Macfee Encryption - MfeEERM.exe won't load

[jordash]

I have an old drive which is encrypted using Macfee Endpoint Encryption for Removable Media, password is known. The date modified suggests it was setup in 2015. The drive is ok, the partition mounts and MfeEERM.exe is visible, but it won't run. Double clicking or running as administrator does absolutely nothing. I've searched the net but I can't find anywhere to download a replacement executable for this program. Trying to get Macfee Support to help is as difficult as you'd expect.

Has anyone come across an issue like this?

[fzabkar]

What do you see when you launch the file from a CMD window?

[jordash]

It does nothing at all



C:\WINDOWS\system32>d:

D:\>MfeEERM.exe

D:\>

[fzabkar]

https://demo.sceen.net/martine/Program%20Files/McAfee/Endpoint%20Encryption%20for%20Files%20and%20Folders/

https://www.virustotal.com/gui/url/12f5bde93b69485cf910599d2711f7ebf06025121074603624e08d36ef415444?nocache=1 (malware scan result)

[fzabkar]

I ran the EXE file in the absence of a USB flash drive. As in your case, the program produced no output and dropped back to the CMD prompt. This suggests to me that this is the expected behaviour when it is unable to find a hidden McAfee Endpoint partition.

[jordash]

Thanks for those links, I'll have a look.

When I examine the structure of the drive, there is just one single partition the full size of the 2tb capacity. It starts at lba 2048 as you'd expect and goes to the end. The encrypted files are under a folder on the top level of the partition (same as MfeEERM.exe) callled "McAfee EERM" that can be seen when the partition is examined with data recovery software. There doesn't seem to be any hidden partitions, and there's one file that can be seen when Show Hidden Files is selected in Explorer called mfecc32.dll. Perhaps its expecting some other missing files on that top level?

[jordash]

If I replace MfeEERM.exe on the drive with the .exe from those links, the console will open and prompt for a password. It seems to accept the password as it will say Please enter a correct password for any password input other than the known password. For the known password the password prompt goes away and opens the console, but no files will appear in it, it just has "Desktop" in the left panel. Clicking on it does nothing, and I can't drag and drop the location of the encrypted files, I can't get any further from that point. The MfeEERM.exe from those links is version 5.2.0.151, and the original is 4.2.0.178, so perhaps it won't work properly unless its the correct version.

I did have to adjust the permissions on the drive to allow me to make changes and replace MfeEERM.exe, so there is a chance it could be related to the altered permissions.

[dick]

Just a crazy thought.........as it is removable media encryption are you connecting the drive via a usb port as it might be the app will only detect external devices?

PSD is portable storage device.
https://docplayer.net/9860630-A-usb-por ... edure.html

[jordash]

Just a crazy thought.........as it is removable media encryption are you connecting the drive via a usb port as it might be the app will only detect external devices?

PSD is portable storage device.
https://docplayer.net/9860630-A-usb-por ... edure.html

That was a good idea, I had been connecting the cloned drive by SATA. But still no luck connecting by USB.

[jordash]

Actually I finally cracked it. I copied all the individual files and some of the encrytped files and the same folder structure onto another empty external drive, but then replaced MfeEERM.exe with the one provided in the link by fzabkar, which was a later version than the original. That MfeEERM.exe wouldn't open normally just like the original, but when placed on an external drive probably with some of the hidden folder structure it was looking for, it would open the console. Entering the password it then must have scanned all connected external drives and found the clone of the original containing all the encrypted data, and then opened it. Thanks everyone for your help.

[grevan]

Thank you for taking the time to update, good job.

[kweik]

Hi everyone, I'm having the same problem: the application isn't working, it gives an error and doesn't create the drive...

I know this post is quite old, but if anyone has the latest version of MfeEERM.exe, I would be incredibly grateful. My sister has 1.5 TB of photos of my nephew, and now she only has 976 files of 2 GB each called encrypted.dsk.xxx.

[WebClaw]

We've had success bypassing the software doing this:

Debian debian-10.12.0-amd64-netinst.iso was used as python 3.10 is not supported (newer dist. use newer version of Python).

apt-get install openssh-server
nano /etc/ssh/sshd_config and allow root
service sshd restart

apt-get install git
git clone https://github.com/RealityNet/McAFuse

apt-get install python3-pip
apt-get install pkg-config
apt-get install fuse3 libfuse3-dev libglib2.0-dev

python3 -m pip install -r requirements.txt

ensure image file of encrypted disk is mounted (eg: mount /dev/sdb1 /media/usb)

python3 ./mcafuse.py -i -a -v /media/xxx/root /media/usb/encrypted480.dsk -k key.xml

apt-get install testdisk

testdisk /file/located/in/media/10tb/*.enc

You'll need the keyfile though.

[kweik]

Thanks for the quickly reply!

I read the mcafuse.py documentation, the key.xml have the password to decrypt, but what's the sctructure? I need to convert the password in a base64 format with <key> tags? Because In my disc dont have key.xml inside..

"-k/--keyfile KEY_FILE: the XML file provided by McAfee FDE installation containing a <key> tag with base64 encoded password to decrypt the disk"


Thanks a lot!

[WebClaw]

Here is what a key.xml file looks like:

Code:

<MfeEpeExportMachineKey>
  <key>PLACEHOLDER</key>
  <algorithm>PLACEHOLDER</algorithm>
  <algInfo>PLACEHOLDER</algInfo>
  <recoveryData>
    <entries>
      <name>EpeMbr</name>
      <value>PLACEHOLDER</value>
    </entries>
    <entries>
      <name>OriginalMbr</name>
      <value>PLACEHOLDER</value>
    </entries>
  </recoveryData>
</MfeEpeExportMachineKey>


Some pre-populated default values are:

Code:

<algorithm>AES-256-CBC</algorithm>
<algInfo>Algorithm identifiers do not indicate device encryption algorithm</algInfo>
<name>EpeMbr</name>


[fzabkar]

if anyone has the latest version of MfeEERM.exe ...

I have 5.2.0.151. Would that be of any use to you?

https://ufile.io/ch690f5l

[kweik]

Thank you for your help fzabkar,
But I think the hdd is corrupted, because I cant to copy your tool in the disk :

The file cannot be deleted due to an unexpected error. If you continue to receive this error, you can use the error code to search for help with this problem.

The file or directory is corrupt or unreadable.




the root contains :



rea
and inside mcafee eerm folder have:

encrypted.bin.0
encrypted.dsk
encrypted.dsk1
encrypted.dsk2
..
encrypted.dsk976

(2tb data)


really thanks !

[pepe]

make a clone of the encrypted data first, and work on the copy.
Check if all the dsk files are present, the thing doesn't get mounted if any of those is missing.

[screenfixing]

I know this is an old thread with some recent action. Does anyone have an active download link for the MfeEERM.exe file they have used? I am in the same boat as most of you guys with this data recovery job.