Data Recovery from an encrypted drive that was formatted

A forum on data recovery using the professional data recovery software R-STUDIO.
vt2017

Data Recovery from an encrypted drive that was formatted

Post by vt2017 » Wed May 03, 2017 4:13 am

By mistake I have formatted my external hard disk that had McAfee Encryption for removable media in place. There has been no action on this external hard disk subsequent to these steps. I tried some of the recovery tools, but none have helped. Is there any chance that I can recover my lost files?

Alt
Site Moderator
Posts: 2271
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Data Recovery from an encrypted drive that was formatted

Post by Alt » Wed May 03, 2017 9:18 am

I'm afraid no chances for recovery.

RForce
Posts: 31
Joined: Wed Jul 09, 2014 9:05 am

Re: Data Recovery from an encrypted drive that was formatted

Post by RForce » Wed May 03, 2017 5:18 pm

You should get a clone of the drive, decrypt the clone, then scan to recover the files.

Wksk
Posts: 2
Joined: Wed May 03, 2017 6:02 pm

Re: Data Recovery from an encrypted drive that was formatted

Post by Wksk » Wed May 03, 2017 6:04 pm

What was the original file system and what did you format it as?

Have you done anything to it since or have you left it alone?

Alt
Site Moderator
Posts: 2271
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Data Recovery from an encrypted drive that was formatted

Post by Alt » Thu May 04, 2017 7:16 am

I'm afraid the drive was formatted over the McAfee Encryption information on the disk, and thus cannot be decrypted.

Wksk
Posts: 2
Joined: Wed May 03, 2017 6:02 pm

Re: Data Recovery from an encrypted drive that was formatted

Post by Wksk » Thu May 04, 2017 4:46 pm

Hi Alt,

I am not that familiar with McAfee but i have had success with formatted encrypted drives using other encryption methods. Are you sure there is no backup metadata sectors that could be used to repopulate the overwritten ones and then force decryption?

Data-Medics
Posts: 146
Joined: Tue Oct 20, 2015 10:13 am
Location: Providence, RI USA
Contact:

Re: Data Recovery from an encrypted drive that was formatted

Post by Data-Medics » Mon May 08, 2017 9:04 am

I believe Mcafee Endpoint actually stores the DEK (disk encryption keys) on the management server, and they can be obtained from the admin account. I don't believe with Mcafee the disk encryption key is actually stored on the disk. That is, if we are talking about Mcafee Endpoint, and not some cheap OEM software they provided with an external drive (I think I've heard of this but not dealt with it).

Post Reply