It is currently September 2nd, 2014, 10:00

All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 13 posts ] 
Author Message
 Post subject: Encrypted disk can i edit MBR?
PostPosted: April 4th, 2009, 7:57 
Offline

Joined: August 6th, 2007, 13:12
Posts: 160
Location: India
Hi
I have 40Gb laptop disk having 2partitions , initially both partitions were encrypted using PGP, now c drive is decrypted & is accessible , but for D drive it is not showing right MBR & file system so i cant decrypt it , is there any way to modify MBR to its working (NTFS) format?
Can we manually modify PGP encrypted disk so as one can decrypt them back?
Thanks
Hddbug


Top
 Profile  
 
 Post subject: Re: Encrypted disk can i edit MBR?
PostPosted: April 4th, 2009, 11:44 
Offline
User avatar

Joined: September 29th, 2005, 12:02
Posts: 2726
Location: Chicago
It is hard to answer you question
Usually PGP software writes special code into Boot Sector, so PGP driver can automatically recognize the partition
As far as I know there is nothing special in MBR

_________________
My hobby is numismatics - http://coins.zoxt.net/


Top
 Profile  
 
 Post subject: Re: Encrypted disk can i edit MBR?
PostPosted: April 9th, 2009, 2:00 
Offline

Joined: August 6th, 2007, 13:12
Posts: 160
Location: India
Hi Doomer thanks
It seems PGP uses a non-standard Windows bootloader called BootGuard which asks for decryption key. I am working on it & will post results.


Top
 Profile  
 
 Post subject: Re: Encrypted disk can i edit MBR?
PostPosted: April 12th, 2009, 8:51 
Offline

Joined: August 6th, 2007, 13:12
Posts: 160
Location: India
Hi Friends
I have cloned crashed disk & the partition which is encrypted is showing raw file system , is there any way to convert it into NTFS by altering its signature?
Here is screenshot of disk.
Thanks
Hddbug


Attachments:
PGP_disk.JPG
PGP_disk.JPG [ 95.41 KiB | Viewed 2758 times ]
Top
 Profile  
 
 Post subject: Re: Encrypted disk can i edit MBR?
PostPosted: April 12th, 2009, 10:07 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 4349
Location: Portugal
Quote:
is there any way to convert it into NTFS by altering its signature?

No pint in doing that, the data inside will still be encrypted ... You will need valid key to decrypt it, otherwise windows or any other disk editor tool that you might use on it will see the partition as *garbage* (encrypted data)... You can only make some sense of what is inside after decryption. If it was so easy as changing the signature and converting to NTFS, the encryption process wouldn't be good for nothing, the point of encrypting the data is to have it scambled in a way that nothing can obtain any valid information from it, until decrypted.

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
The HDD Oracle - Place for open discourse on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Encrypted disk can i edit MBR?
PostPosted: April 12th, 2009, 10:47 
Offline

Joined: August 6th, 2007, 13:12
Posts: 160
Location: India
Hi Spildit
Yes , i have correct passphease to decrypt disk , unfortunately dur to MBR errors PGP decryption is not working so i need to fix this MBR issue first in order to decrypt Data.
Thanks
Hddbug


Top
 Profile  
 
 Post subject: Re: Encrypted disk can i edit MBR?
PostPosted: April 12th, 2009, 11:27 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 4349
Location: Portugal
Hi there !
You will need somehow to force the decryption of the entire volume using the key that you have.
The problem is that yous MBR and possible first sectors of the partition are damaged, and when PGP tryes to decryt them with the valid key that you have, since the sectors are damaged, PGP gets *garbage* and assumes that the key that you have entered is incorrect. You can't fix the MBR neither anything with the volume encrypted, you can only fix after decryption, so you have to somehow arrannge a way to force PGP to decrypt the volume with the key that you have, and only than you will have your data on a form that you can view with a disk editor like winhex, and only than you can try to repair the MBR with something like testdisk ...
The big problem is that as long the data is encrypted you can't fix anything because it's just random bits that no one will be able to do any sense with.
I don't use PGO but i use TrueCrypt and when you do a full drive encryption you are forced to burn a boot CD (and actualy you can't encrypt the drive if you don't do that) and that CD will allow among other things to force a full decryption of the volume if any problem arise.
I guess that you will have to find a way to decrypt with the key you have without PGP checking if the output data is correct or not, just decrypt what you can, without checking if you have enetered a valid key or not.
Maybe contacting PGP support for help ?
I would recommend TrueCrypt instead of PGP because it's more secure, freeware and you can even do combinations of cyphers, like encrypt using Serpent-Towfish-AES at the same time ....

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
The HDD Oracle - Place for open discourse on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Encrypted disk can i edit MBR?
PostPosted: April 13th, 2009, 2:26 
Offline

Joined: August 6th, 2007, 13:12
Posts: 160
Location: India
Hi Spildit
Thanks for detailed explanation. I tried to forcefully decrypt using PGP recovery CD , it tooks 13 hours & at the end PGP gave error Data Corrupted. It was a great learning experience.
Thanks & Regards
hddbug


Top
 Profile  
 
 Post subject: Re: Encrypted disk can i edit MBR?
PostPosted: April 13th, 2009, 5:29 
Offline

Joined: July 19th, 2008, 17:42
Posts: 64
Could you not have used the boot sector back-up ?


Top
 Profile  
 
 Post subject: Re: Encrypted disk can i edit MBR?
PostPosted: April 13th, 2009, 12:33 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 4349
Location: Portugal
:D

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
The HDD Oracle - Place for open discourse on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Encrypted disk can i edit MBR?
PostPosted: April 14th, 2009, 2:52 
Offline

Joined: August 6th, 2007, 13:12
Posts: 160
Location: India
hi
its my customers disk & they have not taken backup.
Thanks


Top
 Profile  
 
 Post subject: Re: Encrypted disk can i edit MBR?
PostPosted: April 14th, 2009, 3:44 
Offline

Joined: July 19th, 2008, 17:42
Posts: 64
hddbug wrote:
hi
its my customers disk & they have not taken backup.
Thanks


:shock:


Top
 Profile  
 
 Post subject: Re: Encrypted disk can i edit MBR?
PostPosted: April 14th, 2009, 14:42 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 4349
Location: Portugal
Boot sector back-up should be on the PGP recovery CD that you have used to force the decryption ...

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
The HDD Oracle - Place for open discourse on Data Recovery.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 13 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Bing [Bot], gtd4242 and 15 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group