I guess I must have been lucky in the past but this is the first time I have come across PGP so would like some advice please. This is a drive from a laptop.
The first 5 sectors seem to relate to PGP ending with a BGFS record at sector 4
Sector 6 - MBR
Sectors 13-16 - user ID information
Sector 17 has reference to UR WDE Admin Key.
Sector 62 - reference to the drive (model s/n etc)
From then on the data looks encrypted.
If I carve our an image starting from the MBR I get 2 partitions but with no file system.
I also have the recovery key from the client.
I have tried Elmcomsoft Forensic Disk Decryptor for whole disk encryption but that does not work.
Is this whole disk encryption or container?
Any other advice for me.
_________________
HDD, SSD, Flash and RAID Data RecoveryFounder of The Data Recovery Professionals Group