. Are you sure there is no backup metadata sectors that could be used to repopulate the overwritten ones and then force decryption?
Wksk
 
Posts: 2
Joined: Wed May 03, 2017 6:02 pm

Re: Data Recovery from an encrypted drive that was formatted

Postby Data-Medics » Mon May 08, 2017 9:04 am

I believe Mcafee Endpoint actually stores the DEK (disk encryption keys) on the management server, and they can be obtained from the admin account. I don't believe with Mcafee the disk encryption key is actually stored on the disk. That is, if we are talking about Mcafee Endpoint, and not some cheap OEM software they provided with an external drive (I think I've heard of this but not dealt with it).
Data-Medics
 
Posts: 133
Joined: Tue Oct 20, 2015 10:13 am
Location: Providence, RI USA


Return to Data Recovery

Who is online

Users browsing this forum: Bing [Bot], Google [Bot] and 1 guest